Keychain syncing

• US 9,197,700 B2
• Filed: 03/15/2013
• Issued: 11/24/2015
• Est. Priority Date: 01/18/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Brouwer, Michael, De Atley, Dallas B., Adler, Mitchell D.
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US13/839,050
• Publication Number:
  US 20140281540A1
• Time in Patent Office: 984 Days
• Field of Search: 726/4, 726/29, 713/169, 709/204, 709/225, 709/227
• US Class Current: 1/1
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: H04L 12/185 with management of multicast group membership
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 2209/122 Hardware reduction or efficient architectures
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1042 using topology management mechanisms
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Some embodiments provide non-transitory machine-readable medium that stores a program which when executed by at least one processing unit of a device synchronizes a set of keychains stored on the device with a set of other devices. The device and the set of other devices are communicatively coupled to one another through a peer-to-peer (P2P) network. The program receives a modification to a keychain in the set of keychains stored on the device. The program generates an update request for each device in the set of other devices in order to synchronize the set of keychains stored on device with the set of other devices. The program transmits through the P2P network the set of update requests to the set of other devices over a set of separate, secure communication channels.

Claims

1. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit of a first peer device in a set of peer devices processes a request from a second peer device in the set of peer devices to join a synchronization circle for synchronizing keychains, the synchronization circle comprising a plurality of the peer devices, including the first peer device, that share secure data, the program comprising sets of instructions for:

receiving a request for the second peer device to join the synchronization circle, wherein the synchronization circle is associated with a particular cloud services account;

determining, at the first peer device, whether the request is authenticated based on data received with the request that is derived from a password associated with the particular cloud services account;

when the request is determined as authenticated, prompting for input approving the request by the second peer device;

when input approving the request is received, adding the second peer device to the synchronization circle; and

sharing secure data between the first and second peer devices by synchronizing keychains between the first and second peer devices after the addition of the second peer device to the synchronization circle.

2. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for determining whether the request is authenticated comprises sets of instructions for:

verifying that a user associated with the synchronization circle submitted the request for the second peer device to join the synchronization circle; and

verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device.

3. The non-transitory machine-readable medium of claim 2, wherein the data received with the request for the second peer device to join the synchronization circle that is derived from the password of the cloud services account comprises a signature of the request signed with a private key of a user signing public/private key pair generated based on the password of the cloud services account, wherein the set of instructions for verifying that the user associated with the synchronization circle submitted the request for the second peer device to join the synchronization circle comprises sets of instructions for:

decrypting the signature of the request with a public key of the user signing public/private key pair generated based on the password of the cloud services account; and

determining that the request matches the decrypted signature.

4. The non-transitory machine-readable medium of claim 2, wherein the data received with the request for the second peer device to join the synchronization circle comprises a signature of the request, wherein the set of instructions for verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device comprises sets of instructions for:

decrypting the signature of the request with a public key of a public/private key pair belonging to and generated by the second peer device; and

determining that the request matches the decrypted signature.

5. The non-transitory machine-readable medium of claim 1, wherein the set of instructions for prompting for the input approving the request comprises a set of instructions for displaying a request for a password of the cloud services account to be entered on a display screen of the first peer device.

6. For a first peer device in a set of peer devices, a method for processing a request from a second peer device in the set of peer devices to join a synchronization circle for synchronizing keychains, the synchronization circle comprising a plurality of the peer devices, including the first peer device, that share secure data, the method comprising:

receiving a request for the second peer device to join the synchronization circle, wherein the synchronization circle is associated with a particular cloud services account;

determining, at the first peer device, whether the request is authenticated based on data received with the request that is derived from a password associated with the particular cloud services account;

when the request is determined as authenticated, prompting for input approving the request by the second peer device;

when input approving the request is received, adding the second peer device to the synchronization circle; and

sharing secure data between the first and second peer devices by synchronizing keychains between the first and second peer devices after the addition of the second peer device to the synchronization circle.

7. The method of claim 6, wherein adding the second peer device to the synchronization circle comprises adding data uniquely identifying the second peer device to a list of devices specified as members of the synchronization circle.

