ES2722533T3 - Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto - Google Patents

Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto Download PDF

Info

Publication number
ES2722533T3
ES2722533T3 ES16794084T ES16794084T ES2722533T3 ES 2722533 T3 ES2722533 T3 ES 2722533T3 ES 16794084 T ES16794084 T ES 16794084T ES 16794084 T ES16794084 T ES 16794084T ES 2722533 T3 ES2722533 T3 ES 2722533T3
Authority
ES
Spain
Prior art keywords
apk
certificate
installation
permission
permit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
ES16794084T
Other languages
English (en)
Inventor
Yongzheng Wu
Xuejun Wen
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei International Pte Ltd
Original Assignee
Huawei International Pte Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei International Pte Ltd filed Critical Huawei International Pte Ltd
Application granted granted Critical
Publication of ES2722533T3 publication Critical patent/ES2722533T3/es
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/67—Risk-dependent, e.g. selecting a security level depending on risk profiles

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

Un método para gestionar la instalación de un paquete de aplicación Android, APK, en un dispositivo, el método comprende: recibir, por parte del dispositivo, una petición de instalación para el APK; recuperar, por parte del dispositivo, un certificado de permisos para el APK de acuerdo con la petición de instalación, en donde el certificado de permisos para el APK incluye una firma criptográfica; determinar, por parte del dispositivo, la validez del certificado de permisos verificando la firma criptográfica incluida en el certificado de permisos utilizando una clave pública de la certificación del permiso del fabricante del dispositivo, en donde la clave pública de la certificación del permiso está almacenada en el dispositivo; y permitir la instalación del APK en el dispositivo cuando se determina que el certificado de permisos es válido; en donde la firma criptográfica incluida en el certificado de permisos se genera en un servidor asociado con el fabricante del dispositivo cuando se utiliza una clave privada de la certificación del permiso del fabricante del dispositivo para firmar criptográficamente el certificado de permisos para el APK; en donde el certificado de permisos firmado criptográficamente para el APK comprende la clave pública de desarrollo del APK, el nombre del APK; el permiso concedido al APK y el periodo de validez del certificado de permisos.
ES16794084T 2015-11-06 2016-11-03 Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto Active ES2722533T3 (es)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
SG10201509221YA SG10201509221YA (en) 2015-11-06 2015-11-06 System and method for managing installation of an application package requiring high-risk permission access
PCT/SG2016/050539 WO2017078624A1 (en) 2015-11-06 2016-11-03 System and method for managing installation of an application package requiring high-risk permission access

Publications (1)

Publication Number Publication Date
ES2722533T3 true ES2722533T3 (es) 2019-08-13

Family

ID=57256394

Family Applications (1)

Application Number Title Priority Date Filing Date
ES16794084T Active ES2722533T3 (es) 2015-11-06 2016-11-03 Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto

Country Status (6)

Country Link
US (2) US10873466B2 (es)
EP (1) EP3274897B1 (es)
CN (1) CN107615292B (es)
ES (1) ES2722533T3 (es)
SG (1) SG10201509221YA (es)
WO (1) WO2017078624A1 (es)

