Apple Inc.

Other

Mitchell David Adler

Michael Brouwer

Dallas Blake De Atley

Conrad Sauerwald

Jerrold Von Hauck

Yannick L Sierra

Jesse Lee Dorogusker

Timothy R Paaske

Nitin Ganatra

Wade Benson

Andrew Roger Whalley

Shu-Yi Yu

Lawrence G Bolton

Emily Clark Schubert

Marc Jason Krochmal

John Joseph Iarocci

Alexander R Ledwith

Anthony Michael Fadell

Paul Holden

John Wesley Archibald

R Stephen Polzin

Gordon J Freedman

Eric Brandon Tamura

Sriram Hariharan

Scott Peter Krueger

Robert D Watson

Michael Jason Giles

Craig P Dooley

Michael J Smith

Jeffrey J Terlizzi

Brijesh Tripathi

Joakim Linde

Ahmer Ali Khan

George R Dicker

Christopher Brooke Sharp

David T Haggerty

James C Wilson

Matthew John Byom

John Meron Ananny

Akshay Mangalam Srivatsa

Haining Zhang

Charles Francis Dominguez

Roberto G Yepez

Anup K Sharma

Yousuf H Vaid

John Andrew Wright

Anand Dalal

Simon P Cooper

David Rahardja

James Hollabaugh

Zachary A Rosen

Michael Lambertus Hubertus Brouwer

Fabrice L Gautier

David P Finkelstein

John C Hurley

Jonathan Jake Rubinstein

Richard F Murphy

Per Love Hornquist Astrand

Matthew G Watson

Thomas Brogan Duffy, Jr

Michael D Ford

Keaton F Mowery

Vrajesh Rajesh Bhavsar

Luke Theodore Hiesterman

Benjamin I Williamson

Michelle A Auricchio

Shyam S Toprani

Dieter W Siegmund

Curtis Galloway

Kenneth Buffalo McNeil

Libor Sykora

Stan Jirman

Paul-Phillip Holden

Terry L Tikalsky

Matthew Reda

Michael L H Brouwer

Christophe Allie

Roberto G Yépez

Ganesha A G Batta

Carsten Guenther

Lucia Elena Ballard

Peter T Langenfeld

Jeffrey C Lee

Van Hong

Timothee Geoghegan

Paul A Seligman

Matt Reda

Dallas De Atley

Jiri Margaritov

Roberto Gabriel Yepeź

Heiko Panther

Jerroid V Hauck

Yousaf H Vaid

Thomas Brogan Duffy

Kenneth Buffalo Mcneil

James M Hollabaugh

Some embodiments provide a method for a first device that identifies definitions of different groups of devices, each of which is defined by a set of properties required for a device to be a member. The method monitors properties of the first device to determine when the device is eligible for membership in a group. When the first device is eligible for membership in a first group of which the device is not a member, the method sends an application for membership in the first group signed with at least a private key of the device to at least one other device that is a member of the first group. When the first device becomes ineligible for membership in a second group of which the first device is a member, the method removes the device from the second group and notifies other devices that are members of the second group.

Dynamic group membership for devices

Some embodiments of the invention provide a method for a trusted (or originator) device to modify the security state of a target device (e.g., unlocking the device) based on a securing ranging operation (e.g., determining a distance, proximity, etc.). The method of some embodiments exchanges messages as a part of a ranging operation in order to determine whether the trusted and target devices are within a specified range of each other before allowing the trusted device to modify the security state of the target device. In some embodiments, the messages are derived by both devices based on a shared secret and are used to verify the source of ranging signals used for the ranging operation. In some embodiments, the method is performed using multiple different frequency bands.

Modifying security state with secured range detection

In an embodiment, a system is provided in which the private key is managed in hardware and is not visible to software. The system may provide hardware support for public key generation, digital signature generation, encryption/decryption, and large random prime number generation without revealing the private key to software. The private key may thus be more secure than software-based versions. In an embodiment, the private key and the hardware that has access to the private key may be integrated onto the same semiconductor substrate as an integrated circuit (e.g. a system on a chip (SOC)). The private key may not be available outside of the integrated circuit, and thus a nefarious third party faces high hurdles in attempting to obtain the private key.

Secure public key acceleration

Some embodiments of the subject technology provide a novel system for synchronizing content items among a group of peer devices. The content synchronizing system of some embodiments includes the group of peer devices and a set of one or more synchronizing servers communicatively connected with the peer devices through one or more networks. In some embodiments, the synchronizing system uses a star architecture, in which each peer device offloads its synchronization operations to the synchronizing server set. Without establishing a peer-to-peer communication with any other peer device, the particular peer device in these embodiments supplies an encrypted content item set along with the N&#x2212;1 encryptions of a content key used to encrypt the content item set to the synchronizing server set so that this server set can distribute the encrypted content item set and an encrypted content key to each of the N&#x2212;1 peer devices.

Synchronizing content

Some embodiments provide a method for a first device to join a group of related devices. The method receives input of a password for an account with a centralized entity and a code generated by a second device in the group. When the second device determines that the code input on the first device matches the generated code, the method receives an authentication code from the second device for authorizing the first device with the entity as a valid device for the account. The method uses the password and information regarding the first device to generate an application to the group. After sending the application to the second device, the method receives information from the second device that enables the first device to add itself to the group. The second device verifies the generated application, and the method uses the information received from the second device to join the group.

Combined authorization process

In some embodiments, a first device performs ranging operations to allow a user to perform one or more operations on the first device without providing device-access credentials. For example, when a second device is within a first distance of the first device, the first device determines that the second device is associated with a first user account that is authorized to perform operations on the first device. In response to the determination, the first device enables at least one substitute interaction (e.g., a password-less UI interaction) to allow the operations to be performed on the first device to be accessed without receiving access credentials through a user interface. In response to detecting an occurrence of the substitute interaction, the operation is authorized on the first device.

Remote interaction with a device using secure range detection

In some embodiments, a first device performs ranging operations to allow a user to access the first device under one of several user accounts without providing device-access credentials. For example, when a second device is within a first distance of the first device, the first device determines that the second device is associated with a first user account under which a user can access (e.g., can log into) the first device. In response to the determination, the first device enables at least one substitute interaction (e.g., a password-less UI interaction) to allow the first device to be accessed without receiving access credentials through a user interface. In response to detecting an occurrence of the substitute interaction, the user is allowed to access the first device under the first user account. In some embodiments, the substitute interaction occurs while the first device is logged into under a second user account.

Some embodiments of the invention provide a method for a trusted (or originator) device to modify the security state of a target device (e.g., unlocking the device) based on a securing ranging operation (e.g., determining a distance, proximity, etc.). The method of some embodiments exchanges messages as a part of a ranging operation in order to to determine whether the trusted and target devices are within a specified range of each other before allowing the trusted device to modify the security state of the target device. In some embodiments, the messages are derived by both devices based on a shared secret and are used to verify the source of ranging signals used for the ranging operation. In some embodiments, the method is performed using multiple different frequency bands.

A user device can segment a secret (e.g., a data recovery key) into a master segment and a shared segment such that possession of both segments is necessary and sufficient to reconstruct the secret. The user device can provide the master segment to a server system. The user device can further segment the shared segment to generate a set of M shares such that any subset of the shares that includes at least a threshold number t of the shares can be used to reconstruct the shared segment, while fewer than t shares provide no information about the shared segment. The M shares can be distributed to shareholder devices. To reconstruct the secret, a recovery device can obtain the master segment and at least t of the M shares, then reconstruct the secret.

Distribution and recovery of a user secret

Growing community of inventors

Cupertino, CA, United States of America

Mitchell David Adler