Apple Inc.

Kyle C Brogle

Brent Michael Ledvina

Yannick L Sierra

Richard J Mondello

Reza Abbasian

Marc Jason Krochmal

Conrad A Shultz

Alexander D Sanciangco

Thomas M Alsina

Pedro Mari

Bob Bradley

Rudolph Van Der Merwe

Johannes P Schmidt

Richard Michael Powell

Ivan Krstic

Daniel C Klingler

Eric A Allamanche

Steven Andrew Myers

Alex Tremain Nelson

Patrick L Coffman

Darin Benjamin Adler

Daniel R Borges

Srinivas Rama

Zaka Ur Rehman Ashraf

Lucia Elena Ballard

Rohit U Nabar

Robert William Mayor

Su Khiong Yong

Grant R Paul

Sriram Hariharan

Steven J Falkenburg

Keith Walter Rauenbuehler

Mingguang Xu

Venkateswara Rao Manepalli

Najeeb M Abdulrahiman

Qi S Wang

Wade Benson

Julien F Freudiger

Nicole M Wells

Onur E Tackin

Raghunandan K Pai

Scott Lopatin

Qi Wang

Edwin W Foo

Langford M Wasada

Mithat C Dogan

Thomas P Mensch

Matthias Lerch

Tommy Rochette

Siva Ganesh Movva

Christopher Aaron Volkert

Florian Galdo

Samuel B Schaevitz

Chelsea Elizabeth Pugh

Maureen Grace Daum

Jacob S Klapper

Joseph M Triscari

Guillaume Borios

Patrick Robert Burns

Benjamin Biron

Hung Q Le

Wayne A Lee

Jiaying Deng

Emmanuel Lalande

Adam M Driscoll

Munish K Poonia

Jay S Coggin

Keun Sup Lee

Aaron M Elder

Paul Russell Knight

Sean P Devlin

Charilaos Papadopoulos

David P Quesada

Praveen Chegondi

Benjamin S Turner

Devin E Gund

Connor David Graham

Shengkai Wu

I-Ting Liu

Dj Capelis

Jesus A Gutierrez Gomez

John Thomas Perry

Aaron M Sigel

Lucie Kucerova

Jonathan R Schoenberg

Christina Selle

Tunc Ertan

Swadesh Bhattacharya

Michael C Laster

Andrew J Ringer

Kahraman D Akdemir

Dominic Spill

Andrei Tudorancea

Amit Gulia

William K Estes

Stephanie R Martin

Tomislav Suchan

Mads N Paulin

Naresh Kumar Chinnathanbi Kailasam

Embodiments described herein provided techniques to enable peripherals configured to provide secure functionality. A secure circuit on a peripheral device can be paired with a secure circuit on a host device outside of a factory environment without compromising security by verifying silicon keys that are embedded within the secure circuit during manufacturing.

Pairing protocol for peripherals with a secure function

Embodiments described herein enable a user to bypass the use of one-time keys or account recovery codes by providing techniques for accessory assisted account recovery. In various embodiments, accessory assisted account recovery makes use of an accessory device of a user, where the accessory device can be any device having a secure processor, cryptographic engine, public key accelerator, or is otherwise able to accelerate cryptographic operations or perform cryptographic operations in a secure execution environment. An account recovery key can be split into multiple portions. At least one portion of the recovery key is then encrypted. The accessory device is then configured to be uniquely capable of decrypting the encrypted portion of an account recovery key.

Accessory assisted account recovery

A wireless access device can be configured to determine a list of accessory groups corresponding to accessories connected to a network managed by the wireless access device. The wireless access device may also be configured to identify at least one firmware update that corresponds to at least one accessory group of the list of accessory groups and request all firmware updates that correspond to the at least one accessory group. The wireless access device can also be configured to receive one or more firmware updates that corresponds to at least one of the accessories of the at least one accessory group for which a respective firmware update is available and transmit at least one firmware update of the received one or more firmware updates to at least one corresponding accessory of the at least one accessory group.

Network access tokens for accessories

The present disclosure generally relates to enrolling a biometric feature for use with a peripheral device. While a computer system is connected to an external device, the computer system receives a first request to enroll a biometric feature. In response to receiving the request and in accordance with a determination that the request satisfies a first set of one or more criteria, the computer system displays a user interface object prompting a user to provide an authorization input to one or more input devices physically connected to the computer system. While displaying the first user interface object, the computer system receives user input. In response to receiving the user input and in accordance with a determination that the user input includes the authentication input, the computer system initiates a process to enroll the biometric feature using a biometric sensor that is integrated with the external device.

