Obtaining device posture of a third party managed device

Patent metadata

Field	Value
Publication number	US-11823007-B2
Application number	US-202217881493-A
Country	US
Kind code	B2
Filing date	Aug 4, 2022
Priority date	Sep 12, 2019
Publication date	Nov 21, 2023
Grant date	Nov 21, 2023

Abstract

Techniques are disclosed to obtain device posture of a third party managed device. In various embodiments, a unique identifier of the third party managed device is embedded in a registration communication sent from a third party managed device to an access node associated with a first party management entity. The registration communication is sent from the third party managed device to the access node. The access node is configured to store data associating the unique identifier with the third party managed device, and to use the unique identifier to obtain from the third party management entity device posture information for the third party managed device.

First claim

What is claimed is:

1. A system, comprising:
a communication interface; and
a processor coupled to the communication interface and configured to:
embed in a registration communication sent from a third party managed device configured to be managed by a third party management entity to an access node associated with a first party management entity a unique identifier of the third party managed device;
send the registration communication sent from the third party managed device to the access node; and
publish a management agent of the third party managed devices as an authenticator upon successful completion of a registration process with which the registration communication is associated;

wherein the access node is configured to store data associating the unique identifier with the third party managed device, and to use the unique identifier to obtain from the third party management entity device posture information for the third party managed device.

2. The system of claim 1 , wherein the registration communication comprises a Fast Identity Online (FIDO) registration response.

3. The system of claim 1 , wherein the registration communication sent from the third party managed device to the access node associated with the first party management entity is sent at least in part in response to a registration challenge sent to the third party managed device at least in part in response to a communication received by the access node from a first party managed device associated with the first party management entity.

4. The system of claim 3 , wherein the third party managed device is configured to send the communication at least in part in response to user input.

5. The system of claim 4 , wherein the user input comprises scanning a QR or other code displayed on a display comprising the third party managed device.

6. The system of claim 4 , wherein QR or other code encodes information that includes a session identifier.

7. The system of claim 6 , wherein the access node is configured to include the session identifier in the registration challenge.

8. The system of claim 4 , wherein the third party managed device is paired with the first party managed device via Bluetooth or another protocol, the user input comprises an input entered via the third party managed device, and the communication is sent by the first party managed device at least in part in response to a Bluetooth or other communication sent by the third party managed device to the first party managed device at least in part in response to the user input.

9. The system of claim 8 , wherein the Bluetooth or other communication includes a session identifier.

10. The system of claim 1 , wherein the processor is configured to embed the unique identifier of the third party managed device in the registration communication at least in part by installing on the third party managed device a management agent associated with the first party management entity.

11. The system of claim 1 , wherein the registration communication includes a one-time access (OTA) token sent by the access node to the third party managed device in response to a communication received from a first party managed device associated with a same user with which the third party managed device is associated.

12. The system of claim 1 , wherein the access node is configured to store the data associating the unique identifier with the third party managed device in a user record associated with the third party managed device.

13. The system of claim 1 , wherein the unique identifier is included in a client data portion or field of the registration communication.

14. The system of claim 1 , wherein the unique identifier comprises a physical address.

15. The system of claim 14 , wherein the physical address comprises a MAC address.

16. A method, comprising:
embedding in a registration communication sent from a third party managed device configured to be managed by a third party management entity to an access node associated with a first party management entity a unique identifier of the third party managed device;
sending the registration communication sent from the third party managed device to the access node; and
publish a management agent of the third party managed devices as an authenticator upon successful completion of a registration process with which the registration communication is associated;
wherein the access node is configured to store data associating the unique identifier with the third party managed device, and to use the unique identifier to obtain from the third party management entity device posture information for the third party managed device.

17. The method of claim 16 , wherein the unique identifier comprises a MAC or other physical address.

18. The method of claim 16 , wherein the registration communication sent from the third party managed device to the access node associated with the first party management entity is sent at least in part in response to a registration challenge sent to the third party managed device at least in part in response to a communication received by the access node from a first party managed device associated with the first party management entity.

19. The method of claim 18 , wherein the first party managed device is configured to send the communication at least in part in response to user input.

20. A computer program product embodied in a non-transitory computer readable medium, the computer program product comprising computer instructions for:
embedding in a registration communication sent from a third party managed device configured to be managed by a third party management entity to an access node associated with a first party management entity a unique identifier of the third party managed device;
sending the registration communication sent from the third party managed device to the access node; and
publish a management agent of the third party managed devices as an authenticator upon successful completion of a registration process with which the registration communication is associated;
wherein the access node is configured to store data associating the unique identifier with the third party managed device, and to use the unique identifier to obtain from the third party management entity device posture information for the third party managed device.

Assignees

• Ivanti Inc

Inventors

• Batchu Suresh Kumar
• Aamir Mohammad

Classifications

• G06K7/1417 Primary

  2D bar codes · CPC title

• H04L63/0838

  using one-time-passwords · CPC title

• H04W4/80

  Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication · CPC title

• H04W60/04

  using triggered events · CPC title

• H04W12/77 Primary

  Graphical identity · CPC title