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190007212A1 (en) * 2017-06-30 2019-01-03 Intel Corporation Secure unlock systems for locked devices
CN107392589B (zh) * 2017-07-01 2023-08-01 武汉天喻信息产业股份有限公司 Android系统智能POS系统、安全验证方法、存储介质
GB2566265B (en) * 2017-09-01 2020-05-13 Trustonic Ltd Post-manufacture generation of device certificate and private key for public key infrastructure
GB2566263A (en) 2017-09-01 2019-03-13 Trustonic Ltd Post-manufacture certificate generation
KR101982085B1 (ko) * 2018-04-25 2019-05-27 주식회사쿠콘 스크립트 엔진을 이용한 데이터 스크래핑 시스템, 방법 및 컴퓨터 프로그램
US20190362066A1 (en) * 2018-05-25 2019-11-28 Microsoft Technology Licensing, Llc Accessing secure system resources by low privilege processes
US10977024B2 (en) * 2018-06-15 2021-04-13 Sierra Wireless, Inc. Method and apparatus for secure software update
CN109343871A (zh) * 2018-12-07 2019-02-15 武汉掌游科技有限公司 应用程序打包的方法、装置、设备及存储介质
CN111414588B (zh) * 2019-01-08 2023-03-31 杭州海康威视数字技术股份有限公司 授权密钥生成方法和授权密钥生成装置以及授权服务器
US11467815B2 (en) * 2019-01-17 2022-10-11 Vmware, Inc. Package distribution and installation in response to user logon
US11361660B2 (en) 2019-03-25 2022-06-14 Micron Technology, Inc. Verifying identity of an emergency vehicle during operation
US11218330B2 (en) * 2019-03-25 2022-01-04 Micron Technology, Inc. Generating an identity for a computing device using a physical unclonable function
CN110166473B (zh) * 2019-05-29 2021-08-27 中国移动通信集团江苏有限公司 网络数据传输检测方法、装置、设备和介质
CN110362990A (zh) * 2019-05-31 2019-10-22 口碑(上海)信息技术有限公司 应用安装的安全处理方法、装置及系统
CN110442357B (zh) * 2019-08-09 2022-11-01 四川虹美智能科技有限公司 一种应用安装管理方法、智能设备以及系统
US11204983B2 (en) * 2019-12-26 2021-12-21 Salesforce.Com, Inc. Scoring cloud packages for risk assessment automation
CN111147259B (zh) * 2019-12-26 2022-01-14 华为技术有限公司 鉴权方法和设备
CN111787529B (zh) * 2020-07-17 2021-06-29 江苏海全科技有限公司 适于Android智能POS机应用的签名方法和系统
US11468199B2 (en) * 2020-07-22 2022-10-11 Apple Inc. Authenticated debug for computing systems
CN114065229A (zh) * 2020-07-31 2022-02-18 华为技术有限公司 一种权限管理方法及终端设备
CN112235797B (zh) * 2020-12-11 2021-03-09 信联科技(南京)有限公司 一种基于sdn的设备网络接入认证方法
CN113296657B (zh) * 2021-06-30 2022-03-18 中国平安人寿保险股份有限公司 安卓系统的危险权限管理方法、装置、设备及存储介质
CN113886894B (zh) * 2021-09-27 2026-03-27 北京三博安科技有限公司 数字签名方法和数字签名设备
CN116049799B (zh) * 2022-07-14 2023-11-07 荣耀终端有限公司 系统权限管理方法、系统及电子设备

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6976163B1 (en) * 2000-07-12 2005-12-13 International Business Machines Corporation Methods, systems and computer program products for rule based firmware updates utilizing certificate extensions and certificates for use therein
EP1420323A1 (en) * 2002-11-18 2004-05-19 Koninklijke KPN N.V. Method and system for distribution of software components
US8312262B2 (en) * 2004-04-30 2012-11-13 Qualcomm Incorporated Management of signing privileges for a cryptographic signing service
US20060093149A1 (en) * 2004-10-30 2006-05-04 Shera International Ltd. Certified deployment of applications on terminals
EP2248366A4 (en) * 2008-01-29 2014-04-09 Qualcomm Inc SECURE APPLICATION SIGNATURE
KR101590188B1 (ko) * 2009-05-08 2016-01-29 삼성전자주식회사 휴대단말기에서 소프트웨어 패키지의 무결성을 검증하는 방법
US8589691B1 (en) 2009-08-17 2013-11-19 Google Inc. Self-signed certificates for computer application signatures
CN101969440B (zh) * 2010-10-28 2013-06-19 四川长虹电器股份有限公司 软件证书生成方法
DE102011015711A1 (de) * 2011-03-31 2012-10-04 Giesecke & Devrient Gmbh Aktualisierung einer Datenträgerapplikation
US8763080B2 (en) 2011-06-07 2014-06-24 Blackberry Limited Method and devices for managing permission requests to allow access to a computing resource
US9009856B2 (en) * 2011-12-16 2015-04-14 Dell Products L.P. Protected application programming interfaces
CN103248481B (zh) 2012-02-10 2016-04-06 工业和信息化部电信传输研究所 一种基于应用数字签名认证的开放api公共授权访问控制的方法
US9003507B2 (en) 2012-03-23 2015-04-07 Cloudpath Networks, Inc. System and method for providing a certificate to a third party request
CN102663320A (zh) 2012-04-12 2012-09-12 福建联迪商用设备有限公司 终端识别开发者及划分不同权限开发者的方法
WO2014000696A1 (zh) 2012-06-28 2014-01-03 北京奇虎科技有限公司 一种Android应用程序的安全检测方法及系统
US9294468B1 (en) * 2013-06-10 2016-03-22 Google Inc. Application-level certificates for identity and authorization
CN103561006B (zh) 2013-10-24 2017-05-10 北京奇虎科技有限公司 基于安卓系统的应用认证方法和装置及应用认证服务器
CN103778367A (zh) 2013-12-30 2014-05-07 网秦（北京）科技有限公司 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器
CN103905207B (zh) 2014-04-23 2017-02-01 福建联迪商用设备有限公司 一种统一apk签名的方法及其系统
CN103944903B (zh) 2014-04-23 2017-02-15 福建联迪商用设备有限公司 一种多方授权的apk签名方法及系统
US9934014B2 (en) * 2014-08-22 2018-04-03 Apple Inc. Automatic purposed-application creation

