# US 10,484,172 B2 · Secure circuit for encryption key generation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,172 B2
- Document ID: US10484172B2
- Status: Granted
- Kind: B2
- Application number: 15/173,647
- Filed: 2016-06-04
- Published: 2017-12-28
- Granted: 2019-11-19
- Earliest claimed: 2015-06-05
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Libor Sykora; Wade Benson; Vratislav Kuzela; Michael Brouwer; Andrew R. Whalley; Jerrold V. Hauck; David Finkelstein; Thomas Mensch
- Web page: https://patentgrep.com/patent/US10484172B2

## CPC

- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/72: in cryptographic circuits
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00)
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3249: {using RSA or related signature schemes, e.g. Rabin scheme}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 13/28: using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence)
- G06F 13/4063: {Device-to-bus coupling}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L 2209/127: Trusted platform modules [TPM]
- H04L 2463/081: applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques are disclosed relating to relating to a public key infrastructure (PKI). In one embodiment, an integrated circuit is disclosed that includes at least one processor and a secure circuit isolated from access by the processor except through a mailbox mechanism. In some embodiments, the secure circuit is configured to generate a public key and a private key for an application, and receive, from the application via an API, a request to perform a cryptographic operation using the private key. The secure circuit is further configured to perform the cryptographic operation in response to the request.

## Claims

### Claim 1

A non-transitory computer readable medium having program instructions stored therein, wherein the program instructions are executable by a computing device to cause the computing device to perform operations comprising:
presenting a login screen on a display of the computing device, wherein the login screen includes a prompt for a user password;
issuing a request to a secure circuit in a mobile device, wherein the request is for the secure circuit to generate a digital signature by using a private key in the secure circuit to sign a challenge included in the request to authenticate a user of the mobile device;
verifying a response received from the secure circuit, wherein the response includes the digital signature corresponding to the signed challenge; and
enabling functionality of the computing device in response to the verifying, wherein the enabling includes removing the login screen and allowing the user to access the computing device without the user entering the user password.

### Claim 2 (depends on 1)

The computer readable medium of claim 1, wherein the enabling includes allowing the user to access confidential data stored in a secure manner in the computing device.

### Claim 3 (depends on 2)

The computer readable medium of claim 2, wherein the confidential data includes a collection of user names and passwords.

### Claim 4 (depends on 1)

The computer readable medium of claim 1, wherein the enabling includes permitting a user to access an application on the computing device.

### Claim 5 (depends on 1)

The computer readable medium of claim 1, wherein the operations comprise:
receiving a certificate that includes a public key corresponding to the private key used to generate the digital signature; and
wherein the verifying includes using the public key to verify the digital signature against the received certificate.

### Claim 6 (depends on 1)

The computer readable medium of claim 1, wherein the operations comprise:
receiving, from the mobile device, an indication that the mobile device includes a biosensor usable to authenticate the user prior to generation of the digital signature.

### Claim 7 (depends on 1)

The computer readable medium of claim 1, wherein the request is issued to the secure circuit via a mailbox mechanism of the secure circuit.

### Claim 8 (depends on 1)

The computer readable medium of claim 1, wherein the request is issued to the secure circuit via a wireless interconnect between the mobile device and the computing device.

### Claim 9

A mobile device, comprising:
a wireless interface configured to receive a request from an external computing device presenting a login screen requesting a user password;
a biosensor configured to collect biometric information from a user of the mobile device; and
a secure circuit configured to:
generate a digital signature in response to the received request and in response to the collected biometric information matching biometric information of an authorized user of the mobile device, wherein generating the digital signature includes using a private key included in the secure circuit to sign a challenge included in the received request; and
issue, to the external computing device via the wireless interface, a response including the digital signature corresponding to the signed challenge, wherein the response including the digital signature is usable by the external computing device to perform a user authentication such that the external computing device removes a login screen without the user entering the user password in response to verification of the response.

### Claim 10 (depends on 9)

The mobile device of claim 9, wherein the secure circuit is configured to:
generate a public key pair having the private key to be used to generate the digital signature;
issue a certificate signing request (CSR) for the public key pair to a certificate authority; and
provide, the external computing device, a certificate issued in response to the CSR.

### Claim 11 (depends on 9)

The mobile device of claim 9, wherein the secure circuit is configured to receive the request including the challenge via a mailbox mechanism of the secure circuit.