DATA PROTECTION FOR KEYCHAIN SYNCING

• US 20140208434A1
• Filed: 03/15/2013
• Published: 07/24/2014
• Est. Priority Date: 01/18/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Brouwer, Michael, De Atley, Dallas B., Adler, Mitchell D.
• Granted Patent: US 9,124,637 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/275 Synchronous replication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use

Abstract

Some embodiments provide a program that provides data protection for a device when synchronizing a set of keychains stored on the device with a set of other devices. The program receives keychain data for synchronizing the set of keychains stored on the device with the set of other devices. The keychain data is specified as belonging to a protection domain. The program determines whether a set of conditions defined for the protection domain is satisfied. When the set of conditions is determined as satisfied, the program allows access to the keychain data in order to process the keychain data and synchronize the set of keychains stored on the device with the set of other devices.

Claims

1. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit of a device provides data protection for the device when synchronizing a set of keychains stored on the device with a set of other devices, the program comprising sets of instructions for:

receiving keychain data for synchronizing the set of keychains stored on the device with the set of other devices, the keychain data specified as belonging to a protection domain;

determining whether a set of conditions defined for the protection domain is satisfied; and

when the set of conditions is determined as satisfied, allowing access to the keychain data in order to process the keychain data and synchronize the set of keychains stored on the device with the set of other devices.

2. The non-transitory machine-readable medium of claim 1, the program further comprising a set of instructions for when the set of conditions is determined as not satisfied, continuing to prevent access to the keychain data.

3. The non-transitory machine-readable medium of claim 1, wherein the set of conditions comprises a condition requiring the device to be in an unlock state that allows a user of the device to interact with the device.

4. The non-transitory machine-readable medium of claim 1, wherein the protection domain is pre-defined and provided as part of an operating system operating on the device.

5. The non-transitory machine-readable medium of claim 1, wherein the keychain data comprises a list of keychain items to update and a set of data that represents the keychain items specified in the list of updated keychain items.

6. A method for providing data protection for a device when synchronizing a set of keychains stored on the device with a set of other devices, the method comprising:

receiving keychain data for synchronizing the set of keychains stored on the device with the set of other devices, the keychain data specified as belonging to a protection domain;

determining whether a set of conditions defined for the protection domain is satisfied; and

when the set of conditions is determined as satisfied, allowing access to the keychain data in order to process the keychain data and synchronize the set of keychains stored on the device with the set of other devices.

7. The method of claim 6, wherein the keychain data is received in an encrypted format, wherein allowing access to the keychain data comprises (1) allowing access to a decryption key for decrypting the keychain data and (2) decrypting the keychain data with the decryption key.

8. The method of claim 7, wherein the decryption key is a private key of a public/private key pair belonging to and generated by the device.

9. The method of claim 8, wherein the keychain data is encrypted in the encrypted format with a public key of the public/private key pair.

10. The method of claim 6 further comprising when the set of conditions is determined as not satisfied, preventing access to the keychain data by returning the keychain data to a processing queue for later processing.

11. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit of a device provides data protection for the device when synchronizing a set of keychains stored on the device with a set of other devices, each keychain comprising a plurality of keychain items, the program comprising sets of instructions for:

receiving keychain data for synchronizing a group of keychain items in the set of keychains stored on the device with the set of other devices, each keychain item specified as belonging to a particular protection domain of a plurality of different protection domains;

determining whether a set of conditions defined for the particular protection domain of each keychain item in the group of keychain items is satisfied; and

when the set of conditions for each keychain item in the group of keychain items is determined as satisfied, allowing access to the keychain data in order to process the keychain data and synchronize the group of keychain items in the set of keychains stored on the device with the set of other devices.

12. The non-transitory machine-readable medium of claim 11, the program further comprising a set of instructions for preventing access to the keychain data when the set of conditions for at least one keychain item in the group of keychain items is determined as not satisfied.

13. The non-transitory machine-readable medium of claim 12, wherein the set of instructions for preventing access to the keychain data comprises a set of instructions for returning the keychain data to a processing queue for later processing.

14. The non-transitory machine-readable medium of claim 11, wherein a first keychain item in the group of keychain items is a keychain item of a first keychain in the set of keychains and a second keychain item in the group of keychain items is a keychain item of a second keychain in the set of keychains different from the first keychain.

15. The non-transitory machine-readable medium of claim 11, wherein the set of conditions of a first protection domain in the plurality of different protection domains comprises the device is in an unlock state.

16. The non-transitory machine-readable medium of claim 15, wherein the set of conditions of the first protection domain in the plurality of different protection domains further comprises the device received valid user authentication information.