Apple Inc.

Ivan Krstic

Lucia Elena Ballard

Jerrold Von Hauck

Karthik Narayanan

James C Wilson

Sudhakar N Mambakkam

John Gates

Selvarajan Subramaniam

Ramarathnam Santhanagopal

Prabhakaran Vaidyanathaswami

Deepti S Prakash

Damien Pascal Sorresso

Oliver J Hunt

Steven Porter Hotelling

Steve Porter Hotelling

Raghunandan K Pai

Eric Daniel Friedman

Richard L Hagy

Moshe Laifenfeld

Lynn Richard Youngs

Anup K Sharma

Jonathan Pokrass

Thorsten Gernoth

Kevin James Van Vechten

Kyle C Brogle

Feng Tang

Pierre-Olivier J Martel

Thomas P Mensch

Michael Ross Malone

Matthew C Waldon

Tal Kaitz

Petr Kostka

Austin G Jennings

Andrei Kolin

Christopher G Zeleznik

Gideon Littwin

Lucie Kucerova

Eitan Hirsh

Ziv Hendel

Jan Cibulka

Etai Littwin

Darin Benjamin Adler

Steven J Falkenburg

Richard J Mondello

Yannick L Sierra

James R Wilson

Patrice Olivier Gautier

Marc Jason Krochmal

Brent Michael Ledvina

Reza Abbasian

Ian J Baird

Conrad A Shultz

Peter Kiehtreiber

Alexander D Sanciangco

Chelsea Elizabeth Pugh

Guillaume Borios

Maureen Grace Daum

Philip James Holland

Patrick Robert Burns

Gregory Daniel Hughes

Paul Russell Knight

Jacob S Klapper

Charilaos Papadopoulos

Pavan Kumar Anasosalu Vasu

Pierre-Oliver J Martel

Connor David Graham

Shengkai Wu

I-Ting Liu

Najeeb M Abdulrahiman

Nicholas Joseph Circosta

Jason Clay Beaver

Onur E Tackin

Filip J Pizlo

Matthias Lerch

Shyam S Toprani

Kevin J Lindeman

Kelsey Yukio Ho

Adele C Peterson

Gavin Barraclough

Samuel M Weinig

Christopher B Zimmermann

Christopher Aaron Volkert

Jacques Anthony Vidrine

Florian Galdo

Libor Sykora

Yongjun Zhang

Olivier Gutknecht

David P Remahl

Sophia Teutschler

Ryan A Williams

Arnold S Liu

Justin S Hogg

Patrick R Metcalfe

Brian J Dawbin

Carmen A Bovalino, Iii

Elliot C Liskin

Richard J Cooper

Filip Stoklas

Pavan Kumar Ansosalu Vasu

David P Remahl, Jr

The subject disclosure provides systems and methods for application-specific network data filtering. Application-specific network data filtering may be performed by a sandboxed process prior to providing the network data to an application to which the network data is directed. Any malicious or otherwise potentially harmful data that is included in the network data may be removed by the application-specific network data filter or may be allowed to corrupt the application specific network data filtering operations within the sandbox, thereby preventing the malicious or harmful data from affecting the application or other portions of an electronic device. In one or more implementations, a first process such as an application-specific network data filtering process may request allocation of memory for the first process from second process, such as an application, that is separate from a memory manager of the electronic device.

Application specific network data filtering

Techniques are disclosed relating to biometric authentication, e.g., facial recognition. In some embodiments, a device is configured to verify that image data from a camera unit exhibits a pseudo-random sequence of image capture modes and/or a probing pattern of illumination points (e.g., from lasers in a depth capture mode) before authenticating a user based on recognizing a face in the image data. In some embodiments, a secure circuit may control verification of the sequence and/or the probing pattern. In some embodiments, the secure circuit may verify frame numbers, signatures, and/or nonce values for captured image information. In some embodiments, a device may implement one or more lockout procedures in response to biometric authentication failures. The disclosed techniques may reduce or eliminate the effectiveness of spoofing and/or replay attacks, in some embodiments.

