Protected application programming interfaces

摘要

Mechanisms are provided to allow particular parties and applications access to protected application programming interfaces (APIs) without the use of security domains. Trusted parties and applications may have access to protected APIs while unfrosted parties and applications may be restricted to a more limited set of APIs. Public keys associated with individual applications that are used to enforce licensing policies can be repurposed for use in a verification process to prevent unauthorized access to APIs. A credential storage manager can be used to maintain permission and certificate information. An application authorization manager may access credential storage and maintain trusted application information.

主权项

1. A method, comprising:
receiving an application package for installation on a device; determining whether an application associated with the application package uses a protected application programming interface (API), wherein access to the protected API is restricted to applications that have been granted a designated access permission level; determining whether an application signature corresponds to a certificate preauthorizing access to the protected API, wherein the certificate preauthorizing access to the protected API indicates the designated access permission level; designating the application as trusted based on protected API credentials, wherein the designation of the application as trusted is not based on whether the application resides in a designated security domain; determining whether the application signature corresponds to a certificate preauthorizing installation of the application package; and proceeding with installation of the application package on the device.