Also Published As

Publication number Publication date
US11637707B2 (en) 2023-04-25
US10873466B2 (en) 2020-12-22
EP3274897A1 (en) 2018-01-31
WO2017078624A1 (en) 2017-05-11
US20180248702A1 (en) 2018-08-30
US20210091963A1 (en) 2021-03-25
CN107615292A (zh) 2018-01-19
SG10201509221YA (en) 2017-06-29
CN107615292B (zh) 2020-12-25
EP3274897B1 (en) 2019-02-27

Similar Documents

Publication Publication Date Title
ES2722533T3 (es) Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto
BR112018011353A2 (pt) método e sistema para provisão e armazenamento de chave criptografada distribuída via criptografia de curva elíptica
CL2020000081A1 (es) Generación de declaración de autenticación de claves que proporcionan el anonimato del dispositivo.
MX2019004660A (es) Esquema de administracion de nombre de dominio para interacciones de cadena cruzada en sistemas de cadena de bloques.
BR112015026372B8 (pt) Dispositivo de comunicação que reforça a segurança para um arquivo armazenado em uma unidade virtual
BR112016023842A2 (pt) sistemas, aparelhos e métodos para autenticação melhorada
GB2573666A (en) Verifying authenticity of computer readable information using the blockchain
BR112018016810A2 (pt) método e sistema implementado por computador para criptografia de dados em um dispositivo eletrônico, dispositivo eletrônico e programa de computador
BR112017005824A2 (pt) método, e, dispositivo móvel.
BR112016017947A2 (pt) Método implementado por computador, dispositivo de acesso, e, sistema
AR102007A1 (es) Sistema, método implementado por computadora y dispositivo informático de autenticación para acceder a recursos en base a desafíos
CO2019007875A2 (es) Direccionamiento de un entorno de ejecución confiable utilizando clave de firma
NZ744540A (en) Systems and methods for providing block chain-based multifactor personal identity verification
BR112018015254A2 (pt) método de transferência de dados, método de controle de uso de dados, e dispositivo criptográfico
BR112019000805A2 (pt) sistema e método para gerenciamento de chave de ponta a ponta
NZ744353A (en) Networked access control system
GB2458844A (en) Format-preserving cryptographic systems
MX2018007332A (es) Metodo, dispositivo, servidor y sistema para autenticar a un usuario.
MX2016014461A (es) Aprovisionamiento de licencias de gestion de derechos digitales (drm) en un dispositivo cliente que utiliza un servidor de actualizaciones.
BR112014012653A8 (pt) sistema e método para o gerenciamento de chave para domínio de segurança do emissor ao usar especificações da global platform
RU2010100880A (ru) Создание и проверка достоверности документов, защищенных криптографически
JP2019501431A5 (es)
BR112015032837A2 (pt) método para inscrever um certificado em um dispositivo utilizando scep e aplicativo de gerenciamento respectivo
GB2533727A (en) Registry apparatus, agent device, application providing apparatus and corresponding methods
EP4425356A3 (en) Delegated administration of permissions using a contactless card