Determining a device posture using a device posture token

Patent metadata

Field	Value
Publication number	US-11038924-B2
Application number	US-202016733625-A
Country	US
Kind code	B2
Filing date	Jan 3, 2020
Priority date	Jun 27, 2016
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Disclosed are various approaches for generating a device posture token corresponding to a client device. The device posture token can be used by a verification computing device to determine whether the client device complies with the security policies of a particular facility.

First claim

We claim the following:

1. A system for generating a device posture token, comprising:
at least one computing device comprising a processor and a memory; and
a device token generator executable by the at least one computing device, the device token generator causing the at least one computing device to at least:
obtain a request for a device posture token associated with a client device;
determine a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generate the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypt the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device;
cause the encrypted device posture token to be accessible to the client device.

2. The system of claim 1 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.

3. The system of claim 1 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.

4. The system of claim 1 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.

5. The system of claim 1 , wherein the device posture token is encrypted with a private key associated with the device token generator.

6. The system of claim 5 , wherein a trust relationship is established between a verification computing device and the at least one computing device by causing a public key corresponding to the private key to be accessible to the verification computing device.

7. The system of claim 6 , wherein a verification computing device is configured to decrypt the device posture token using the public key corresponding to the private key.

8. A method for generating a device posture token, comprising:
obtaining a request for a device posture token associated with a client device;
determining a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generating the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypting the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device; and
causing the encrypted device posture token to be accessible to the client device.

9. The method of claim 8 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.

10. The method of claim 8 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.

11. The method of claim 8 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.

12. The method of claim 8 , wherein the device posture token is encrypted with a private key associated with a device token generator configured to generate the device posture token.

13. The method of claim 12 , wherein a trust relationship is established with a verification computing device by causing a public key corresponding to the private key to be accessible to the verification computing device.

14. The method of claim 13 , wherein a verification computing device is configured to decrypt the device posture token using the public key corresponding to the private key.

15. A non-transitory computer-readable medium comprising machine-readable instructions for generating a device posture token, wherein when executed by a processor of at least one computing device, the machine-readable instructions cause the at least one computing device to at least:
obtain a request for a device posture token associated with a client device;
determine a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generate the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypt the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device; and
cause the encrypted device posture token to be accessible to the client device.

16. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.

17. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.

18. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.

19. The non-transitory computer-readable medium of claim 15 , wherein the device posture token is encrypted with a private key associated with the management service.

20. The non-transitory computer-readable medium of claim 19 , wherein a verification computing device is configured to decrypt the device posture token using a public key corresponding to the private key.

Assignees

• Airwatch Llc

Inventors

• Quintas Dan
• Kueh Anthony

Classifications

• H04W12/77

  Graphical identity · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04W12/108

  Source integrity · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title