Biometric authentication techniques

Techniques are disclosed relating to sharing access to electronically-secured property. In some embodiments, a first computing device having a first secure element receives, from a second computing device associated with an owner of the electronically-secured property, an indication that the second computing device has transmitted a token to server computing system, the token permitting a user of the first computing device access to the electronically-secured property. Based on the received indication, the first computing device sends a request for the transmitted token to the server computing system and, in response to receiving the requested token, securely stores the received token in the first secure element of the first computing device. The first computing device subsequently transmits the stored token from the first secure element of the first device to the electronically-secured property to obtain access to the electronically-secured property based on the token.

Friend key sharing

The present disclosure describes techniques for changing a required authentication type based on a request for a particular type of information. For example, consider a situation where a user has asked a virtual assistant 'who owns this device?' By default, the device may allow biometric authentication to unlock. In response to identification of the owner by the virtual assistant, however, the device may require one or more other types of authentication (e.g., manual entry of a passcode) to unlock the device. In various embodiments, the disclosed techniques may increase the security of the device by making it more difficult for malicious entities to obtain the sensitive information or to access device functionality once the sensitive information has been disclosed. In various embodiments, this may prevent or reduce unauthorized access to the device.

Authentication techniques in response to attempts to access sensitive information

Some embodiments of the invention provide a program for recovering access to a service associated with an account. The program provides a login credential to log into the account to receive the associated service. Next, the program receives an access continuation parameter (ACP) after logging into the account. The program then accesses the service and receives a rejection of a subsequent access to the service. The program then provides the ACP in lieu of the login credential to continue to receive the service.

Account access recovery system, method and apparatus

In accordance with some embodiments, the method includes: detecting, via the one or more input devices, a request to display information for password protected accounts; and, in response to detecting the request, concurrently displaying, on the display device: a representation of a first password protected account that is associated with a credential having one or more security issues, wherein the representation of the first password protected account is visually associated with an alert indicator indicating the one or more security issues associated with the credential of the first password protected account; and a representation of a second password protected account that is associated with a credential having one or more security issues, wherein the representation of the second password protected account is visually associated with an alert indicator indicating the one or more security issues associated with the credential of the second password protected account.

Device, method, and graphical user interface for managing authentication credentials for user accounts

Techniques are disclosed relating to securing an accessory interface on a computing device. In various embodiments, a computing device detects a connection of an accessory device to an accessory interface port and, in response to the detected connection, evaluates a policy defining one or more criteria for restricting unauthorized access to the accessory interface port. Based on the evaluating, the computing device determines whether to disable the accessory interface port to prevent communication with the connected accessory device. In some embodiments, the computing device includes an interconnect coupled between the processor and the accessory interface port, and the interconnect includes a hub circuit configured to facilitate communication between a plurality of devices via the interconnect. In some embodiments, the computing device, in response to determining to disable the accessory interface port, instructs the hub circuit to prevent traffic from being conveyed from the accessory interface port.

Securing accessory interface

In accordance with some embodiments, a method is performed at an electronic device with a display device and one or more input devices. The method includes displaying, via the display device, a user interface that includes a new-password field. The method includes detecting, via the one or more input devices, a user input that corresponds to selection of the new-password field. In response to detecting the user input that corresponds to selection of the new-password field, the method includes displaying, on the display device, a representation of a new automatically-generated password in the new-password field and displaying, on the display device, an affordance to accept the new automatically-generated password and an affordance to decline to use the new automatically-generated password.

Techniques for access control of a data processing system are described. In one embodiment, in response to a request from an application for accessing a resource of a data processing system, it is determined a first class of resources the requested resource belongs. A second class of resources the application is entitled to access is determined based on a resource entitlement encoded within the application and authorized by a predetermined authority. The application is allowed to access the resource if the first class and the second class of resources are matched. The application is denied from accessing the resource if the first class and the second class are not matched, regardless an operating privilege level of the application.

Restricted resource classes of an operating system

In response to a request for launching a program, a list of one or more application frameworks to be accessed by the program during execution of the program is determined. Zero or more entitlements representing one or more resources entitled by the program during the execution are determined. A set of one or more rules based on the entitlements of the program is obtained from at least one of the application frameworks. The set of one or more rules specifies one or more constraints of resources associated with the at least one application framework. A security profile is dynamically compiled for the program based on the set of one or more rules associated with the at least one application framework. The compiled security profile is used to restrict the program from accessing at least one resource of the at least one application frameworks during the execution of the program.

Methods for restricting resources used by a program based on entitlements

Growing community of inventors

San Francisco, CA, United States of America

Ivan Krstic