Persistent mobile device enrollment

Patent metadata

Field	Value
Publication number	US-2016188307-A1
Application number	US-201414584681-A
Country	US
Kind code	A1
Filing date	Dec 29, 2014
Priority date	Dec 29, 2014
Publication date	Jun 30, 2016
Grant date	—

Abstract

Embodiments of the disclosure are directed to a persistent enrollment of a device in a management system. Upon detection of a triggering event, detection of whether an activator application is installed is performed. Then, detection of whether an agent application is installed also performed. The agent application can then complete an enrollment of the device with a management system. Certain components of such a process can be bundled with the device operating system or as a system application.

First claim

Therefore, the following is claimed:

1 . A method, comprising:
determining, in a client device, a version of an activator application in response to determining that the activator application is installed upon the client device; transmitting, from the client device, an indication of whether the activator application is installed to a first computing environment accessible through a network; transmitting, from the client device, an indication of a version of the activator application to a first computing environment accessible through a network; obtaining, from the first computing environment, the activator application in response to determining that the activator application is not installed or that the version of the activator application is deprecated; installing, on the client device, the activator application in response to determining that the activator application is not installed or that the version of the activator application is deprecated; determining, by the activator application, whether an agent application is installed on the client device; and obtaining, by the activator application, the agent application from a second computing environment accessible through the network in response to determining that the agent application is not installed on the client device.

2 . The method of claim 1 , further comprising:
transmitting, from the activator application, a device identifier associated with the client device to the second computing environment; and obtaining, using the activator application, a credential associated with an account in the second computing environment.

3 . The method of claim 2 , further comprising enrolling the client device in a management system implemented by the second computing environment using the credential associated with the account.

4 . The method of claim 2 , wherein the credential comprises an authentication token associated with a user account in a management system.

5 . The method of claim 1 , further comprising installing, by the activator application, the agent application on the client device in response to determining that the agent application is not installed on the client device.

6 . The method of claim 1 , wherein the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.

7 . The method of claim 1 , wherein determining whether the agent application is installed on the client device further comprises detecting, using the activator application, deletion of the agent application from the client device.

8 . The method of claim 7 , wherein detecting deletion of the agent application from the client device further comprises obtaining, using the activator application, an event triggered by the agent application signifying uninstallation of the agent application.

9 . A non-transitory computer-readable medium embodying program instructions executable in a client device, the program instructions being configured to cause the client device to at least:
determine a version of an activator application installed upon the client device; transmit an indication of a version of the activator application installed upon the client device; obtain the activator application in response to determining that the activator application is not installed or that the version of the activator application is deprecated; install the activator application in response to determining that the activator application is not installed or that the version of the activator application is deprecated; determine whether an agent application is installed on the client device; and obtain the agent application from a second computing environment accessible via the network in response to determining that the agent application is not installed on the client device.

10 . The non-transitory computer-readable medium of claim 9 , the program further being configured to cause the client device to at least:
transmit a device identifier associated with the client device to the second computing environment; and obtain a credential associated with an account in the second computing environment.

11 . The non-transitory computer-readable medium of claim 10 , the program further being configured to cause the client device to at least enroll the client device in a management system implemented by the second computing environment using the credential associated with the account.

12 . The non-transitory computer-readable medium of claim 9 , wherein startup of the client device comprises a boot-up of an operating system or a powering on of the client device.

13 . The non-transitory computer-readable medium of claim 9 , the program further being configured to cause the client device to at least:
install the agent application on the client device in response to determining that the agent application is not installed on the client device

14 . The non-transitory computer-readable medium of claim 9 , wherein the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.

15 . The non-transitory computer-readable medium of claim 9 , wherein the agent application is determined to be installed on the client device by detecting deletion of the agent application from the client device.

16 . The non-transitory computer-readable medium of claim 15 , wherein deletion of the agent application from the client device is detected by obtaining an event triggered by the agent application signifying uninstallation of the agent application.

17 . A client device, comprising:
an operating system executable by at least one processor associated with the client device; and a loader service application bundled with the operating system, the loader service application configured to cause the client device to at least:
install, on the client device, a current version of an activator application in response to determining that the current version of the activator application is not installed or that a version of the activator application is deprecated; wherein the activator application is configured to:
install, on the client device, a current version of an agent application on the client device in response to determining that the current version of the agent application is not installed or that a version of the agent application is deprecated.

18 . The client device of claim 17 , wherein the activator application is configured to activate elevated privileges within the client device without user intervention.

19 . The client device of claim 17 , wherein the activator application is configured to
transmit a device identifier associated with the client device to a second computing environment; and obtain a credential associated with an account in the second computing environment.

20 . The client device of claim 17 , wherein the loader service application is a system application bundled with the operating system and the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.

Assignees

• Airwatch Llc

Inventors

• Reagan Spencer
• Sawant Prasad

Classifications

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L67/34 Primary

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• G06F8/61 Primary

  Installation · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title