Mobile device management registration

Patent metadata

Field	Value
Publication number	US-10404684-B1
Application number	US-201514966511-A
Country	US
Kind code	B1
Filing date	Dec 11, 2015
Priority date	Dec 12, 2014
Publication date	Sep 3, 2019
Grant date	Sep 3, 2019

Abstract

Techniques of the present disclosure register a device to a mobile device management (MDM) network to enable access of the MDM network. In some embodiments, a registration service receives a request to register a device as a device managed by an enterprise associated with the registration service. In response, the registration service sends a response redirecting the device to authenticate via an authentication service, where the device is configured via an authentication profile to authenticate via the authentication service. The device sends a token issued by the authentication service of the enterprise. The registration service provides access to the registration service based the received token, including by allowing the registration service to be used to register the device as a device managed at least in part by the enterprise. The present techniques improve security of communications by registering a device without requiring input of sensitive authentication information.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a registration service, a request to register an unregistered device as a device managed at least in part by a mobile device management (MDM) system, wherein the request includes non-sensitive information identifying the device and a domain for which the device seeks access;
determining that the requesting device is unrecognized by the MDM system;
in response to the determination that the requesting device is unrecognized, using the request to dynamically generate an authentication profile for the requesting device, wherein the authentication profile is adapted to configure an authentication client to perform authentication operations to authenticate applications included in the authentication profile to services located in the domain;
sending the authentication profile to the device;
sending, in response to the request, a response redirecting the requesting device to authenticate via an authentication service of an enterprise, wherein the device is configured via the authentication profile to authenticate via the authentication service of the enterprise, and the authentication service does not require user communication of login credentials to the authentication service;
receiving, from the device, a token issued by the authentication service of the enterprise; and
providing access to the registration service based at least in part on receiving the token, including by allowing the registration service to be used to register the device as a device managed at least in part by the enterprise.

2. The method of claim 1 , wherein the device is configured to install the authentication profile.

3. The method of claim 1 , further comprising storing registration data associating the device with a management domain.

4. The method of claim 3 , wherein the registration of the device includes configuring the device to be managed according to policies of the enterprise for the management domain.

5. The method of claim 1 , wherein the authentication profile is a single sign-on (SSO) profile.

6. The method of claim 1 , wherein the authentication profile defines a Kerberos authentication process.

7. The method of claim 1 , wherein the authentication profile is dynamically adapted to at least one characteristic of the device.

8. The method of claim 1 , wherein the authentication profile is uploaded to the device.

9. The method of claim 1 , wherein the authentication service does not require user entry of a password.

10. The method of claim 1 , wherein the device includes a native mobile device management (MDM) client.

11. The method of claim 1 , wherein the device is a mobile device.

12. The method of claim 1 , wherein the authentication service includes a proxy server, the proxy server configured to obtain authentication information usable by the device to access the registration service.

13. A method, comprising:
sending to a registration service a request to register an unregistered device as a device managed at least in part by a mobile device management (MDM) system, wherein the request includes non-sensitive information identifying the device and a domain corresponding to the registration service;
receiving an authentication profile, wherein the authentication profile is dynamically generated in response to a determination by the registration service that the device is unrecognized by the MDM system;
receiving a response redirecting the device to authenticate via an authentication service of an enterprise, wherein the device is configured via the authentication profile to authenticate via the authentication service of the enterprise, and the authentication service does not require user communication of login credentials to the authentication service;
receiving a token issued by the authentication service of the enterprise;
sending the token to initiate the registration service; and
responsive to an indication from the registration service, recognizing the enterprise as a manager of the device.

14. The method of claim 13 , wherein the authentication profile is downloaded to the device.

15. The method of claim 13 , wherein the authentication profile is locally stored on the device.

16. The method of claim 13 , wherein the authentication profile is received in an email.

17. The method of claim 13 , wherein the authentication profile is a single sign-on (SSO) profile.

18. The method of claim 13 , wherein communication with an authentication server is according to Kerberos.

19. The method of claim 13 , wherein the request does not include a password.

20. A system, comprising:
a processor configured to:
receive, at a registration service, a request to register an unregistered device as a device managed at least in part by a mobile device management (MDM) system, wherein the request includes non-sensitive information identifying the device and a domain for which the device seeks access;
determine that the requesting device is unrecognized by the MDM system;
in response to the determination that the requesting device is unrecognized, use the request to dynamically generate an authentication profile for the requesting device, wherein the authentication profile is adapted to configure an authentication client to perform authentication operations to authenticate applications included in the authentication profile to services located in the domain;
send the authentication profile to the device;
send, in response to the request, a response redirecting the requesting device to authenticate via an authentication service of an enterprise, wherein the device is configured via the authentication profile to authenticate via the authentication service of the enterprise, and the authentication service does not require user communication of login credentials to the authentication service;
receive, from the device, a token issued by the authentication service of the enterprise; and
provide access to the registration service based at least in part on receiving the token, including by allowing the registration service to be used to register the device as a device managed at least in part by the enterprise; and

a memory coupled to the processor and configured to provide the processor with instructions.

21. A device, comprising:
a processor configured to:
send to a registration service a request to register the device as an unregistered device managed at least in part by a mobile device management (MDM) system, wherein the request includes non-sensitive information identifying the device and a domain corresponding to the registration service;
receive an authentication profile, wherein the authentication profile is dynamically generated in response to a determination by the registration service that the device is unrecognized by the MDM system;
receive a response redirecting the device to authenticate via an authentication service of an enterprise, wherein the device is configured via the authentication profile to authenticate via the authentication service of the enterprise, and the authentication service does not require user communication of login credentials to the authentication service;
receive a token issued by the authentication service of the enterprise;
send the token to initiate the registration service; and
responsive to an indication from the registration service, recognize the enterprise as a manager of the device; and

a memory coupled to the processor and configured to provide the processor with instructions.

Assignees

• Mobile Iron Inc

Inventors

• Chittireddy Sudheer Babu
• Kim Mansu

Classifications

• H04W4/50

  Service provisioning or reconfiguring · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/08

  Access security · CPC title

• H04W12/06

  Authentication · CPC title