Apple Inc.

Other

Michael Lambertus Hubertus Brouwer

Mitchell David Adler

Conrad Sauerwald

Jerry Hauck

Dallas Blake De Atley

Gordon J Freedman

Jeffrey Alan Bush

Eric Brandon Tamura

Thomas Brogan Duffy, Jr

Daryl Mun-Kid Low

Vrajesh Rajesh Bhavsar

Matthew John Byom

Nitin Ganatra

Dieter W Siegmund

Curtis Galloway

Kenneth Buffalo McNeil

Stan Jirman

Matthew Reda

Roberto G Yépez

Christophe Allie

John Andrew Wright

David Rahardja

Carsten Guenther

Lucia Elena Ballard

Thomas Brogan Duffy

Kenneth Buffalo Mcneil

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for encryption and key management. The method includes encrypting each file on a computing device with a unique file encryption key, encrypting each unique file encryption key with a corresponding class encryption key, and encrypting each class encryption key with an additional encryption key. Further disclosed are systems, methods, and non-transitory computer-readable storage media for encrypting a credential key chain. The method includes encrypting each credential on a computing device with a unique credential encryption key, encrypting each unique credential encryption key with a corresponding credential class encryption key, and encrypting each class encryption key with an additional encryption key. Additionally, a method of generating a cryptographic key based on a user-entered password and a device-specific identifier secret utilizing an encryption algorithm is disclosed.

System and method for content protection based on a combination of a user pin and a device specific identifier

System and method for content protection based on a combination of a user PIN and a device specific identifier

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for wireless data protection utilizing cryptographic key management on a primary device and a backup device. A system encrypts a file with a file key and encrypts the file key twice, resulting in two encrypted file keys. The system encrypts each file key differently and stores a first file key on the primary device and transmits one of the encrypted file keys in addition to the encrypted file to a backup device for storage. On the backup device, the system associates the encrypted file key with a set of backup keys protected by a user password. In one embodiment, the system generates an initialization vector for use in cryptographic operations based on a file key. In another embodiment, the system manages cryptographic keys on a backup device during a user password change.

System and method for wireless data protection

Systems and methods for activating a mobile device for use with a service provider are described. In one exemplary method, a mobile device having a currently inserted SIM card may be prepared for activation using a signing process in which an activation server generates a signed activation ticket encoded with SIM policy data that corresponds to the combination of the device and one of a number of SIM cards belonging to a set of SIM cards defined by the SIM policy data. The activation ticket is securely stored on the mobile device. In another exemplary method the mobile device may be activated in an activation process in which the device verifies an activation ticket against information specific to the device and SIM card in accordance with the SIM policy in the activation ticket, and initiates activation when the verification of the activation ticket is successful.

Service provider activation with subscriber identity module policy

A method for configuring a device includes receiving a first configuration profile comprising a first configuration and a first certificate and a second certificate, verifying the first configuration profile with the first certificate, receiving a user input indicating to accept the first configuration profile, configuring the device according to the first configuration, receiving a second configuration profile comprising a second configuration, verifying the second configuration profile with the second certificate and updating the device according to the second configuration, wherein the user is unaware of the updating.

Secure device configuration profiles

A method and apparatus for generating provisioning data to provision a device are described. A provisioning bundle is validated according to a relationship between a configuration and a bundle sequence number identifying the provisioning bundle. A provisioning request includes a device hardware identifier identifying the device. An authorization for the provisioning request is determined for generating provisioning data including the provisioning bundle personalized by the device hardware identifier for the device.

Provisioning secrets in an unsecured environment

A machine implemented method includes storing a first data representing a prior exception to a first trust failure (e.g., expired certificate). The prior exception may be stored as part of establishing a first communication with a data processing system (e.g., a handheld device). The first communication may not be trustworthy. The method may determine, as part of establishing a second communication with the data processing system, that a second trust failure has occurred. The second trust failure (e.g., revoked certificate) indicates that the second communication may not be trustworthy. The method may determine whether the prior exception applies to the second trust failure. If the prior exception does not apply, the data processing system determines, automatically, whether to create a new exception for the second trust failure.

Trust exception management

Methods and apparatuses for performing secure incremental backup and restore operations are disclosed.

Incremental secure backup and restore of user settings and data

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for encryption and key management. The method includes encrypting each file on a computing device with a unique file encryption key, encrypting each unique file encryption key with a corresponding class encryption key, and encrypting each class encryption key with an additional encryption key. Further disclosed are systems, methods, and non-transitory computer-readable storage media for encrypting a credential key chain. The method includes encrypting each credential on a computing device with a unique credential encryption key, encrypting each unique credential encryption key with a corresponding credential class encryption key, and encrypting each class encryption key with an additional encryption key. Also disclosed is a method of verifying a password by decrypting a key bag, retrieving data from an encrypted file using an encryption key from the decrypted key bag, and verifying the password by comparing retrieved data with expected data.

System and method for file-level data protection

A method and apparatus for secure software installation to boot a device authorized by a ticket are described herein. A ticket request including a device identifier of the device is sent for the ticket which includes attributes for one or more components to boot the device into an operating state. The ticket is cryptographically validated to match the one or more components with corresponding attributes included in the ticket. If successfully matched, the one or more components are executed to boot the device.

Ticket authorized secure installation and boot

A data processing device receives a manifest from a previous backup operation and determines what files have changed by comparing the files to be backed up to the manifest. The data processing device then transforms and encrypts the new and modified files, updates the manifest, signs the manifest and sends the encrypted files along with the signed manifest to a host data processing system for backup.

Growing community of inventors

San Jose, CA, United States of America

Michael Lambertus Hubertus Brouwer