# US 12,008,087 B2 · Secure reduced power mode > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,087 B2 - Document ID: US12008087B2 - Status: Granted - Kind: B2 - Application number: 17/505,318 - Filed: 2021-10-19 - Published: 2022-04-28 - Granted: 2024-06-11 - Earliest claimed: 2020-10-26 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: Alan M. Dunn; Anish C. Trivedi; Ronnie G. Misra; Wade Benson; Anand Dalal - Web page: https://patentgrep.com/patent/US12008087B2 ## CPC - G06F 21/31: User authentication - G06F 1/3203: Power management, i.e. event-based initiation of a power-saving mode - G06F 1/3234: Power saving characterised by the action undertaken - G06F 1/3275: {Power saving in memory, e.g. RAM, cache} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 9/3247: {involving digital signatures} - G06F 1/3212: Monitoring battery levels, e.g. power saving mode being initiated when battery voltage goes below a certain level - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are disclosed relating to maintaining device security associated with reduced power modes. In some embodiments, a computing device receives a request to place the computing device in a reduced power mode in which a first memory of the computing device is powered off. Based on the request, the computing device offloads a memory page from the first memory to a second memory such that the offloading includes encrypting the memory page. Based on a request to resume from the reduced power mode, the computing device restores the memory page from the second memory to the first memory such that the restoring includes decrypting the encrypted memory page. After initiating the restoring, the computing device presents a user authentication prompt asking for a user credential. ## Claims ### Claim 1 A non-transitory computer readable medium having program instructions stored therein that are executable by a computing device to cause the computing device to perform operations comprising: receiving a request to place the computing device in a reduced power mode in which a first memory of the computing device is powered off; based on the request, offloading a memory page from the first memory to a second memory, wherein the offloading includes encrypting the memory page; based on a request to resume from the reduced power mode, restoring the memory page from the second memory to the first memory, wherein the restoring includes decrypting the encrypted memory page using a first cryptographic key accessible prior to a user authentication prompt; after initiating the restoring, presenting the user authentication prompt asking for a user credential; and granting access to encrypted data stored in the second memory using a second cryptographic key made accessible in response to reception of the user credential. ### Claim 2 (depends on 1) The computer readable medium of claim 1, wherein the operations further comprise: performing an authentication by verifying a user credential received responsive to the user authentication prompt, wherein the second cryptographic key is protected by the user authentication credential. ### Claim 3 (depends on 2) The computer readable medium of claim 2, wherein the granting includes deriving the second cryptographic key based on the user credential. ### Claim 4 (depends on 1) The computer readable medium of claim 1, wherein the encrypting includes: generating the first cryptographic key in response to the request to place the computing device in a reduced power mode; and encrypting the memory page using the first cryptographic key. ### Claim 5 (depends on 1) The computer readable medium of claim 1, wherein the operations further comprise: detecting a change corresponding to a power source of the computing device; and based on the detecting, providing the request to resume from the reduced power mode. ### Claim 6 (depends on 1) The computer readable medium of claim 1, wherein the operations further comprise: receiving user input via a user interface of the computing device; and based on the user input, providing the request to resume from the reduced power mode. ### Claim 7 (depends on 1) The computer readable medium of claim 1, wherein the operations further comprise: detecting that a power level of a power source of the computing device has reached a threshold, wherein the request to place the computing device in the reduced power mode is received responsive to the detecting. ### Claim 8 (depends on 1) The computer readable medium of claim 1, wherein the offloading includes: generating a signature of the memory page; storing the signature in the second memory; and wherein the restoring includes verifying the memory page against the stored signature. ### Claim 9 (depends on 8) The computer readable medium of claim 8, wherein the generating includes: generating the signature over a plurality of memory pages being offloaded from the first memory, wherein ones of the plurality of memory pages are input into a signature generation function based on an ordering that the memory pages are stored in the first memory. ### Claim 10 (depends on 1) The computer readable medium of claim 1, wherein the operations further comprise: storing a first set of metadata about an initial boot of the computing device, wherein the first set of metadata is stored in the second memory; based on the request to resume from the reduced power mode, comparing the first set of metadata with a second set of metadata when causing the computing device to resume from the reduced power mode; and based on the comparing, determining whether to present the user authentication prompt. ### Claim 11 A computing device, comprising: one or more processors; and memory having program instructions stored therein that are executable by the one or more processors to cause the computing device to perform operations comprising: receiving a request to place the computing device in a reduced power mode in which a first memory of the computing device is powered off; based on the request, offloading a memory page from the first memory to a second memory, wherein the offloading includes encrypting the memory page; based on a request to resume from the reduced power mode, restoring the memory page from the second memory to the first memory, wherein the restoring includes decrypting the encrypted memory page using a first cryptographic key accessible prior to a user authentication prompt; after initiating the restoring, presenting the user authentication prompt asking for a user credential; and granting access to encrypted data stored in the second memory using a second cryptographic key made accessible in response to reception of the user credential. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the operations further comprise: after the user authentication, using the user credential to derive the second cryptographic key. ### Claim 13 (depends on 11) The computing device of claim 11, wherein the operations further comprise: providing the request to resume from the reduced power mode in response to detecting a change associated with a power source of the computing device. ### Claim 14 (depends on 11) The computing device of claim 11, wherein the offloading includes generating a signature based on the memory page; and wherein the restoring includes verifying the signature against the memory page from the second memory. ### Claim 15 (depends on 11) The computing device of claim 11, wherein the operations further comprise: storing a first set of metadata about an initial boot of the computing device; and prior to presenting the user authentication prompt, verifying the first set of metadata matches a second set of metadata associated with resuming from the reduced power mode. ### Claim 16 A method, comprising: receiving, by a computing device, a request to place the computing device in a reduced power mode in which a first memory of the computing device is powered off; based on the request, offloading, by the computing device, a memory page from the first memory to a second memory, wherein the offloading includes encrypting the memory page; based on a request to resume from the reduced power mode, restoring, by the computing device, the memory page from the second memory to the first memory, wherein the restoring includes decrypting the encrypted memory page using a first cryptographic key accessible prior to a user authentication prompt; and after initiating the restoring, presenting, by the computing device, the user authentication prompt asking for a user credential; and granting, by the computing device, access to encrypted data stored in the second memory using a second cryptographic key made accessible in response to reception of the user credential. ### Claim 17 (depends on 16) The method of claim 16, further comprise: after the user authentication, deriving, by the computing device, the second cryptographic key based on the user credential. ### Claim 18 (depends on 16) The method of claim 16, wherein the request to resume from the reduced power mode corresponds to a user input received via a user interface. ### Claim 19 (depends on 16) The method of claim 16, wherein the offloading includes storing a signature generated based on the memory page in the second memory; and wherein the restoring includes using the signature to verify the memory page from the second memory. ### Claim 20 (depends on 16) The method of claim 16, further comprising: storing, in the second memory, a first set of metadata about an initial boot of the computing device; based on the request to resume from the reduced power mode, verifying the first set of metadata against a second set of metadata when causing the computing device to resume from the reduced power mode; and based on the verifying, determining whether to present the user authentication prompt.