ES2722533T3 - Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto - Google Patents

Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto Download PDF

Info

Publication number
ES2722533T3
ES2722533T3 ES16794084T ES16794084T ES2722533T3 ES 2722533 T3 ES2722533 T3 ES 2722533T3 ES 16794084 T ES16794084 T ES 16794084T ES 16794084 T ES16794084 T ES 16794084T ES 2722533 T3 ES2722533 T3 ES 2722533T3
Authority
ES
Spain
Prior art keywords
apk
certificate
installation
permission
permit
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
ES16794084T
Other languages
English (en)
Inventor
Yongzheng Wu
Xuejun Wen
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei International Pte Ltd
Original Assignee
Huawei International Pte Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei International Pte Ltd filed Critical Huawei International Pte Ltd
Application granted granted Critical
Publication of ES2722533T3 publication Critical patent/ES2722533T3/es
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/67—Risk-dependent, e.g. selecting a security level depending on risk profiles

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

Un método para gestionar la instalación de un paquete de aplicación Android, APK, en un dispositivo, el método comprende: recibir, por parte del dispositivo, una petición de instalación para el APK; recuperar, por parte del dispositivo, un certificado de permisos para el APK de acuerdo con la petición de instalación, en donde el certificado de permisos para el APK incluye una firma criptográfica; determinar, por parte del dispositivo, la validez del certificado de permisos verificando la firma criptográfica incluida en el certificado de permisos utilizando una clave pública de la certificación del permiso del fabricante del dispositivo, en donde la clave pública de la certificación del permiso está almacenada en el dispositivo; y permitir la instalación del APK en el dispositivo cuando se determina que el certificado de permisos es válido; en donde la firma criptográfica incluida en el certificado de permisos se genera en un servidor asociado con el fabricante del dispositivo cuando se utiliza una clave privada de la certificación del permiso del fabricante del dispositivo para firmar criptográficamente el certificado de permisos para el APK; en donde el certificado de permisos firmado criptográficamente para el APK comprende la clave pública de desarrollo del APK, el nombre del APK; el permiso concedido al APK y el periodo de validez del certificado de permisos.
ES16794084T 2015-11-06 2016-11-03 Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto Active ES2722533T3 (es)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
SG10201509221YA SG10201509221YA (en) 2015-11-06 2015-11-06 System and method for managing installation of an application package requiring high-risk permission access
PCT/SG2016/050539 WO2017078624A1 (en) 2015-11-06 2016-11-03 System and method for managing installation of an application package requiring high-risk permission access

Publications (1)

Publication Number Publication Date
ES2722533T3 true ES2722533T3 (es) 2019-08-13

Family

ID=57256394

Family Applications (1)

Application Number Title Priority Date Filing Date
ES16794084T Active ES2722533T3 (es) 2015-11-06 2016-11-03 Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto

Country Status (6)

Country Link
US (2) US10873466B2 (es)
EP (1) EP3274897B1 (es)
CN (1) CN107615292B (es)
ES (1) ES2722533T3 (es)
SG (1) SG10201509221YA (es)
WO (1) WO2017078624A1 (es)

