Network World — This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter's approach.

Smartphone users download billions of applications each year, and while the apps add greatly to phone functionality, the risks of buggy or malicious code threatens the user and also the integrity of networks.

Mobile application publishers and developers need ways to differentiate their legitimate software from malware, protect their applications from tampering, and recall faulty or malicious code without impacting the rest of their published applications.

ANALYSIS: Outsourced apps a security minefield, study finds

Fortunately, advanced mobile software platforms such as Windows Mobile 7 and popular app stores such as Windows Marketplace for Mobile have implemented code signing technology to address many of the most frightening security concerns. These platforms use code signing to control the software allowed on networks, taking comprehensive measures to ensure the safety of mobile apps for users and the networks upon which they increasingly rely.

What is code signing?

In traditional software delivery models, a buyer confirms the source of the application and its integrity by examining the packaging. Software downloaded over a mobile network, however, poses a risk because the identities of the publishers are more difficult to determine. Inadvertently introducing malware into the wireless network environment doesn't just put a single end user's smartphone at risk, it can affect an entire network of devices and expose all subscribers to attack, interrupt service, and seriously damage the network provider's reputation and financial performance.

Realizing the responsibility they bear, app stores such as Windows Marketplace now require code signing technology that essentially "signs" the mobile software code with a digital signature, creating a "digital shrink-wrap" that both validates the source of the software code and confirms that the code has not been modified.

Code signing is based on public key cryptography. A developer or software publisher uses a private key to add a digital signature to a piece of software code. Mobile software platforms such as Windows Mobile 7 will use a public key to validate the signature during the app download process and compare the hash used to sign the application against the hash of the downloaded application.

It is this hash that confirms the contents of the file and verifies the code has not been altered or corrupted since it was signed. And while a user can verify the contents of a file and the integrity of the software, the publisher should also have the ability to efficiently revoke a compromised certificate.

Continue Reading