Single sign-on for managed mobile devices

Patent metadata

Field	Value
Publication number	US-11057364-B2
Application number	US-201815875236-A
Country	US
Kind code	B2
Filing date	Jan 19, 2018
Priority date	Jun 15, 2015
Publication date	Jul 6, 2021
Grant date	Jul 6, 2021

Abstract

Disclosed are various examples for providing a single sign-on experience for managed mobile devices. A management application executed in a computing device receives a single sign-on request from a managed client application executed by the same computing device. The management application determines that the client application is permitted to access a management credential for single sign-on use. The management application provides the management credential to the client application in response to the single sign-on request.

First claim

Therefore, the following is claimed:

1. A system for providing single sign-on using a management application, comprising:
a computing device including a plurality of managed applications installed thereon, each of the plurality of managed applications signed by one of a plurality of certificates, the computing device in communication with a device management service executing on a server remote from the computing device, the device management service managing a plurality of compliance rules for the computing device and configuring the management application with the plurality of compliance rules for enforcement by the management application;
the management application that executes on the computing device when launched by a user of the computing device, and
a user interface that is rendered on the computing device upon the launch of the management application;
the management application configured to cause the computing device to at least:
receive, at the management application, a single sign-on request from a client application executed by the computing device;
send, from the management application to the device management service, a request for a management credential that allows the management application to provide access to the plurality of managed application, wherein the request includes credentials entered into the user interface by the user;
in an instance where the device management service determines that the credentials are valid, receive the management credential at the management application from the device management service, wherein
receiving the management credential is contingent on a determination by the device management service that the user is authenticated and that the management application is in an authenticated state with the device management service; and
wherein the user may access each of the plurality of managed applications using the received management credential to be automatically authenticated with any of the plurality of managed applications without re-entering the entered credentials;

provide, by the management application, the received management credential to the client application,
establish a corresponding access-restricted storage area for each of the plurality of managed applications; and
establish a secure communications link that conveys data comprising a plurality of data portions from the device management service to the computing device, each of the data portions for storage in one of the corresponding access-restricted storage areas,
wherein the stored data portions are accessible only by a respective managed application corresponding to the corresponding access-restricted storage area storing the stored data portion and any of the other of the plurality of managed applications signed with the same one of the plurality of certificates that signed the respective managed application which corresponds to the corresponding access-restricted storage area storing the stored data portion;

wherein a first compliance rule of the plurality of compliance rules restricts the user from capturing, sharing, or otherwise removing the conveyed data from the access-restricted storage areas, and
wherein a second compliance rule of the plurality of compliance rules instructs the computing device to erase the conveyed data from the access-restricted storage areas in an instance where the client device is lost or stolen.

2. The system of claim 1 , wherein the management application is further configured to cause the computing device to at least:
receive another single sign-on request from another client application executed by the computing device;
determine that the other client application is not permitted to access the management credential for single sign-on use; and
deny access to the management credential by the other client application.

3. The system of claim 1 , wherein the management application is further configured to cause the computing device to at least: communicate with the device management service over the network to determine whether the client application is permitted to access the management credential for single sign-on use.

4. The system of claim 1 , wherein the management application is further configured to cause the computing device to at least:
determine whether the computing device is jailbroken; and
determine that the client application is permitted to access the management credential for single sign-on use based at least in part on whether the computing device is jail broken.

5. The system of claim 1 , wherein the management application is further configured to cause the computing device to at least:
determine whether the computing device uses a password of a given length or complexity; and
determine that the client application is permitted to access the management credential for single sign-on use based at least in part on whether the computing device uses the password of the given length or complexity.

6. The system of claim 1 , wherein the management application is further configured to cause the computing device to at least:
determine whether the computing device is within a certain geographic area; and
determine that the client application is permitted to access the management credential for single sign-on use based at least in part on whether the computing device is within the certain geographic area.

7. The system of claim 1 , wherein the at least one compliance rule includes a list of unauthorized hardware functions, a list of unauthorized software functions, or a list of unauthorized applications.

8. The system of claim 1 , wherein the management credential includes a Kerberos profile.

9. The system of claim 1 , wherein the management credential is generated by a certificate authority corresponding to the device management service provider.

10. A method for providing single sign-on using a management application, comprising:
authenticating, by the management application executed in a computing device, with a device management service over a network,
the computing device:
including a plurality of managed applications installed thereon, each of the plurality of managed applications signed by one of a plurality of certificates,
including a plurality of compliance rules managed by the device management service,
in communication with the device management service executing on a server remote from the computing device, and
rendering a user interface upon launch of the management application;

receiving, by the management application and from the device management service, configuration to enforce the plurality of compliance rules;
by the management application, causing the computing device to at least:
receive, at the management application, a single sign-on request from a client application executed by the computing device;
send, from the management application to the device management service, a request for a management credential that allows the management application to provide access to the plurality of managed application, wherein the request includes credentials entered into the user interface by the user;
in an instance where the device management service determines that the credentials are valid, receive the management credential at the management application from the device management service, wherein:
receiving the management credential is contingent on a determination by the device management service that the user is authenticated and that the management application is in an authenticated state with the device management service; and
wherein the user may access each of the plurality of managed applications using the received management credential to be automatically authenticated with any of the plurali

Assignees

• Airwatch Llc

Inventors

• Rykowski Adam
• Jain Ashish
• Olds Dale Robert
• Xu Emily Hong
• Barday Kabir
• Austin Kyle
• Kommireddy Sridhara Babu
• Brannon Jonathan Blake
• Lotero Camilo

Classifications

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title