公开(公告)号：US11822664B2

公开(公告)日：2023-11-21

申请号：US17092030

申请日：2020-11-06

Applicant: Apple Inc.

Inventor： Xeno S. Kovah ,  Nikolaj Schlej ,  Thomas P. Mensch ,  Wade Benson ,  Jerrold V. Hauck ,  Josh P. de Cesare ,  Austin G. Jennings ,  John J. Dong ,  Robert C. Graham ,  Jacques Fortier

IPC: G06F21/57 ,  G06F21/72 ,  H04L9/32 ,  H04L9/08 ,  H04L9/40 ,  G06F21/73 ,  G06F9/4401

CPC classification number: G06F21/575 ,  G06F9/4406 ,  G06F21/72 ,  G06F21/73 ,  H04L9/0897 ,  H04L9/3226 ,  H04L9/3236 ,  H04L9/3268 ,  H04L63/123 ,  G06F2221/034

Abstract: Techniques are disclosed relating to securing computing devices during boot. In various embodiments, a secure circuit of a computing device generates for a public key pair and signs, using a private key of the public key pair, configuration settings for an operating system of the computing device. A bootloader of the computing device receives a certificate for the public key pair from a certificate authority and initiates a boot sequence to load the operating system. The boot sequence includes the bootloader verifying the signed configuration settings using a public key included in the certificate and the public key pair. In some embodiments, the secure circuit cryptographically protects the private key based on a passcode of a user, the passcode being usable by the user to authenticate to the computing device.

公开(公告)号：US11531758B2

公开(公告)日：2022-12-20

申请号：US17122771

申请日：2020-12-15

Applicant: Apple Inc.

Inventor： Pierre Oliver Martel ,  Arthur Mesh ,  Wade Benson

IPC: G06F21/57 ,  G06F21/31 ,  G06F21/45

Abstract: Embodiments described herein provide for a system, method, and apparatus to provision domains in a secure enclave processor to support multiple users. One embodiment provides for an apparatus comprising a first processor to receive a set of credentials associated with one of multiple user accounts on the apparatus and a second processor including a secure circuit to provide a secure enclave, the secure enclave to receive a request from the first processor to authenticate the set of credentials, the request including supplied credentials and an authentication type, where the secure enclave is to block the request from the first processor in response to a determination that the user account has exceeded a threshold number of successive failed authentication attempts for the authentication type.

公开(公告)号：US20220391517A1

公开(公告)日：2022-12-08

申请号：US17805329

申请日：2022-06-03

Applicant: Apple Inc.

Inventor： Wade Benson ,  Anthony J. Chivetta ,  D. J. Capelis

IPC: G06F21/60 ,  G06F21/78 ,  G06F21/31 ,  G06F21/57

Abstract: Techniques are disclosed relating to securely storing data in a computing system. In some embodiments, a computing system performs a boot sequence that includes generating ephemeral key data and preventing the generated ephemeral key data from being stored in a non-volatile storage including persisting the generated ephemeral key data in the volatile storage. The boot sequence further includes creating, in the non-volatile storage, an ephemeral data volume and encrypting the ephemeral data volume by using the ephemeral key data persisted in the volatile storage.

公开(公告)号：US20220129527A1

公开(公告)日：2022-04-28

申请号：US17505318

申请日：2021-10-19

Applicant: Apple Inc.

Inventor： Alan M. Dunn ,  Anish C. Trivedi ,  Ronnie G. Misra ,  Wade Benson ,  Anand Dalal

IPC: G06F21/31 ,  G06F21/62 ,  G06F21/64 ,  G06F1/3234 ,  G06F21/60

Abstract: Techniques are disclosed relating to maintaining device security associated with reduced power modes. In some embodiments, a computing device receives a request to place the computing device in a reduced power mode in which a first memory of the computing device is powered off. Based on the request, the computing device offloads a memory page from the first memory to a second memory such that the offloading includes encrypting the memory page. Based on a request to resume from the reduced power mode, the computing device restores the memory page from the second memory to the first memory such that the restoring includes decrypting the encrypted memory page. After initiating the restoring, the computing device presents a user authentication prompt asking for a user credential.

公开(公告)号：US11178127B2

公开(公告)日：2021-11-16

申请号：US15497203

申请日：2017-04-26

Applicant: Apple Inc.

