System and method for managing installation of an application package requiring high-risk permission access

A mobile device, comprising:

• a processor, and
• a non-transitory storage medium storing instructions readable by the processor;
• wherein the processor executes the instructions to cause the mobile device to:
• receive an installation request for installing an application package (APK) in the mobile device;
• retrieve a permission certificate for the APK according to the installation request, wherein the permission certificate for the APK comprises a cryptographic signature;
• verify the cryptographic signature using a permission certification public key of a manufacturer of the mobile device to determine validity of the permission certificate, wherein the permission certification public key is stored in the mobile device, and wherein a valid permission certificate indicates that the manufacturer of the mobile device permits the installation of the APK in the mobile device;
• and
• allow the installation of the APK in the mobile device based on the permission certificate being determined to be valid;
• wherein in verifying the cryptographic signature to determine the validity of the permission certificate, the instructions cause the mobile device to:
• compute a cryptographic hash of the APK using a cryptographic hash function;
• and
• compare the cryptographic hash of the APK with another cryptographic hash of the APK stored in the permission certificate;
• wherein the cryptographic signature included in the permission certificate is generated at a server associated with the manufacturer of the mobile device based on a permission certification private key of the manufacturer of the mobile device being used to cryptographically sign the permission certificate for the APK;
• and
• wherein the cryptographically signed permission certificate for the APK comprises:
• a development public key of the APK, a name of the APK, permission or permissions granted to the APK, and a validity period of the permission certificate.