Granted Patent B2

US 12,445,289 · App. 17/591,430 · Granted Oct 14, 2025

Inventors: Chu Ly Tran (San Jose, CA); Xun Chen (Freemont, CA)

Assignee: Samsung Electronics Co., Ltd.

H04L9/3236H04L9/0833H04L63/0861H04L63/104

Abstract

Claims (70)

1. A method, comprising:

receiving, at a first electronic device associated with a first root identifier, a second root identifier from a second electronic device, wherein the first root identifier is based on a first profile tree maintained at the first electronic device, and wherein the second root identifier is associated with a second profile tree maintained at the second electronic device;

determining that the first root identifier does not match the second root identifier;

sending, to the second electronic device, the first profile tree, wherein the first profile tree comprises a representation of currently-maintained user profiles at the first electronic device;

receiving, from the second electronic device, user profile update information, wherein the user profile update information corresponds to user profile information maintained at the second electronic device and determined to be more recent than corresponding user profile information at the first electronic device; and

updating a subset of the currently-maintained user profiles based on the user profile update information.

2. The method of claim 1 , further comprising:

responsive to updating the subset of the currently-maintained user profiles, updating the first profile tree; and

generating an updated first root identifier based on the updated first profile tree.

3. The method of claim 1 , wherein the first profile tree comprises a Merkle tree generated from one or more hash tables of user profile data.

4. The method of claim 3 , wherein the first root identifier comprises a Merkle root of the first profile tree.

5. The method of claim 1 , further comprising:

detecting the second electronic device;

authenticating the second electronic device as a peer device of a shared device group; and

establishing a trusted connection with the second electronic device.

6. The method of claim 5 , wherein detecting the second electronic device comprises:

receiving an advertising message from the second electronic device,

wherein the advertising message comprises an identifier of the shared device group and at least a portion of the second root identifier.

7. The method of claim 5 , wherein establishing the trusted connection with the second electronic device comprises:

receiving, from the second electronic device, a group key for the shared device group; and

confirming that the group key for the shared device group received from the second electronic device matches a group key for the shared device group maintained at the first electronic device.

8. The method of claim 7 , further comprising:

responsive to confirming that the group key for the shared device group received from the second electronic device matches the group key for the shared device group maintained at the first electronic device, decrypting a biometric authentication profile for a user with the group key;

receiving, through a biometric sensor of the first electronic device, biometric information of the user;

authenticating the user by comparing the biometric information of the user against the biometric authentication profile for the user; and

sending a logoff message for the user to the second electronic device.

9. The method of claim 1 , further comprising:

receiving, at the first electronic device from a third electronic device, a third root identifier, wherein the third root identifier is associated with a third profile tree maintained at the third electronic device;

determining that the first root identifier does not match the third root identifier;

sending, to the third electronic device, the first profile tree;

receiving, from the third electronic device, second user profile update information; and

updating a second subset of the currently-maintained user profiles at the first electronic device based on the second user profile update information.

10. The method of claim 1 , further comprising:

subsequent to updating the subset of the currently-maintained user profiles based on the user profile update information, sending a report to a remote management console, wherein the report comprises at least one of per-profile metadata of the currently-maintained user profiles or per-device metadata based on the currently-maintained user profiles.

11. An electronic device associated with a first root identifier, the first root identifier based on a first profile tree maintained at the electronic device, the electronic device comprising:

at least one communication interface; and

at least one processor configured to:

receive, via the at least one communication interface, a second root identifier from a second electronic device, wherein the second root identifier is associated with a second profile tree maintained at the second electronic device,

determine that the first root identifier does not match the second root identifier,

send, to the second electronic device, the first profile tree, wherein the first profile tree comprises a representation of currently-maintained user profiles at the electronic device,

receive, from the second electronic device, user profile update information, wherein the user profile update information corresponds to user profile information maintained at the second electronic device and determined to be more recent than corresponding user profile information at the electronic device; and

update a subset of the currently-maintained user profiles based on the user profile update information.

12. The electronic device of claim 11 , wherein the at least one processor is further configured to:

responsive to updating the subset of the currently-maintained user profiles, update the first profile tree, and

generate an updated first root identifier based on the updated first profile tree.

13. The electronic device of claim 11 , wherein the first profile tree comprises a Merkle tree generated from one or more hash tables of user profile data.

14. The electronic device of claim 13 , wherein the first root identifier comprises a Merkle root of the first profile tree.

15. The electronic device of claim 11 , wherein the at least one processor is further configured to:

detect the second electronic device,

authenticate the second electronic device as a peer device of a shared device group, and

establish a trusted connection with the second electronic device.

16. The electronic device of claim 15 , wherein:

to detect the second electronic device, the at least one processor is configured to receive an advertising message from the second electronic device, and

the advertising message comprises an identifier of the shared device group and at least a portion of the second root identifier.

17. The electronic device of claim 16 , wherein, to establish the trusted connection with the second electronic device, the at least one processor is configured to:

receive, from the second electronic device, a group key for the shared device group, and

confirm that the group key for the shared device group received from the second electronic device matches a group key for the shared device group maintained at the electronic device.

18. The electronic device of claim 17 , wherein the at least one processor is further configured to:

responsive to confirming that the group key for the shared device group received from the second electronic device matches the group key for the shared device group maintained at the electronic device, decrypt a biometric authentication profile for a user with the group key,

receive, through a biometric sensor of the electronic device, biometric information of the user,

authenticate the user by comparing the biometric information of the user against the biometric authentication profile for the user, and

send a logoff message for the user to the second electronic device via the at least one communication interface.

19. The electronic device of claim 11 , wherein the at least one processor is further configured to:

receive, via the at least one communication interface from a third electronic device, a third root identifier, wherein the third root identifier is associated with a third profile tree maintained at the third electronic device,

determine that the first root identifier does not match the third root identifier,

send, to the third electronic device, the first profile tree,

receive, from the third electronic device, second user profile update information, and

update a second subset of the currently-maintained user profiles at the electronic device based on the second user profile update information.

20. The electronic device of claim 11 , wherein the at least one processor is further configured to:

subsequent to updating the subset of the currently-maintained user profiles based on the user profile update information, send a report to a remote management console, wherein the report comprises at least one of per-profile metadata of the currently-maintained user profiles or per-device metadata based on the currently-maintained user profiles.

Assignments (1)

Continuity (2)

References Cited (29)