Abstract:
A computing device executes one or more trusted execution environment (TEE) processes in a TEE of a processor. The one or more TEE processes cryptographically protect a secret and a policy. The policy specifies a plurality of conditions on usage of the secret. A particular non-TEE process generates a request whose fulfillment involves an action requiring use of the secret. Responsive to the request, one or more non-TEE processes determine whether a first subset of the plurality of conditions is satisfied. Responsive to the first subset of the plurality of conditions being satisfied, the one or more TEE processes determine that a second, different subset of the plurality of conditions is satisfied. Responsive to determining the second subset of the plurality of conditions is satisfied, the one or more TEE processes use the secret to perform the action.
Abstract:
Systems and techniques are provided for gesture-based password entry to unlock an encrypted device. A gesture input from a user to a gesture interface may be received. The gesture input may be converted to gesture data which may be hashed using a hashing algorithm to obtain a table key. A table including a master key may be encrypted using the table key. The master key may include a key for decrypting a primary storage that is at least partially encrypted. A second gesture input may be receive. The second gesture input may be an input from a user to the gesture interface. The second gesture input may be converted to second gesture data which may be hashed using the hashing algorithm to obtain a key equivalent to the table key. The table including the master key may be decrypted using the key equivalent to the table key.
Abstract:
Systems and techniques are provided for trust agents. Trust agents may be enabled. A state determination may be received from each of the enabled trust agents. The state determination may indicate either a trusted state or an untrusted state. The received state determinations may be combined to determine a security state. A security measure may be enabled or disabled based on the determined security state.
Abstract:
Systems and techniques are provided for trust agents. Trust agents may be enabled. A state determination may be received from each of the enabled trust agents. The state determination may indicate either a trusted state or an untrusted state. The received state determinations may be combined to determine a security state. A security measure may be enabled or disabled based on the determined security state.
Abstract:
A computing device executes one or more trusted execution environment (TEE) processes in a TEE of a processor. The one or more TEE processes cryptographically protect a secret and a policy. The policy specifies a plurality of conditions on usage of the secret. A particular non-TEE process generates a request whose fulfillment involves an action requiring use of the secret. Responsive to the request, one or more non-TEE processes determine whether a first subset of the plurality of conditions is satisfied. Responsive to the first subset of the plurality of conditions being satisfied, the one or more TEE processes determine that a second, different subset of the plurality of conditions is satisfied. Responsive to determining the second subset of the plurality of conditions is satisfied, the one or more TEE processes use the secret to perform the action.
Abstract:
Systems and techniques are provided for aggregation of asynchronous trust outcomes in a mobile device. Trust levels may be determined from the signals. Each trust level may be determined independently of any other trust level. Each trust level may be determined based on applying to the signals heuristics, mathematical optimization, decisions trees, machine learning systems, or artificial intelligence systems. An aggregated trust outcome may be determined by aggregating the trust levels. Aggregating the trust levels may include applying heuristics, mathematical optimization, decisions trees, machine learning systems, or artificial intelligence systems to the trust levels, and wherein the aggregated trust outcome; and sending the aggregated trust outcome to be implemented by the enabling, disabling, or relaxing of at least one security measure based on the aggregated trust outcome.
Abstract:
A computing device is described that outputs for display at a presence-sensitive screen a lock screen graphical user interface. The lock screen graphical user interface includes a widget region and an unlock region. The widget region includes a widget and an overlay that at least partially obscures the widget. The computing device receives an indication of a user input and determines a characteristic of the user input. In response to determining that the determined characteristic satisfies a threshold, the computing device removes the overlay from the widget region.
Abstract:
Systems and techniques are provided for gesture-based password entry to unlock an encrypted device. A gesture input from a user to a gesture interface may be received. The gesture input may be converted to gesture data which may be hashed using a hashing algorithm to obtain a table key. A table including a master key may be encrypted using the table key. The master key may include a key for decrypting a primary storage that is at least partially encrypted. A second gesture input may be receive. The second gesture input may be an input from a user to the gesture interface. The second gesture input may be converted to second gesture data which may be hashed using the hashing algorithm to obtain a key equivalent to the table key. The table including the master key may be decrypted using the key equivalent to the table key.
Abstract:
A smart-watch can include a wristband, a base, and a flip up portion. The base can be coupled to the wristband and include a housing, a processor, a wireless transceiver, and a tactile user interface. The wireless transceiver can be configured to connect to a wireless network. The tactile user interface can be configured to provide interaction between a user and the smart-watch. The flip up portion can be displaceable between an open position exposing the base and a closed position concealing the base. Further, the flip up portion can include: a top display exposed when the flip up portion is in the closed position, and an inside display opposite the top display. The inside display can be concealed when the flip up portion is in the closed position and be exposed when the flip up portion is in the open position.
Abstract:
A computing device is described that outputs for display at a presence-sensitive screen a lock screen graphical user interface. The lock screen graphical user interface includes an unlock region and a widget region including a first widget. The computing device receives an indication of a user input received at a location of the presence-sensitive screen within the widget region. The computing device determines a characteristic of the user input including at least one of a shape, a length, a velocity, and an acceleration. Responsive to determining that the determined characteristic exceeds a threshold, the computing device outputs for display an updated widget region of the lock screen graphical user interface that includes a second widget.