8. The method of claim 7, wherein adding the second peer device to the synchronization circle further comprises generating a signature of the list of devices with a private key of a public/private device signing key pair belonging to and generated by the first peer device.

9. The method of claim 8, wherein adding the second peer device to the synchronization circle further comprises storing the list of devices and the generated signature in a central location for sharing with the other peer devices in the synchronization circle.

10. The method of claim 6, wherein the secure data shared between the first peer device and the second peer device comprises at least one of passwords, private keys, certificates, and secured notes.

11. The method of claim 6, wherein determining whether the request is authenticated comprises:

verifying that a user associated with the synchronization circle submitted the request to the second peer device to join the synchronization circle; and

verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device.

12. The method of claim 11, wherein the data received with the request for the second peer device to join the synchronization circle that is derived from the password of the cloud services account comprises a signature of the request signed with a private key of a user signing public/private key pair generated based on the password of the cloud services account, wherein verifying that the user associated with the synchronization circle submitted the request for the second peer device to join the synchronization circle comprises:

decrypting the signature of the request with a public key of the user signing public/private key pair generated based on the password of the cloud services account; and

determining that the request matches the decrypted signature.

13. The method of claim 11, wherein the data received with the request for the second peer device to join the synchronization circle comprises a signature of the request, wherein verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device comprises:

decrypting the signature of the request with a public key of a public/private key pair belonging to and generated by the second peer device; and

determining that the request matches the decrypted signature.

14. The method of claim 6, wherein prompting for the input approving the request comprises displaying a request for a password of the cloud services account to be entered on a display screen of the first peer device.

15. An electronic first peer device in a set of peer devices, the first peer device comprising:

a set of processing units for executing sets of instructions; and

a non-transitory machine readable medium for storing a program which when executed by at least one of the processing units processes a request from a second peer device in the set of peer devices to join a synchronization circle for synchronizing keychains, the synchronization circle comprising a plurality of the peer devices, including the first peer device, that share secure data, the program comprising sets of instructions for;

receiving a request for the second peer device to join the synchronization circle wherein the synchronization circle is associated with a particular cloud services account;

determining, at the first peer device, whether the request is authenticated based on data received with the request that is derived from a password associated with the particular cloud services account;

when the request is determined as authenticated, prompting for input approving the request by the second peer device;

when input approving the request is received, adding the second peer device to the synchronization circle; and

sharing secure data between the first and second peer devices by synchronizing keychains between the first and second peer devices after the addition of the second peer device to the synchronization circle.

16. The electronic first peer device of claim 15, wherein the set of instructions for determining whether the request is authenticated comprises sets of instructions for:

verifying that a user associated with the synchronization circle submitted the request to the second peer device to join the synchronization circle; and

verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device.

17. The electronic first peer device of claim 16, wherein the data received with the request for the second peer device to join the synchronization circle that is derived from the password of the cloud services account comprises a signature of the request signed with a private key of a user signing public/private key pair generated based on the password of the cloud services account, wherein the set of instructions for verifying that the user associated with the synchronization circle submitted the request to for the second peer device to join the synchronization circle comprises sets of instructions for:

decrypting the signature of the request with a public key of the user signing public/private key pair generated based on the password of the cloud services account; and

determining that the request matches the decrypted signature.

18. The electronic first peer device of claim 16, wherein the data received with the request for the second peer device to join the synchronization circle comprises a signature of the request, wherein the set of instructions for verifying that the request for the second peer device to join the synchronization circle is generated by the second peer device comprises sets of instructions for:

decrypting the signature of the request with a public key of a public/private key pair belonging to and generated by the second peer device; and

determining that the request matches the decrypted signature.

19. The electronic first peer device of claim 15, wherein the set of instructions for prompting for the input approving the request comprises a set of instructions for displaying a request for a password of the cloud services account to be entered on a display screen of the first peer device.

20. The electronic first peer device of claim 15, wherein adding the second peer device to the synchronization circle comprises adding data uniquely identifying the second peer device to a list of devices specified as members of the synchronization circle.