Inventor： Wade Benson ,  Marc J. Krochmal ,  Alexander R. Ledwith ,  John Iarocci ,  Jerrold V. Hauck ,  Michael Brouwer ,  Mitchell D. Adler ,  Yannick L. Sierra

IPC: H04W12/08 ,  H04L29/06 ,  H04W12/041 ,  H04W12/086 ,  H04W12/0431 ,  G06F9/445 ,  H04W12/06 ,  H04L9/08 ,  H04L9/14 ,  H04L9/32

Abstract: Some embodiments of the invention provide a method for a trusted (or originator) device to modify the security state of a target device (e.g., unlocking the device) based on a securing ranging operation (e.g., determining a distance, proximity, etc.). The method of some embodiments exchanges messages as a part of a ranging operation in order to to determine whether the trusted and target devices are within a specified range of each other before allowing the trusted device to modify the security state of the target device. In some embodiments, the messages are derived by both devices based on a shared secret and are used to verify the source of ranging signals used for the ranging operation. In some embodiments, the method is performed using multiple different frequency bands.

公开(公告)号：US20210141902A1

公开(公告)日：2021-05-13

申请号：US17122771

申请日：2020-12-15

Applicant: Apple Inc.

Inventor： Pierre Oliver Martel ,  Arthur Mesh ,  Wade Benson

IPC: G06F21/57 ,  G06F21/31 ,  G06F21/45

Abstract: Embodiments described herein provide for a system, method, and apparatus to provision domains in a secure enclave processor to support multiple users. One embodiment provides for an apparatus comprising a first processor to receive a set of credentials associated with one of multiple user accounts on the apparatus and a second processor including a secure circuit to provide a secure enclave, the secure enclave to receive a request from the first processor to authenticate the set of credentials, the request including supplied credentials and an authentication type, where the secure enclave is to block the request from the first processor in response to a determination that the user account has exceeded a threshold number of successive failed authentication attempts for the authentication type.

公开(公告)号：US10079677B2

公开(公告)日：2018-09-18

申请号：US15173643

申请日：2016-06-04

Applicant: Apple Inc.

Inventor： Wade Benson ,  Libor Sykora ,  Vratislav Kuzela ,  Michael Brouwer ,  Andrew R. Whalley ,  Jerrold V. Hauck ,  David Finkelstein ,  Thomas Mensch

IPC: H04L29/06 ,  H04L9/08 ,  H04L9/32 ,  H04L9/00 ,  G06F21/32 ,  H04L9/14

CPC classification number: H04L9/0861 ,  G06F13/28 ,  G06F13/4063 ,  G06F21/32 ,  G06F21/72 ,  G06F21/74 ,  G06F21/78 ,  G06F21/79 ,  H04L9/006 ,  H04L9/0877 ,  H04L9/14 ,  H04L9/3231 ,  H04L9/3234 ,  H04L9/3239 ,  H04L9/3247 ,  H04L9/3249 ,  H04L9/3263 ,  H04L9/3268 ,  H04L63/0428 ,  H04L63/062 ,  H04L63/0823 ,  H04L63/0861 ,  H04L2209/12 ,  H04L2209/127 ,  H04L2463/081

Abstract: Techniques are disclosed relating to relating to a public key infrastructure (PKI). In one embodiment, an integrated circuit is disclosed that includes at least one processor and a secure circuit isolated from access by the processor except through a mailbox mechanism. The secure circuit is configured to generate a key pair having a public key and a private key, and to issue, to a certificate authority (CA), a certificate signing request (CSR) for a certificate corresponding to the key pair. In some embodiments, the secure circuit may be configured to receive, via the mailbox mechanism, a first request from an application executing on the processor to issue a certificate to the application. The secure circuit may also be configured to perform, in response to a second request, a cryptographic operation using a public key circuit included in the secure circuit.

公开(公告)号：US20170373843A1

公开(公告)日：2017-12-28

申请号：US15173643

申请日：2016-06-04

Applicant: Apple Inc.

