Conflict resolution for keychain syncing

• US 9,077,759 B2
• Filed: 03/15/2013
• Issued: 07/07/2015
• Est. Priority Date: 01/18/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Brouwer, Michael, De Atley, Dallas B., Adler, Mitchell D.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US13/839,084
• Publication Number:
  US 20140208404A1
• Time in Patent Office: 844 Days
• Field of Search: 726/6
• US Class Current: 1/1
• CPC Class Codes: G06F 16/275 Synchronous replication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use

Abstract

Some embodiments provide a program that synchronizes a keychain stored on a device with a set of other devices. The keychain includes a set of keychain items. The program receives (1) a list of keychain items for updating the keychain stored on the device and (2) data representing the keychain items specified in the list of keychain items. For each keychain item in the list of keychain items, the program updates the keychain stored on the device with the data that represents the keychain item.

Claims

1. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit of a first device in a set of peer devices synchronizes a keychain stored on the first device with a set of keychains stored on other devices in the set of peer devices, each keychain comprising a set of keychain items, the set of peer devices communicatively coupled to one another in a peer-to-peer network through a set of network storage devices, the program comprising sets of instructions for:

receiving, from the set of network storage devices, a first keychain item for updating the keychain stored on the first device;

determining whether a first unique identifier associated with the first keychain item matches a second unique identifier associated with a second keychain item in the keychain stored on the first device;

resolving, when the second unique identifier is determined to match the first unique identifier, a conflict between the first and second keychain items and updating the second keychain item based on the resolution, wherein the first keychain item is associated with a first conflict resolver and the second keychain item is associated with a second conflict resolver; and

wherein the resolving comprises utilizing the second conflict resolver to resolve the conflict between the first and second keychain items in response to the second conflict resolver being a same conflict resolver or a more recently updated conflict resolver than the first conflict resolver.

2. The non-transitory machine-readable medium of claim 1, wherein the program further comprises a set of instructions for adding the first keychain item to the keychain stored on the first device when the second unique identifier is determined to not match a unique identifier of any keychain item in the keychain stored in the first device.

3. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for resolving the conflict comprises sets of instruction for:

identifying conflict resolution metadata associated with the first keychain item and conflict resolution metadata associated with the second keychain item;

determining, based on the conflict resolution metadata, whether the first conflict resolver associated with the first keychain item conflicts with the second conflict resolver associated with the second keychain item; and

using, when the first and second conflict resolvers are determined to not conflict, the second conflict resolver to resolve the conflict between the first and second keychain items.

4. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for resolving the conflict comprises sets of instruction for setting a value of the second keychain item to a value of the first keychain item when the first conflict resolver is more recently updated than the second conflict resolver.

5. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for resolving the conflict comprises sets of instructions for:

determining whether the first keychain item is more recent than the second keychain item;

setting, when the first keychain item is determined as more recent, a value of the second keychain item to a value of first keychain item as the resolution to the conflict.

6. The non-transitory machine-readable medium of claim 5, wherein the set of instructions for determining whether the first keychain item is more recent than the second keychain item comprises a set of instructions for determining whether the first keychain item is more recent than the second keychain item based on timestamps associated with the first keychain item and the second keychain item.

7. The non-transitory machine-readable medium of claim 5, wherein the set of instructions for resolving the conflict further comprises a set of instructions for leaving a value of the second keychain item stored on the first device unchanged, when the first keychain item is not determined as more recent then the second keychain item.

8. The non-transitory machine-readable medium of claim 1, wherein the peer-to-peer network is implemented as an overlay network configured according to a star topology, wherein the set of network storage devices is a center of said star topology.

9. The non-transitory machine-readable medium of claim 8, wherein the set of network storage devices provides cloud services for the set of peer devices.

10. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for receiving, from the set of network storage devices, the first keychain item comprises sets of instructions for:

receiving a notification from the set of network storage devices that a second device in the set of peer devices has stored the first keychain item in the set of network storage devices for retrieval by the first device; and

retrieving the first keychain item from the set of network storage devices.

11. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for receiving, from the set of network storage devices, the first keychain item comprises sets of instructions for:

receiving a notification from the set of network storage devices that a second device in the set of peer devices has stored the first keychain item in the set of network storage devices for retrieval by the first device while the first device has been offline; and

retrieving the first keychain item from the set of network storage devices.

