Your iPhone and iPad Could Soon Support Multiple User Profiles

Although for most people the iPhone is an eminently personal device, one of the most glaring limitations of Apple’s iPad over the years has been the inability to customize it for use by more than one user, but the good news is that it looks like Apple may soon have a really good solution to the problem.

While the macOS operating system has long supported multiple users, each with their own secure profile, it’s been a significant omission on the iOS side — a limitation that because apparent when Apple debuted the iPad back in 2010, since the tablet computer by its very nature was much more easily geared to being used by families, especially those with multiple kids.

For years the iPad remained a single-user device, making it difficult for multiple family members to even have their own apps and layouts, much less keep personal information on the tablet, and it was perhaps even more disappointing when Apple finally brought multiple user profiles in iOS 9, but chose to limit the feature exclusively to use by schools.

However, now a new patent recently discovered by AppleInsider suggests that Apple is not only working on adding multi-user support to iOS devices, but it’s actually looking to build a really secure hardware-based solution in order to support it.

The recently-granted patent, which features a typically wordy title of “Provision of domains in secure enclave to support multiple users” is one of the more specific ones we’ve seen. Unlike many patents which cover a whole range of different concepts and could therefore be applied generally to a lot of things, this one is very clearly about allowing more than one user to use a device, and allowing them to do so securely.

As with most patents, Apple doesn’t specify which devices are involved, so this could apply to Macs just as easily as iPads and iPhones, but the fact that it refers to “mobile computing devices and multi-user laptop and desktop computing devices” definitely sounds very much like iOS devices will be on the table as well.

Of course, macOS already has multi-user support, but this patent aims to take even that a step further, since it’s talking about leveraging the Secure Enclave, which is found on almost all iPhones, iPads, and Macs released in the past several years, to store user credentials in such a way that even shared users of the same device won’t have access to that data.

Right now, the Secure Enclave is an all-or-nothing affair. While it’s locked down and only rendered accessible by Touch ID or Face ID, your passcode or password can also be used, which opens up anything in the Secure Enclave, including iCloud Keychain passwords, HealthKit information, and Apple Pay payment methods to anybody who has your password.

More importantly, however, the Secure Enclave is only currently designed to store this kind of data for a single user; even on a Mac, where multiple user profile are a possibility, anything requiring the Secure Enclave can only be used by a single user; this is why more than one user can’t add cards to Apple Pay on a MacBook, for example.

Similarly, while you can add fingerprints for different people to use Touch ID with your MacBook, they’re all unlocking the exact same Secure Enclave profile, which means you’re exposing your secure credentials, payment methods, and other similar information to anybody that you’ve added Touch ID access for. The same is of course also true for an iPhone or iPad, although the single-user nature of those devices make that a bit more obvious.

Shared Secure Enclave

In addition to a number of more advanced ideas, the new patent basically describes a Secure Enclave design that would be able to store encrypted data for multiple users, partitioned off in such a way that there would be no way for one user to access the secured data of another.

However, the problem isn’t all that simple to solve, since the Secure Enclave also contains system-level credentials and encryption keys that would need to be accessible to all users. Further, there would need to be an “administrator” level of access to allow somebody such as a parent, teacher, or business supervisor to gain at least some level of access to other user profiles.

The patent addresses this by describing “group keys” that could be created to allow data to be shared by multiple profiles, either for administrative purposes or just to ensure that things like keys and certificates used by things like Safari can be unlocked regardless of who is logged into the device.

The patent also details how the Secure Enclave Processor (SEP) ultimately becomes the arbiter of what each user can access, routing everything through this proposed future version of the chip.

Apple’s patent also suggests several other methods for handling unauthorized access attempts, such as deliberately slowing the system down before locking the user out entirely — something that iOS devices already do when dealing with passcodes, but sounds like it could be extended to other authentication methods, in addition to coming to the Mac.

[The information provided in this article has NOT been confirmed by Apple and may be speculation. Provided details may not be factual. Take all rumors, tech or otherwise, with a grain of salt.]