Inventor： Wade Benson ,  Libor Sykora ,  Vratislav Kuzela ,  Michael Brouwer ,  Andrew R. Whalley ,  Jerrold V. Hauck ,  David Finkelstein ,  Thomas Mensch

IPC: H04L9/08 ,  H04L9/00 ,  H04L9/14 ,  H04L9/32 ,  G06F21/32

CPC classification number: H04L9/0861 ,  G06F21/32 ,  G06F21/74 ,  H04L9/006 ,  H04L9/0877 ,  H04L9/14 ,  H04L9/3231 ,  H04L9/3234 ,  H04L9/3239 ,  H04L9/3247 ,  H04L9/3249 ,  H04L9/3263 ,  H04L9/3268 ,  H04L2209/12 ,  H04L2209/127

Abstract: Techniques are disclosed relating to relating to a public key infrastructure (PKI). In one embodiment, an integrated circuit is disclosed that includes at least one processor and a secure circuit isolated from access by the processor except through a mailbox mechanism. The secure circuit is configured to generate a key pair having a public key and a private key, and to issue, to a certificate authority (CA), a certificate signing request (CSR) for a certificate corresponding to the key pair. In some embodiments, the secure circuit may be configured to receive, via the mailbox mechanism, a first request from an application executing on the processor to issue a certificate to the application. The secure circuit may also be configured to perform, in response to a second request, a cryptographic operation using a public key circuit included in the secure circuit.

公开(公告)号：US20170357817A1

公开(公告)日：2017-12-14

申请号：US15275289

申请日：2016-09-23

Applicant: Apple Inc.

Inventor： Eric B. Tamura ,  Wade Benson ,  John Garvey

IPC: G06F21/60 ,  H04L9/14 ,  G06F21/31

CPC classification number: G06F21/6218 ,  G06F21/31 ,  G06F21/602 ,  G06F21/78 ,  G06F2221/2107 ,  H04L9/0822 ,  H04L9/0863 ,  H04L9/14

Abstract: Techniques are disclosed relating to securely storing file system metadata in a computing device. In one embodiment, a computing device includes a processor, memory, and a secure circuit. The memory has a file system stored therein that includes metadata for accessing a plurality of files in the memory. The metadata is encrypted with a metadata encryption key that is stored in an encrypted form. The secure circuit is configured to receive a request from the processor to access the file system. In response to the request, the secure circuit is configured to decrypt the encrypted form of the metadata encryption key. In some embodiments, the computing device includes a memory controller configured to receive the metadata encryption key from the secure circuit, retrieve the encrypted metadata from the memory, and decrypt the encrypted metadata prior to providing the metadata to the processor.

公开(公告)号：US20150348022A1

公开(公告)日：2015-12-03

申请号：US14475375

申请日：2014-09-02

Applicant: Apple Inc.

Inventor： Ahmer A. Khan ,  Jerrold V. Hauck ,  George R. Dicker ,  Jeffrey C. Lee ,  Mitchell D. Adler ,  Wade Benson

IPC: G06Q20/38 ,  G06Q20/40 ,  G06Q20/32

CPC classification number: G06Q20/385 ,  G06Q20/3226 ,  G06Q20/354 ,  G06Q20/3829

Abstract: A system for provisioning credentials onto an electronic device is provided. The system may include a payment network subsystem, a service provider subsystem, and one or more user devices that can be used to perform mobile transactions at a merchant terminal. The user device may communicate with the service provider subsystem in order to obtained commerce credentials from the payment network subsystem. The user device may include a secure element and a corresponding trusted processor. The trusted processor may generate a random authorization number and inject that number into the secure element. Mobile payments should only be completed if the random authorization number on the secure element matches the random authorization number at the trusted processor. The trusted processor may be configured to efface the previous random authorization number and generate a new random authorization number when detecting a potential change in ownership at the user device.

Abstract translation: 提供了一种用于将凭证提供到电子设备上的系统。 系统可以包括支付网络子系统，服务提供商子系统以及可以用于在商家终端执行移动交易的一个或多个用户设备。 用户设备可以与服务提供商子系统通信，以便从支付网络子系统获得商业凭证。 用户设备可以包括安全元件和相应的可信处理器。 可信处理器可以生成随机授权号，并将该号码注入到安全元件中。 仅当安全元素上的随机授权号码与可信处理器上的随机授权号码匹配时，才应完成移动支付。 信任处理器可以被配置为在检测用户设备的所有权的潜在变化时消除先前的随机授权号码并生成新的随机授权号码。