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190007212A1 (en) * 2017-06-30 2019-01-03 Intel Corporation Secure unlock systems for locked devices
CN107392589B (zh) * 2017-07-01 2023-08-01 武汉天喻信息产业股份有限公司 Android系统智能POS系统、安全验证方法、存储介质
GB2566265B (en) * 2017-09-01 2020-05-13 Trustonic Ltd Post-manufacture generation of device certificate and private key for public key infrastructure
GB2566263A (en) 2017-09-01 2019-03-13 Trustonic Ltd Post-manufacture certificate generation
KR101982085B1 (ko) * 2018-04-25 2019-05-27 주식회사쿠콘 스크립트 엔진을 이용한 데이터 스크래핑 시스템, 방법 및 컴퓨터 프로그램
US20190362066A1 (en) * 2018-05-25 2019-11-28 Microsoft Technology Licensing, Llc Accessing secure system resources by low privilege processes
US10977024B2 (en) * 2018-06-15 2021-04-13 Sierra Wireless, Inc. Method and apparatus for secure software update
CN109343871A (zh) * 2018-12-07 2019-02-15 武汉掌游科技有限公司 应用程序打包的方法、装置、设备及存储介质
CN111414588B (zh) * 2019-01-08 2023-03-31 杭州海康威视数字技术股份有限公司 授权密钥生成方法和授权密钥生成装置以及授权服务器
US11467815B2 (en) * 2019-01-17 2022-10-11 Vmware, Inc. Package distribution and installation in response to user logon
CN110166473B (zh) * 2019-05-29 2021-08-27 中国移动通信集团江苏有限公司 网络数据传输检测方法、装置、设备和介质
CN110362990A (zh) * 2019-05-31 2019-10-22 口碑(上海)信息技术有限公司 应用安装的安全处理方法、装置及系统
CN110442357B (zh) * 2019-08-09 2022-11-01 四川虹美智能科技有限公司 一种应用安装管理方法、智能设备以及系统
CN111147259B (zh) * 2019-12-26 2022-01-14 华为技术有限公司 鉴权方法和设备
US11204983B2 (en) * 2019-12-26 2021-12-21 Salesforce.Com, Inc. Scoring cloud packages for risk assessment automation
CN111787529B (zh) * 2020-07-17 2021-06-29 江苏海全科技有限公司 适于Android智能POS机应用的签名方法和系统
US11468199B2 (en) * 2020-07-22 2022-10-11 Apple Inc. Authenticated debug for computing systems
CN114741720B (zh) * 2020-07-31 2023-03-24 华为技术有限公司 一种权限管理方法及终端设备
CN112235797B (zh) * 2020-12-11 2021-03-09 信联科技(南京)有限公司 一种基于sdn的设备网络接入认证方法
CN113296657B (zh) * 2021-06-30 2022-03-18 中国平安人寿保险股份有限公司 安卓系统的危险权限管理方法、装置、设备及存储介质
CN116049799B (zh) * 2022-07-14 2023-11-07 荣耀终端有限公司 系统权限管理方法、系统及电子设备

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6976163B1 (en) * 2000-07-12 2005-12-13 International Business Machines Corporation Methods, systems and computer program products for rule based firmware updates utilizing certificate extensions and certificates for use therein
EP1420323A1 (en) * 2002-11-18 2004-05-19 Koninklijke KPN N.V. Method and system for distribution of software components
US8312262B2 (en) * 2004-04-30 2012-11-13 Qualcomm Incorporated Management of signing privileges for a cryptographic signing service
US20060093149A1 (en) * 2004-10-30 2006-05-04 Shera International Ltd. Certified deployment of applications on terminals
US20090210702A1 (en) * 2008-01-29 2009-08-20 Palm, Inc. Secure application signing
KR101590188B1 (ko) * 2009-05-08 2016-01-29 삼성전자주식회사 휴대단말기에서 소프트웨어 패키지의 무결성을 검증하는 방법
US8589691B1 (en) 2009-08-17 2013-11-19 Google Inc. Self-signed certificates for computer application signatures
CN101969440B (zh) * 2010-10-28 2013-06-19 四川长虹电器股份有限公司 软件证书生成方法
DE102011015711A1 (de) * 2011-03-31 2012-10-04 Giesecke & Devrient Gmbh Aktualisierung einer Datenträgerapplikation
US8763080B2 (en) 2011-06-07 2014-06-24 Blackberry Limited Method and devices for managing permission requests to allow access to a computing resource
US9009856B2 (en) * 2011-12-16 2015-04-14 Dell Products L.P. Protected application programming interfaces
CN103248481B (zh) 2012-02-10 2016-04-06 工业和信息化部电信传输研究所 一种基于应用数字签名认证的开放api公共授权访问控制的方法
US9137234B2 (en) 2012-03-23 2015-09-15 Cloudpath Networks, Inc. System and method for providing a certificate based on granted permissions
CN102663320A (zh) 2012-04-12 2012-09-12 福建联迪商用设备有限公司 终端识别开发者及划分不同权限开发者的方法
WO2014000696A1 (zh) 2012-06-28 2014-01-03 北京奇虎科技有限公司 一种Android应用程序的安全检测方法及系统
US9294468B1 (en) * 2013-06-10 2016-03-22 Google Inc. Application-level certificates for identity and authorization
CN103561006B (zh) 2013-10-24 2017-05-10 北京奇虎科技有限公司 基于安卓系统的应用认证方法和装置及应用认证服务器
CN103778367A (zh) 2013-12-30 2014-05-07 网秦（北京）科技有限公司 基于应用证书来检测应用安装包的安全性的方法、终端以及辅助服务器
CN103905207B (zh) 2014-04-23 2017-02-01 福建联迪商用设备有限公司 一种统一apk签名的方法及其系统
CN103944903B (zh) 2014-04-23 2017-02-15 福建联迪商用设备有限公司 一种多方授权的apk签名方法及系统
US9934014B2 (en) * 2014-08-22 2018-04-03 Apple Inc. Automatic purposed-application creation

