Back to results
US 8,301,903 B2Granted
Low-level code signing mechanism
AssigneeResearch In Motion Limited
InventorsDavid MacFarlane, Michael K. Brown
Life of this patent
Estimating the term…
Abstract
Before an application is allowed to execute a secure function, code signing keys associated with the application are analyzed for correspondence with the class that contains the secure function as well as correspondence with the secure function. Optionally, code signing keys associated with the application are analyzed for correspondence with the input parameters to the function.
Claims17
A method for verifying that a given application is to be permitted access to a secure subroutine, said method comprising:
- obtaining code for said given application;
- obtaining a subroutine cryptographic identifier associated with said given application and associated with said secure subroutine, wherein said secure subroutine is associated with a secure input parameter;
- obtaining an input parameter cryptographic identifier associated with said given application and associated with said secure input parameter;
- obtaining a hash of said code for said given application;
- decoding said subroutine cryptographic identifier, using a locally-stored public key associated with said secure subroutine, to obtain a decoded subroutine cryptographic identifier;
- decoding said input parameter cryptographic identifier, using a locally-stored public key associated with said secure input parameter, to obtain a decoded input parameter cryptographic identifier;
- determining that said hash of said code matches said decoded subroutine cryptographic identifier;
- determining that said hash of said code matches said decoded input parameter cryptographic identifier;
- and
- responsive to determining that said hash of said code matches said decoded subroutine cryptographic identifier and that said hash of said code matches said decoded input parameter cryptographic identifier, allowing said application to execute said secure subroutine.
7 more elements
A computing apparatus comprising:
- a processor;
- a memory for storing:
- code for a given application;
- a subroutine cryptographic identifier associated with said given application and associated with said secure subroutine, wherein said secure subroutine is associated with a secure input parameter;
- an input parameter cryptographic identifier associated with said given application and associated with said secure input parameter;
- said processor being configured to verify that an application should be given access to said secure subroutine by:
- obtaining a hash of said code for said given application;
- decoding said subroutine cryptographic identifier, using a locally-stored public key associated with said secure subroutine, to obtain a decoded subroutine cryptographic identifier;
- decoding said input parameter cryptographic identifier, using a locally-stored public key associated with said secure input parameter, to obtain a decoded input parameter cryptographic identifier:
- determining that said hash of said code matches said decoded subroutine cryptographic identifier;
- determining that said hash of said code matches said decoded input parameter cryptographic identifier;
- and
- responsive to determining that said hash of said code matches said decoded subroutine cryptographic identifier and that said hash of said code matches said decoded input parameter cryptographic identifier, allowing said application to execute said secure subroutine.
10 more elements
A non-transitory computer readable medium storing computer-executable instructions that, when executed by a processor to verify that a given application should be given access to a secure subroutine, cause said processor to:
- obtain code for said given application;
- obtain a subroutine cryptographic identifier associated with said given application and associated with said secure subroutine, wherein said secure subroutine is associated with a secure input parameter;
- obtain an input parameter cryptographic identifier associated with said given application and associated with said secure input parameter;
- obtain a hash of said code for said given application;
- decode said subroutine cryptographic identifier, using a locally-stored public key associated with said secure subroutine, to obtain a decoded subroutine cryptographic identifier;
- decode said input parameter cryptographic identifier, using a locally-stored public key associated with said secure input parameter, to obtain a decoded input parameter cryptographic identifier;
- determine that said hash of said code matches said decoded subroutine cryptographic identifier;
- determine that said hash of said code matches said decoded input parameter cryptographic identifier;
- and
- responsive to determining that said hash of said code matches said decoded subroutine cryptographic identifier and that said hash of said code matches said decoded input parameter cryptographic identifier, allow said application to execute said secure subroutine.
7 more elements
Dependencies are inferred from the claim text.