Apple Inc.

Other

Conrad Sauerwald

Mitchell David Adler

Timothy R Paaske

Shu-Yi Yu

Gregory B Novick

Andrew Roger Whalley

Jerrold Von Hauck

Christopher G Wilson

Rudolph Van Der Merwe

Tyler D Hawkins

Wade Benson

Paul William Chinn

Eric Brandon Tamura

Augustin J Farrugia

Dallas Blake De Atley

Gianpaolo Fasoli

Sean Boland Kelly

Patrice Olivier Gautier

Matthew John Byom

Craig Alan Marciniak

Marc Jason Krochmal

John Joseph Iarocci

Nitin Ganatra

R Stephen Polzin

Alexander R Ledwith

Joe S Abuan

Timothy John Millet

Hyeonkuk Jeong

Yannick L Sierra

Justin N Wood

Daniel Jeffrey Post

Joseph P Bratt

Joshua P De Cesare

Roberto Garcia

Fabrice L Gautier

Michael Lambertus Hubertus Brouwer

Neil Gareth Crane

Samuel Noble

Payam Mirrashidi

Michael Kuohao Chu

Thomas Brogan Duffy, Jr

Tristan F Schaap

Braden Jacob Thomas

Kenneth W Scott

Thomas Matthieu Alsina

Jeffrey C Lee

Vrajesh Rajesh Bhavsar

Zachary F Papilion

Scott T Boyd

Rajit Shinh

Dieter W Siegmund

Curtis Galloway

Kenneth Buffalo McNeil

Pedraum R Pardehpoosh

Stan Jirman

Matthew Reda

Noah Witherspoon

Michael L H Brouwer

Christophe Allie

Roberto G Yépez

Gordon J Freedman

Andrew H Vyrros

Michael Brouwer

Roberto Garcia, Jr

John Andrew Wright

David Rahardja

Thomas P Mensch

Carsten Guenther

Lucia Elena Ballard

David P Finkelstein

Weihua Mao

Zhimin Chen

Puja Dilip Gupta

Mitch Adler

Timothee Geoghegan

Pedraum Pardehpoosh

Thomas Brogan Duffy

Kenneth Buffalo Mcneil

In one embodiment, a unique (or quasi unique) identifier can be received by an application store, or other on-line store, and the store can create a signed receipt that includes data desired from the unique identifier. This signed receipt is then transmitted to a device that is running the application obtained from the on-line store and the device can verify the receipt by deriving the unique (or quasi-unique) identifier from the signed receipt and comparing the derived identifier with the device identifier stored on the device, or the vendor identifier assigned to the application vendor.

Securing in-app purchases

A method of unlocking a second device using a first device is disclosed. The method can include: the first device pairing with the second device; establishing a trusted relationship with the second device; authenticating the first device using a device key; receiving a secret key from the second device; receiving a user input from an input/output device; and transmitting the received secret key to the second device to unlock the second device in response to receiving the user input, wherein establishing a trusted relationship with the second device comprises using a key generated from a hardware key associated with the first device to authenticate the device key.

Method of using one device to unlock another device

In an embodiment, a system is provided in which the private key is managed in hardware and is not visible to software. The system may provide hardware support for public key generation, digital signature generation, encryption/decryption, and large random prime number generation without revealing the private key to software. The private key may thus be more secure than software-based versions. In an embodiment, the private key and the hardware that has access to the private key may be integrated onto the same semiconductor substrate as an integrated circuit (e.g. a system on a chip (SOC)). The private key may not be available outside of the integrated circuit, and thus a nefarious third party faces high hurdles in attempting to obtain the private key.

Secure public key acceleration

Techniques are disclosed relating to the secure communication of devices. In one embodiment, a first device is configured to perform a pairing operation with a second device to establish a secure communication link between the first device and the second device. The pairing operation includes receiving firmware from the second device to be executed by the first device during communication over the secure communication link, and in response to a successful verification of the firmware, establishing a shared encryption key to be used by the first and second devices during the communication. In some embodiments, the pairing operation includes receiving a digital signature created from a hash value of the firmware and a public key of the second device, and verifying the firmware by extracting the hash value from the digital signature and comparing the extracted hash value with a hash value of the received firmware.

Secure device pairing

Systems and methods are disclosed for generating one or more hardware reference keys (HRK) on a computing device, and for attesting to the validity of the hardware reference keys. An initial hardware reference key can be a silicon attestation key (SIK) generated during manufacture of a computing system, such as a system-on-a-chip. The SIK can comprise an asymmetric key pair based at least in part on an identifier of the processing system type and a unique identifier of the processing system. The SIK can be signed by the computing system and stored thereon. The SIK can be used to generate further HRKs on the computing device that can attest to the processing system type of the computing device and an operating system version that was running when the HRK was generated. The computing device can generate an HRK attestation (HRKA) for each HRK generated on the computing system.

Silicon key attestation

Techniques are disclosed relating to securely storing data in a computing device. In one embodiment, a computing device includes a secure circuit configured to maintain key bags for a plurality of users, each associated with a respective one of the plurality of users and including a first set of keys usable to decrypt a second set of encrypted keys for decrypting data associated with the respective user. The secure circuit is configured to receive an indication that an encrypted file of a first of the plurality of users is to be accessed and use a key in a key bag associated with the first user to decrypt an encrypted key of the second set of encrypted keys. The secure circuit is further configured to convey the decrypted key to a memory controller configured to decrypt the encrypted file upon retrieval from a memory.

Cryptographic separation of users

A method of establishing communications with a first device is disclosed. The method includes: the first device presenting connection information to a second device; receiving a response from a second device; establishing an association with the second device; transmitting, in response to a determination that the first device and the second device are connected for data, first data to the second device, the first data comprising addressing information for a server; receiving second data from the second device, the second data comprising second information for establishing communications with the first device; and configuring the first device to receive third data from a location remote to the first device using the second information from the second data.

Method of establishing communications

Growing community of inventors

Mountain View, CA, United States of America

Conrad Sauerwald