# US 11,030,278 B2 · Code signing system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,278 B2 - Document ID: US11030278B2 - Status: Granted - Kind: B2 - Application number: 16/543,201 - Filed: 2019-08-16 - Published: 2019-12-26 - Granted: 2021-06-08 - Earliest claimed: 2000-09-21 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: David Paul Yach; Herbert Anthony Little; Michael Stephen Brown - Web page: https://patentgrep.com/patent/US11030278B2 ## CPC - H04L 63/123: {received data contents, e.g. message integrity} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/121: {Restricting unauthorised execution of programs} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/629: {to features or functions of an application} - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3247: {involving digital signatures} - H04L 63/126: {the source of the received data} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04W 4/60: Subscription-based services using application servers or record carriers, e.g. SIM application toolkits - H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A novel code signing system, computer readable media, and method are provided. The code signing method includes receiving a code signing request from a requestor in order to gain access to one or more specific application programming interfaces (APIs). A digital signature is provided to the requestor. The digital signature indicates authorization by a code signing authority for code of the requestor to access the one or more specific APIs. In one example, the digital signature is provided by the code signing authority or a delegate thereof. In another example, the code signing request may include one or more of the following: code, an application, a hash of an application, an abridged version of the application, a transformed version of an application, a command, a command argument, and a library. ## Claims ### Claim 1 A mobile device comprising: one or more hardware processors enabled to receive a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device; at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, and wherein the signed application comprises a digital signature generated by a device external to the mobile device; and at least one non-sensitive API, wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API. ### Claim 2 (depends on 1) The mobile device of claim 1, wherein the signed application is signed using a private key. ### Claim 3 (depends on 2) The mobile device of claim 2, wherein the private key is stored by the code signing authority. ### Claim 4 (depends on 1) The mobile device of claim 1, wherein the signed application is signed using a hash of a software application, the software application being comprised in code. ### Claim 5 (depends on 1) The mobile device of claim 1, wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code. ### Claim 6 (depends on 1) The mobile device of claim 1, wherein the one or more hardware processors enabled are further enabled to verify the digital signature of the signed application using a corresponding public key. ### Claim 7 (depends on 6) The mobile device of claim 6, wherein the corresponding public key is associated with a manufacturer of the mobile device. ### Claim 8 A method implemented in a mobile device, the method comprising: receiving a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device, wherein the mobile device comprises at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, wherein the signed application comprises a digital signature generated by a device external to the mobile device, wherein the mobile device further comprises at least one non-sensitive API, and wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API. ### Claim 9 (depends on 8) The method of claim 8, wherein the signed application is signed using a private key. ### Claim 10 (depends on 9) The method of claim 9, wherein the private key is stored by the code signing authority. ### Claim 11 (depends on 8) The method of claim 8, wherein the signed application is signed using a hash of a software application, the software application being comprised in code. ### Claim 12 (depends on 8) The method of claim 8, wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code. ### Claim 13 (depends on 8) The method of claim 8, further comprising verifying the digital signature of the signed application using a corresponding public key. ### Claim 14 (depends on 13) The method of claim 13, wherein the corresponding public key is associated with a manufacturer of the mobile device. ### Claim 15 A non-transitory computer readable medium storing instructions that when executed by one or more processors of a mobile device, cause the one or more processors to implement a method comprising: receiving a signed application from a software developer, wherein the signed application is signed by a code signing authority, wherein the signed application is to be loaded on the mobile device, wherein the mobile device comprises at least one sensitive application programming interface (API), wherein the signed application is authorized to access the at least one sensitive API, wherein the signed application comprises a digital signature generated by a device external to the mobile device, wherein the mobile device further comprises at least one non-sensitive API, and wherein access to the at least one sensitive API is further restricted relative to the at least one non-sensitive API. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the signed application is signed using a private key. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the private key is stored by the code signing authority. ### Claim 18 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the signed application is signed using a hash of a software application, the software application being comprised in code. ### Claim 19 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the signed application is signed using an abridged version of a software application, the software application being comprised in code. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the method further comprises verifying the digital signature of the signed application using a corresponding public key.