Certificate based profile confirmation

Patent metadata

Field	Value
Publication number	US-12250220-B2
Application number	US-202318387568-A
Country	US
Kind code	B2
Filing date	Nov 7, 2023
Priority date	Mar 15, 2013
Publication date	Mar 11, 2025
Grant date	Mar 11, 2025

Abstract

Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

First claim

Therefore, the following is claimed:

1. A method, comprising:
installing a plurality of profiles that specify device setting for use of a mobile device management (MDM) service on a device independent of enrollment with the MDM service, the device setting being for one or more functions of the device that facilitate transfer of data out of the device;
installing a plurality of certificates associated with the profiles on the device;
receiving a plurality of requests to execute, on the device, a plurality of applications that are configured to access resources managed by the MDM service, the requests including a first request to execute a first application among the plurality of applications and a second request to execute a second application among the plurality of applications;
in response to the requests to execute the applications, determining, with respect to each of the applications, whether the certificates installed on the device includes a required certificate for executing the application;
responsive to a determination that the certificates installed on the device include a required certificate for executing the first application, executing the first application in compliance with device setting specified by one or more of the profiles associated with the required certificate; and
responsive to a determination that the certificates installed on the device do not include a required certificate for executing the second application, refusing the second request to execute the second application.

2. The method of claim 1 , further comprising, responsive to the determination that the certificates installed on the device include the required certificate for executing the first application, sending a request to access a resource on a remote server that provides the MDM service.

3. The method of claim 1 , further comprising, responsive to the determination that the certificates installed on the device include the required certificate for executing the second application, sending a failure notification to a remote server that provides the MDM service.

4. The method of claim 1 , wherein the function of the device including control of data transfer between the device and a plurality of remote servers that provide the MDM service.

5. The method of claim 1 , wherein the device setting at least one of enables the function of the device and disables the function of the device.

6. The method of claim 5 , wherein the function is one of a camera, a screen capture function, a communication function and an audio function.

7. The method of claim 1 , wherein the plurality of profiles include a first profile uniquely associated with the first application and the required certificate for executing the first application is uniquely associated with the first profile.

8. The method of claim 1 , wherein said installing the plurality of certificates associated with the profiles includes storing the plurality of certificates in a trust store of the device.

9. The method of claim 1 , wherein the profiles comprise at least one of a plurality of iOS profiles, a plurality of Android OS profiles, a plurality of Windows Mobile profiles, a plurality of Windows Phone profiles, a plurality of Windows 8 profiles, a plurality of Mac OS X profiles, and a plurality of Symbian OS profiles, and the certificates are at least one of a plurality of root certificates and a plurality of intermediate certificates.

10. A method of managing an application on a device independent of enrollment with a mobile device management (MDM) service based on presence of a plurality of profiles that specify device setting for use of the MDM service on the device, the device setting being for one or more functions of the device that facilitate transfer of data out of the device, comprising:
receiving a plurality of requests to execute, on the device, a plurality of applications that are configured to access resources managed by the MDM service, the requests including a first request to execute a first application among the plurality of applications and a second request to execute a second application among the plurality of applications;
identifying a plurality of certificates associated with the profiles;
in response to the requests to execute the applications, determining, with respect to each of the applications, whether the identified certificates include a required certificate for executing the application;
responsive to a determination that the identified certificates include a required certificate for executing the first application, executing the first application in compliance with device setting specified by one or more of the profiles associated with the required certificate; and
responsive to a determination that the identified certificates do not include a required certificate for executing the second application, refusing the second request to execute the second application.

11. The method of claim 10 , further comprising, responsive to the determination that the identified certificates include the required certificate for executing the first application, sending a request to access a resource on a remote server that provides the MDM service.

12. The method of claim 10 , wherein each of the profiles includes a device setting that at least one of:
controls data transfer between the device and a plurality of remote servers;
enables at least one function of the device; and
disables at least one function of the device.

13. An apparatus, comprising:
a computing device;
a display; and
a processor, configured to:
install a plurality of profiles that specify device setting for use of a mobile device management (MDM) service and a plurality of certificates associated with the profiles, the device setting being for one or more functions of the apparatus that facilitate transfer of data out of the apparatus;
receive a plurality of requests to execute, on the device, a plurality of applications that are configured to access resources managed by the MDM service, the requests including a first request to execute a first application among the plurality of applications and a second request to execute a second application among the plurality of applications;
identify a plurality of certificates associated with the profiles;
in response to the requests to open the applications, determine, with respect to each of the applications, whether the identified certificates include a required certificate for executing the application;
responsive to a determination that the identified certificates include a required certificate for executing the first application, executing the first application in compliance with device setting specified by one or more of the profiles associated with the required certificate; and
responsive to a determination that the identified certificates include a required certificate for executing the second application, refusing the second request to execute the second application.

14. The apparatus of claim 13 , wherein the processor is further configured to, responsive to the determination that the identified certificates do not include the required certificate for executing the second application, send a failure notification to a remote server that provides the MDM service.

15. The apparatus of claim 13 , wherein the profiles include one or more device settings operative to, at least one of:
control data transfer between the apparatus and a plurality of remote servers;
enable at least one function of the apparatus; and
disable at least one function of the apparatus.

16. The apparatus of claim 13 , wherein the profile

Assignees

• Omnissa Llc

Inventors

• Dabbiere Alan
• Stuntebeck Erich

Classifications

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• H04W12/08

  Access security · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title