Scalable onboarding for internet-connected devices

Patent metadata

Field	Value
Publication number	US-11711366-B2
Application number	US-202017013706-A
Country	US
Kind code	B2
Filing date	Sep 7, 2020
Priority date	Jul 16, 2020
Publication date	Jul 25, 2023
Grant date	Jul 25, 2023

Abstract

Examples described herein include systems and methods for onboarding a device into a management system. An example method can include loading a management agent onto the device and receiving inventory information for the device. The example method can further include receiving a request to whitelist the device. In some examples, the request originates from a different device, such as a device used by a technician installing the connected device. The management server can authorize the device and add it to the whitelist. After authorizing the device, the management server can onboard the device by sending management information to the management agent on the device. The management server can then exercise management control of the device through the management agent installed on the device.

First claim

What is claimed is:

1. A method for onboarding a device into a management system, comprising:
loading a management agent onto the device, wherein the management agent is configured to communicate with the management system;
receiving inventory information for the device;
receiving a request from a technician device to whitelist the device;
authorizing the device to be added to the whitelist by:
causing an out-of-band message comprising a code to be sent to the technician device; and
receiving the code and device information from the technician device; and

in an instance in which the device has been added to the whitelist, onboarding the device into the management system, wherein onboarding comprises sending management information to the management agent, and wherein onboarding allows the management system to exercise management control over the device by providing instructions to the management agent.

2. The method of claim 1 , further comprising, before authorizing the device to be added to the whitelist:
receiving an onboarding request at the management system from the device; and
denying the onboarding request in an instance where the device is not in the whitelist.

3. The method of claim 1 , wherein causing an out-of-band message comprising a code to be sent to the technician device comprises requesting an out-of-band server to send the code to the technician device.

4. The method of claim 3 , wherein the response from the technician is provided through an application executing on the technician device of the technician and in communication with the management system.

5. The method of claim 3 , wherein the out-of-band message is at least one of a short message service (SMS) message or an email.

6. The method of claim 1 , wherein the inventory information comprises a hardware token created using hardware information for the device.

7. The method of claim 1 , further comprising pre-registering the device using initial purchase information for the device.

8. A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, performs stages for onboarding a device into a management system, the stages comprising:
loading a management agent onto the device, wherein the management agent is configured to communicate with the management system;
receiving inventory information for the device;
receiving a request from a technician device to whitelist the device;
authorizing the device to be added to the whitelist by:
causing an out-of-band message comprising a code to be sent to the technician device; and

receiving the code and device information from the technician device; and
in an instance in which the device has been added to the whitelist, onboarding the device into the management system, wherein onboarding comprises sending management information to the management agent, and wherein onboarding allows the management system to exercise management control over the device by providing instructions to the management agent.

9. The non-transitory, computer-readable medium of claim 8 , the stages further comprising, before authorizing the device to be added to the whitelist:
receiving an onboarding request at the management system from the device; and
denying the onboarding request in an instance where the device is not in the whitelist.

10. The non-transitory, computer-readable medium of claim 8 , wherein causing an out-of-band message comprising a code to be sent to the technician device comprises requesting an out-of-band server to send the code to the technician device.

11. The non-transitory, computer-readable medium of claim 10 , wherein the response from the technician is provided through an application executing on the technician device of the technician and in communication with the management system.

12. The non-transitory, computer-readable medium of claim 10 , wherein the out-of-band message is at least one of a short message service (SMS) message or an email.

13. The non-transitory, computer-readable medium of claim 8 , wherein the inventory information comprises a hardware token created using hardware information for the device.

14. The non-transitory, computer-readable medium of claim 8 , the stages further comprising pre-registering the device using initial purchase information for the device.

15. A system for onboarding a device into a management system, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions; and
a management server including a hardware-based processor that executes the instructions to carry out stages comprising:
loading a management agent onto the device, wherein the management agent is configured to communicate with the management system;
receiving inventory information for the device;
receiving a request from a technician device to whitelist the device;
authorizing the device to be added to the whitelist by:
causing an out-of-band message comprising a code to be sent to the technician device; and
receiving the code and device information from the technician device; and

in an instance in which the device has been added to the whitelist, onboarding the device into the management system, wherein onboarding comprises sending management information to the management agent, and wherein onboarding allows the management system to exercise management control over the device by providing instructions to the management agent.

16. The system of claim 15 , the stages further comprising, before authorizing the device to be added to the whitelist:
receiving an onboarding request at the management server from the device; and
denying the onboarding request in an instance where the device is not in the whitelist.

17. The system of claim 15 , wherein causing an out-of-band message comprising a code to be sent to the technician device comprises requesting an out-of-band server to send the code to the technician device.

18. The system of claim 17 , wherein the response from the technician is provided through an application executing on the technician device of the technician and in communication with the management server.

19. The system of claim 17 , wherein the out-of-band message is at least one of a short message service (SMS) message or an email.

20. The system of claim 15 , wherein the inventory information comprises a hardware token created using hardware information for the device.

Assignees

• Vmware Inc

Inventors

• Banerjee Swarnadeep
• Shubham Prashant
• Dwivedi Ashutosh
• Govindaraju Agila

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title