12. A method for synchronizing a keychain stored on a first device in a set of devices with a set of keychains stored on other devices in the set of devices, each keychain comprising a set of keychain items, the method comprising:

receiving a first keychain item for updating the keychain stored on the first device, the first keychain item comprising a password;

at the first device, determining whether a first unique identifier associated with the first keychain item matches a second unique identifier associated with a second keychain item in the keychain stored on the device; and

at the first device, resolving a conflict between the first and second keychain items and updating the second keychain item based on the resolution when the second unique identifier is determined to match the first unique identifier, wherein the first keychain item is associated with a first conflict resolver and the second keychain item is associated with a second conflict resolver,

wherein the resolving comprises utilizing the second conflict resolver to resolve the conflict between the first and second keychain items in response to the second conflict resolver being a same conflict resolver or a more recently updated conflict resolver than the first conflict resolver.

13. The method of claim 12 further comprising adding the first keychain item to the keychain stored on the first device when the second unique identifier is determined to not match a unique identifier of any keychain item in the keychain stored in the first device.

14. The method of claim 12, wherein resolving the conflict comprises:

identifying conflict resolution metadata associated with the first keychain item and conflict resolution metadata associated with the second keychain item;

based on the conflict resolution metadata, determining whether the first conflict resolver associated with the first keychain item conflicts with the second conflict resolver associated with the second keychain item; and

when the first and second conflict resolvers are determined to not conflict, using the second conflict resolver to resolve the conflict between the first and second keychain items.

15. The method of claim 12, wherein resolving the conflict comprises setting a value of the second keychain item to a value of the first keychain item when the first conflict resolver is more recently updated than the second conflict resolver.

16. The method of claim 12, wherein resolving the conflict comprises:

determining whether the first keychain item is more recent than the second keychain item;

when the first keychain item is determined as more recent, setting a value of the second keychain item to a value of first keychain item as the resolution to the conflict.

17. The method of claim 16, wherein determining whether the first keychain item is more recent than the second keychain item comprises determining whether the first keychain item is more recent than the second keychain item based on timestamps associated with the first keychain item and the second keychain item.

18. The method of claim 12, wherein the password is one of a password to access a website and a password to access an application.

19. The method of claim 12, wherein the devices in the set of devices are peer devices communicatively coupled to one another in a peer-to-peer network through a set of network storage devices, the method further comprising:

receiving a notification from the set of network storage devices that a second device in the set of peer devices has stored the first keychain item in the set of network storage devices for retrieval by the first device,

wherein receiving the first keychain item comprises retrieving the first keychain item from the set of network storage devices.

20. The method of claim 19, wherein the peer-to-peer network is implemented as an overlay network configured according to a star topology, wherein the set of network storage devices is a center of said star topology.

21. The method of claim 20, wherein the set of network storage devices provides cloud services for the set of peer devices.

22. The method of claim 12, wherein the devices in the set of devices are peer devices communicatively coupled to one another in a peer-to-peer network through a set of network storage devices, the method further comprising:

receiving a notification from the set of network storage devices that a second device in the set of peer devices has stored the first keychain item in the set of network storage devices for retrieval by the first device while the first device has been offline; and

retrieving the first keychain item from the set of network storage devices.

23. A first device, comprising:

a set of physical processing units for executing sets of instructions; and

a non-transitory machine readable medium storing a program which when executed by at least one of the physical processing units synchronizes a keychain stored on the device with a set of keychains stored on a set of other devices, each keychain comprising a set of keychain items, the program comprising sets of instructions for;

receiving, from a second device, a first keychain item associated with a first conflict resolver on the second device;

determining that there is a conflict between the first keychain item and a second keychain item stored on the first device;

setting a value of the second keychain item to a value of the first keychain item when the first conflict resolver has a more recent version than a second conflict resolver that is associated with the second keychain item; and

resolving the conflict between the first and second keychain items utilizing the second conflict resolver when the second conflict resolver has a same version or a more recent version than the first conflict resolver.

24. The device of claim 23, wherein the set of instructions for resolving the conflict comprises sets of instruction for:

identifying conflict resolution metadata associated with the first keychain item and conflict resolution metadata associated with the second keychain item; and

determining, based on the identified conflict resolution metadata, whether the first conflict resolver conflicts with the second conflict resolver.

25. The device of claim 24, wherein the conflict resolution metadata of each of the first and second keychain items comprises a flag indicating that the keychain item is a result of a conflict resolution.

26. The device of claim 25, wherein the conflict resolution metadata of each of the first and second keychain items further comprises a version number of the conflict resolver used to resolve the conflict for the keychain item.

27. The device of claim 24, wherein the conflict resolution metadata of each of the first and second keychain items comprises the conflicting items from which the keychain item was resolved.

28. The device of claim 23, wherein the set of instructions for resolving the conflict between the first and second keychain items utilizing the second conflict resolver comprises sets of instructions for:

determining whether the first keychain item is more recent than the second keychain item based on timestamps associated with the first keychain item and the second keychain item; and

setting, when the first keychain item is determined as more recent, a value of the second keychain item to a value of first keychain item as the resolution to the conflict.