Certificate based profile confirmation

Patent metadata

Field	Value
Publication number	US-10972467-B2
Application number	US-202016749937-A
Country	US
Kind code	B2
Filing date	Jan 22, 2020
Priority date	Mar 15, 2013
Publication date	Apr 6, 2021
Grant date	Apr 6, 2021

Abstract

Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

First claim

The invention claimed is:

1. A method for managing a device, the method comprising:
sending, to a device from a remote server, a profile and a certificate that is unique to the profile, the profile specifying mandatory settings for the device, and installation of the profile by the device causing the certificate to be accessible by the device;
receiving, by the remote server, a request from the device to do at least one of utilize a resource and execute an application, the request being sent based on the profile;
determining, by the remote server, whether the certificate is accessible by the device and whether the device is compliant with the mandatory settings; and
in an instance where the certificate is accessible by the device and the device is compliant, authorizing the device to do at least one of utilize the resource and execute the application.

2. The method of claim 1 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored on the device.

3. The method of claim 1 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored remotely from the device and associated with the device.

4. The method of claim 1 , wherein one of the mandatory settings includes the device having an embedded certificate installed, the embedded certificate being included in the in the profile.

5. The method of claim 1 , further comprising verifying the certificate is valid after determining the certificate is accessible by the user device and before authorizing the device to do at least one of utilize the resource and execute the application.

6. The method of claim 1 , wherein the request includes a request by the device to execute the application to utilize the resource.

7. The method of claim 6 , wherein the request further includes a request to provide the application with access to a plurality of additional resources authorized by the certificate in order to provide the application with access to the resource.

8. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, performs stages for managing a device, the stages comprising:
sending, to a device from a remote server, a profile and a certificate that is unique to the profile, the profile specifying mandatory settings for the device, and installation of the profile by the device causing the certificate to be accessible by the device;
receiving, by the remote server, a request from the device to do at least one of utilize a resource and execute an application, the request being sent based on the profile;
determining, by the remote server, whether the certificate is accessible by the device and whether the device is compliant with the mandatory settings; and
in an instance where the certificate is accessible by the device and the device is compliant, authorizing the device to do at least one of utilize the resource and execute the application.

9. The non-transitory, computer-readable medium of claim 8 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored on the device.

10. The non-transitory, computer-readable medium of claim 8 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored remotely from the device and associated with the device.

11. The non-transitory, computer-readable medium of claim 8 , wherein one of the mandatory settings includes the device having an embedded certificate installed, the embedded certificate being included in the in the profile.

12. The non-transitory, computer-readable medium of claim 8 , the stages further comprising verifying the certificate is valid after determining the certificate is accessible by the user device and before authorizing the device to do at least one of utilize the resource and execute the application.

13. The non-transitory, computer-readable medium of claim 8 , wherein the request includes a request by the device to execute the application to utilize the resource.

14. The non-transitory, computer-readable medium of claim 13 , wherein the request further includes a request to provide the application with access to a plurality of additional resources authorized by the certificate in order to provide the application with access to the resource.

15. A server, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions; and
at least one processor that executes the instructions to carry out stages comprising:
sending, to a device from a remote server, a profile and a certificate that is unique to the profile, the profile specifying mandatory settings for the device, and installation of the profile by the device causing the certificate to be accessible by the device;
receiving, by the remote server, a request from the device to do at least one of utilize a resource and execute an application, the request being sent based on the profile;
determining, by the remote server, whether the certificate is accessible by the device and whether the device is compliant with the mandatory settings; and
in an instance where the certificate is accessible by the device and the device is compliant, authorizing the device to do at least one of utilize the resource and execute the application.

16. The server of claim 15 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored on the device.

17. The server of claim 15 , wherein determining whether the certificate is accessible by the device includes determining whether the certificate is stored remotely from the device and associated with the device.

18. The server of claim 17 , wherein one of the mandatory settings includes the device having an embedded certificate installed, the embedded certificate being included in the in the profile.

19. The server of claim 15 , the stages further comprising verifying the certificate is valid after determining the certificate is accessible by the user device and before authorizing the device to do at least one of utilize the resource and execute the application.

20. The server of claim 15 , wherein the request includes a request by the device to execute the application to utilize the resource.

Assignees

• Airwatch Llc

Inventors

• Dabbiere Alan
• Stuntebeck Erich

Classifications

• G06F21/30 Primary

  Authentication, i.e. establishing the identity or authorisation of security principals · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/33

  using certificates · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title