User interface for enrolling a biometric feature

Techniques are disclosed relating to securely authenticating communicating devices. In various embodiments, a computing device receives, via a network connection with a network, a first certificate for a first public key pair of the computing device. The computing device provides the first certificate to an offline accessory device and receives a second certificate for a second public key pair maintained by the offline accessory device. The computing device performs a verification of the second certificate and, responsive to the verification being successful, interacts with the offline accessory device. In some embodiments, prior to providing the first certificate, the computing device determines an ordering in which the first and second certificates are to be exchanged by the first computing device and the offline accessory device, and the first certificate is provided to the offline accessory device in accordance with the determined ordering.

Secure accessory connections

The embodiments set forth a technique for enabling a computing device to securely configure a peripheral computing device. According to some embodiments, the method can include the steps of (1) approving a request received from the peripheral computing device to engage in a setup procedure for the peripheral computing device, (2) receiving, from the peripheral computing device: (i) an audio signal that encodes a password and timing information, and (ii) a light signal. Additionally, the method can involve, in response to identifying that the timing information correlates with the light signal: (3) extracting the password from the audio signal, and (4) establishing a communication link with the peripheral computing device based on the password. In turn, the method can involve (5) providing configuration information to the peripheral computing device over the communication link.

Techniques for verifying user intent and securely configuring computing devices

The present disclosure generally relates to methods and user interfaces for authentication, including providing and controlling authentication at a computer system using an external device in accordance with some embodiments.

Implementation of biometric authentication

Techniques disclosed herein relate to the pairing of a pairing initiator device and a pairing responder device for communication. The pairing initiator device and the pairing responder device range with each other to determine the distance between the pairing initiator device and the pairing responder device. Based on the distance being below a threshold distance, the pairing initiator device and the pairing responder device wirelessly pair with each other without further input from the user.

Pairing devices based on distance

Techniques are disclosed relating to user authentication. In some embodiments, a first computing device receives, from a second computing device, a request for a user credential to be input into an authentication prompt associated with the second device. The first computing device determines a proximity associated with the second computing device based on a received wireless location beacon and, based on the request and the determined proximity, presents a selection prompt asking a user of the first computing device to select a user credential stored in the first computing device. The first computing device then provides the selected user credential to the second computing device to input into the authentication prompt. In some embodiments, the first computing device receives the wireless location beacon from a remote controller of the second computing device and determines a proximity based on a signal strength associated with the received location beacon.

Proximity credential sharing

Techniques are disclosed relating to credential managers. In some embodiments, a computing device maintains a credential manager that stores, in a protected manner, a set of credentials for authenticating a user and metadata about the credentials. The computing device stores an instance of the metadata externally to the credential manager. The computing device uses the externally stored metadata to determine whether the set of credentials includes a particular credential associated with a service and, in response to determining that the set of credentials includes the particular credential, displays an indication of the particular credential. In some embodiments, the computing device receives a selection of the displayed indication by the user and, in response to the selection, sends a request for the particular credential to the credential manager.

Credential manager integration

Techniques are disclosed relating to sharing access to electronically-secured property. In some embodiments, a first computing device having a first secure element receives, from a second computing device associated with an owner of the electronically-secured property, an indication that the second computing device has transmitted a token to server computing system, the token permitting a user of the first computing device access to the electronically-secured property. Based on the received indication, the first computing device sends a request for the transmitted token to the server computing system and, in response to receiving the requested token, securely stores the received token in the first secure element of the first computing device. The first computing device subsequently transmits the stored token from the first secure element of the first device to the electronically-secured property to obtain access to the electronically-secured property based on the token.

Friend key sharing

Some aspects of this disclosure relate to implementing a thread device that can associate with a thread network. The thread device includes a network processor, a first memory, and a host processor communicatively coupled to the network processor and the first memory. The first memory can be a nonvolatile memory with a first level security protection, and configured to store a first dataset including thread network parameters for the network processor to manage network functions for the thread device associated with the thread network. The network processor can be coupled to a second memory to store a second dataset having a same content as the first dataset. The network processor is configured to manage the network functions based on the second dataset. The second memory can be a volatile memory with a second level security protection that is less than the first level security protection.

Secure storage of datasets in a thread network device

Growing community of inventors

San Francisco, CA, United States of America

Kyle C Brogle