Also Published As

Publication number Publication date
US11637707B2 (en) 2023-04-25
US20180248702A1 (en) 2018-08-30
CN107615292A (zh) 2018-01-19
EP3274897B1 (en) 2019-02-27
CN107615292B (zh) 2020-12-25
EP3274897A1 (en) 2018-01-31
SG10201509221YA (en) 2017-06-29
WO2017078624A1 (en) 2017-05-11
US10873466B2 (en) 2020-12-22
US20210091963A1 (en) 2021-03-25

Similar Documents

Publication Publication Date Title
ES2722533T3 (es) Sistema y método para gestionar la instalación de un paquete de aplicación que requiera un acceso a permisos de riesgo alto
BR112018011353A2 (pt) método e sistema para provisão e armazenamento de chave criptografada distribuída via criptografia de curva elíptica
CL2020000081A1 (es) Generación de declaración de autenticación de claves que proporcionan el anonimato del dispositivo.
GB2573666A (en) Verifying authenticity of computer readable information using the blockchain
BR112016023842A2 (pt) sistemas, aparelhos e métodos para autenticação melhorada
BR112018016810A2 (pt) método e sistema implementado por computador para criptografia de dados em um dispositivo eletrônico, dispositivo eletrônico e programa de computador
BR112015026372B8 (pt) Dispositivo de comunicação que reforça a segurança para um arquivo armazenado em uma unidade virtual
MX2019006968A (es) Metodo, aparato y sistema para procesar codigos de barras bidimensionales.
AR102007A1 (es) Sistema, método implementado por computadora y dispositivo informático de autenticación para acceder a recursos en base a desafíos
NZ744540A (en) Systems and methods for providing block chain-based multifactor personal identity verification
CO2019007875A2 (es) Direccionamiento de un entorno de ejecución confiable utilizando clave de firma
MX2021005415A (es) Tecnicas para mejorar la seguridad de las actualizaciones de software cifradas de vehiculos.
NZ744353A (en) Networked access control system
GB2458844A (en) Format-preserving cryptographic systems
MX2016014461A (es) Aprovisionamiento de licencias de gestion de derechos digitales (drm) en un dispositivo cliente que utiliza un servidor de actualizaciones.
BR112015024921A2 (pt) método para destravar a autoridade de administração e dispositivo para autenticação
BR112018015254A2 (pt) método de transferência de dados, método de controle de uso de dados, e dispositivo criptográfico
BR112014012653A2 (pt) sistema e método para o gerenciamento de chave para domínio de segurança do emissor ao usar especificações da global platform
JP2019501431A5 (es)
BR112016021120A2 (pt) Método e dispositivo de gerenciamento de dados confidenciais; método e sistema de autenticação segura
JP2013142994A5 (ja) サーバ装置、車載端末、情報通信方法および情報配信システム
BR112018071634A2 (pt) utilização de região isolada de segurança baseada em hardware para impedir pirataria e fraude em dispositivos eletrônicos
BR112019000805A2 (pt) sistema e método para gerenciamento de chave de ponta a ponta
NZ720190A (en) System and methods for encrypting data
BRPI0711042A8 (pt) Sistema, método para possibilitar um emissor de direitos criar dados de autenticação relacionados à um objeto e/ou criptografar o objeto usando uma chave diversificada e dispositivo