Software signing certificate reputation model
AssigneeSymantec Corporation
InventorsWilliam E. Sobel, Bruce E. McCorkendale
Life of this patent
Estimating the term…
Abstract
A request from a software developer is received to digitally sign software included in the request. A security policy associated with the software developer is accessed where the security policy describes criteria for valid request by the software developer. A determination is made whether the request is valid based at least in part on the security policy. The software is digitally signed responsive to the determination indicating that the request is valid. The digitally signed software is provided to the software developer.
Claims20
A computer-implemented method for using a computer system of a certificate authority to digitally sign software, the method comprising:
- receiving a request from a software developer to digitally sign software included in the request;
- accessing a security policy associated with the software developer, the security policy describing criteria for valid requests by the software developer;
- determining whether the request is valid based at least in part on whether one or more of the criteria for valid requests is met;
- using the computer system to digitally sign the software responsive to the determination indicating that the request is valid;
- embedding reputation information associated with the digitally-signed software in a digital certificate, the reputation information indicative of which of the one or more criteria for valid requests that were met in the determination of whether the request is valid, the one or more criteria for valid requests comprising geo-locations from which valid requests are issued by the software developer;
- and
- providing the digitally-signed software and the digital certificate to the software developer.
A computer program product comprising a non-transitory computer-readable storage medium storing computer-executable code, the code when executed by a computer processor performs steps comprising:
- receiving a request from a software developer to digitally sign software included in the request;
- accessing a security policy associated with the software developer, the security policy describing criteria for valid requests by the software developer;
- determining whether the request is valid based at least in part on whether one or more of the criteria for valid requests is met;
- digitally signing the software responsive to the determination indicating that the request is valid;
- embedding reputation information associated with the digitally-signed software in a digital certificate, the reputation information indicative of which of the one or more criteria for valid requests that were met in the determination of whether the request is valid, the one or more criteria for valid requests comprising geo-locations from which valid requests are issued by the software developer;
- and
- providing the digitally-signed software and the digital certificate to the software developer.
A computer system of a certificate authority for digitally signing software, the system comprising:
- a computer processor;
- and
- a non-transitory computer readable storage medium storing computer code configured to execute on the computer processor, the computer code when executed performs steps comprising:
- receiving a request from a software developer to digitally sign software included in the request;
- accessing a security policy associated with the software developer, the security policy describing criteria for valid requests by the software developer;
- determining whether the request is valid based at least in part on whether one or more of the criteria for valid requests is met;
- digitally signing the software responsive to the determination indicating that the request is valid;
- embedding reputation information associated with the digitally-signed software in a digital certificate, the reputation information indicative of which of the one or more criteria for valid requests that were met in the determination of whether the request is valid, the one or more criteria for valid requests comprising geo-locations from which valid requests are issued by the software developer;
- and
- providing the digitally-signed software and the digital certificate to the software developer.
Dependencies are inferred from the claim text.