Apple Inc.

Plasmology4, Inc.

Finishing Brands Holdings Inc.

Steven Andrew Myers

Yannick L Sierra

Jeffry E Gonion

Kyle C Brogle

Nihar Sharma

Brent Michael Ledvina

Thomas Icart

Ian D Kountanis

Conrado Blasco

Per Love Hornquist Astrand

Jorge Fernando Pozas Trevino

Van Hong

Munish K Poonia

Sean P Devlin

Pablo Antonio Gonzalez Cervantes

Mohan Singh Randhava

Dongsheng Zhang

Amir H Jadidi

Jeffrey I Meyers

Xixi Lu

Michelle D Linington

Zhengjun Jiang

Suhail Ahmad

Roy Werner Sanders

Gokul P Thirumalai

Marc C Jacofsky

Paul R Micheli

Scott Lopatin

Edwin W Foo

David J Jacofsky

Tommy Rochette

Alexandre A Aybes

Sudhakar N Mambakkam

Dmitry V Belov

Nekheel S Gajjar

Frederic Jacobs

Keaton F Mowery

Emmanuel Lalande

Kalyan C Gopavarapu

Ramarathnam Santhanagopal

Daniel Joseph Hasselschwert

Samuel A Mussell

John Thomas Perry

Emilia M Kulaga

Aniwat Arromratana

Michael C Laster

Isaac Pinol Catadau

Mariappan Rengarajan

Meenakshi Arasu

Nithin Koram

Jean-Luc Giraud

Rebekah H Mercer

Assar E Westerlund

Tim Taubert

Benjamin W Brown

Gary Phillip Metzger

Susan Armstrong

Techniques are provided to create and manage groups of users. A group can be treated as a single entity. For privacy of a user, user keys can be translated to group keys, which are then used to access resources. The user can prove membership in the group via their keys (e.g., using a diversified public key), and then get the group keys in response, e.g., after verification to a group server using a diversified user key.

Generating and managing group identities

Techniques are disclosed relating to resuming a communication session. In some embodiments, a first computing device stores a session resumption token that includes metadata usable to resume a communication session. The first computing device provides a request to resume the communication session with a second computing device and receives, from the second computing device, an output of a verifiable random function (VRF) associated with the request. In response to the request, the first computing device performs a verification of the output and determines, based on the verification, whether to provide the session resumption token to the second computing device.

Secure session resumption

Embodiments described herein provide for a non-transitory machine-readable medium storing instructions to cause one or more processor to perform operations to share a set of keys used to communicate with a wireless accessory device. By sharing the set of keys, functionality of the wireless accessory device can be delegated by an owner to other individuals.

Sharing keys for a wireless accessory

This Application sets forth techniques for establishing a custodial relationship between a user device and a custodian device for recovering access to a user account and/or to encrypted user data with assistance provided by the custodian device to effect access recovery. A server of a cloud network service provides an anonymous identifier to associate with the custodian device and an account recovery key to store at the custodian device. Identity of an account of the cloud network service associated with the custodian device can be hidden from the server. The user device generates a data recovery key and provides a first portion of the data recovery key to the custodian device and a second portion of the data recovery key to the server. Integrity of the stored account recovery key and portions of the data recovery key are checked regularly by the custodian device and the user device.

Techniques for user account and data recovery

A system and method for efficiently protecting branch prediction information. In various embodiments, a computing system includes at least one processor with a branch predictor storing branch target addresses and security tags in a table. The security tag includes one or more components of machine context. When the branch predictor receives a portion of a first program counter of a first branch instruction, and hits on a first table entry during an access, the branch predictor reads out a first security tag. The branch predictor compares one or more components of machine context of the first security tag to one or more components of machine context of the first branch instruction. When there is at least one mismatch, the branch prediction information of the first table entry is not used. Additionally, there is no updating of any branch prediction training information of the first table entry.

Indirect branch predictor storing encrypted branch information fields

Techniques are disclosed relating to securely authenticating communicating devices. In various embodiments, a computing device receives, via a network connection with a network, a first certificate for a first public key pair of the computing device. The computing device provides the first certificate to an offline accessory device and receives a second certificate for a second public key pair maintained by the offline accessory device. The computing device performs a verification of the second certificate and, responsive to the verification being successful, interacts with the offline accessory device. In some embodiments, prior to providing the first certificate, the computing device determines an ordering in which the first and second certificates are to be exchanged by the first computing device and the offline accessory device, and the first certificate is provided to the offline accessory device in accordance with the determined ordering.

Secure accessory connections

Techniques disclosed herein relate to the pairing of a pairing initiator device and a pairing responder device for communication. The pairing initiator device and the pairing responder device range with each other to determine the distance between the pairing initiator device and the pairing responder device. Based on the distance being below a threshold distance, the pairing initiator device and the pairing responder device wirelessly pair with each other without further input from the user.

Pairing devices based on distance

Techniques for storing health data can include a multi-node data structure. A data node, a category node, and an institution node of a multi-node data structure can be generated in accordance with a configuration file. The data node can include health data and can be identified by a first unique data identifier and encrypted using a first cryptographic key. The category node can include the first unique data identifier and the first cryptographic key. The category node can be identified by a second unique data identifier and encrypted using a second cryptographic key. The institution node can include the second unique data identifier and the second cryptographic key. The institution node can be identified by a third unique data identifier and encrypted using a third cryptographic key. The data node, the category node, and the institution node can be shared with a service provider.

Secure storage and retrieval of sensitive information

Techniques are disclosed relating to protecting branch prediction information. In various embodiments, an integrated circuit includes branch prediction logic having a table that maintains a plurality of entries storing encrypted target address information for branch instructions. The branch prediction logic is configured to receive machine context information for a branch instruction having a target address being predicted by the branch prediction logic, the machine context information including a program counter associated with the branch instruction. The branch prediction logic is configured to use the machine context information to decrypt encrypted target address information stored in one of the plurality of entries identified based on the program counter. In some embodiments, the branch prediction logic decrypts the encrypted target address information by performing a cipher to encrypt the machine context information and performing a Boolean exclusive-OR operation of the encrypted machine context information and the encrypted target address information.

Branch predictor storing encrypted information

The subject technology may be implemented by a device that includes at least one processor configured to encrypt a data object based at least in part on an encryption key. The at least one processor may be further configured to sign the encrypted data object with a private key and transmit the signed encrypted data object to a server for retrieval by another device. The at least one processor may be further configured to generate a sharing object corresponding to the data object, wherein the sharing object includes an encryption key and a public key that corresponds to the private key. The at least one processor may be further configured to encrypt the sharing object using a key of the other device and transmit, over a secure channel, the encrypted sharing object to the other device for subsequent retrieval and verification of the signed data object from the server.

Synchronizing content

A user device may share encrypted health data with an electronic health record (EHR) system associated with a health institution. A unique data identifier that identifies a portion of the health data and a cryptographic key may be shared with the EHR system. The encrypted health may be shared with a service provider and a unique data identifier. To access the health data, the EHR system may query the service provider with the unique data identifier.

Indirect branch predictor storing encrypted branch information fields and security tag for security protection

Indirect branch predictor security protection

Growing community of inventors

San Jose, CA, United States of America

Steven Andrew Myers