Enforcing policy compliance on a device

Patent metadata

Field	Value
Publication number	US-9444849-B2
Application number	US-201414506773-A
Country	US
Kind code	B2
Filing date	Oct 6, 2014
Priority date	Oct 6, 2014
Publication date	Sep 13, 2016
Grant date	Sep 13, 2016

Abstract

Disclosed herein is a method for enforcing policy compliance on a device that includes detecting a compliance action associated with an electronic device. The compliance action initiates verification that the electronic device is in compliance with a policy. The method also includes sending configuration information for the electronic device to a compliance authenticator in response to the compliance action. The compliance authenticator verifies that the configuration information complies with a policy. Further, the method includes receiving an authentication certificate in response to the compliance authenticator verifying the configuration information complies with the policy. The authentication certificate expires after a predetermined period of time.

First claim

What is claimed is:

1. A method, comprising:
detecting a compliance action associated with an electronic device, the compliance action initiating verification that the electronic device is in compliance with a policy;
sending configuration information for the electronic device to a compliance authenticator in response to the compliance action, the compliance authenticator verifying that the configuration information complies with the policy;
receiving an authentication certificate in response to the compliance authenticator verifying the configuration information complies with the policy, the authentication certificate expiring after a predetermined period of time;
determining, from the policy, a list of one or more predetermined actions that the electronic device is authorized to perform;
determining the electronic device violated the policy in response to determining the electronic device performed an unauthorized action not on the list of the one or more predetermined actions; and
invalidating the authentication certificate in response to the electronic device becoming not compliant with the policy.

2. The method of claim 1 , wherein invalidating the authentication certificate comprises deleting a key associated with the authentication certificate.

3. The method of claim 1 , further comprising accessing a secure resource of a computer system for an organization in response to the authentication certificate for the electronic device being validated.

4. The method of claim 3 , wherein the organization comprises an airline and the electronic device comprises a maintenance device managed by the airline, the secure resource accessed by the maintenance device comprising a secure resource of an airplane.

5. The method of claim 1 , further comprising storing a key for the authentication certificate in a trusted platform module (TPM) of the electronic device.

6. The method of claim 5 , further comprising storing one or more configuration values for the electronic device in the TPM, wherein the key for the authentication certificate is usable in response to stored configuration values matching predetermined configuration values for the electronic device.

7. The method of claim 6 , further comprising storing one or more of the key for the authentication certification and the one or more configuration values for the electronic device in one or more platform configuration registers (PCRs) associated with the TPM.

8. The method of claim 7 , further comprising determining a configuration of the electronic device and updating the one or more configuration values stored in the PCRs in response to detecting the electronic device performed an unauthorized action.

9. The method of claim 1 , wherein the compliance authenticator comprises a mobile device manager (MDM), the MDM configured to run a health check on the configuration information in order to verify the configuration information complies with the policy.

10. The method of claim 1 , wherein the predetermined period of time is a function of a predefined amount of time for the electronic device to complete a task associated with the authentication certificate.

11. The method of claim 1 , wherein the compliance action comprises one or more of:
connecting to an authorized network;
registering the electronic device with the compliance authenticator;
installing a compliance application; and
scanning the electronic device for malicious applications.

12. The method of claim 1 , wherein the configuration information comprises one or more of:
information associated with applications installed on the electronic device;
information associated with a hardware configuration of the electronic device; and
information associated with an operating system of the electronic device.

13. The method of claim 1 , wherein the configuration information comprises one or more hash values, the one or more hash values being generated based on a configuration of the electronic device.

14. The method of claim 1 , further comprising presenting a message on the electronic device that the electronic device is not in compliance with the policy, the message being presented in response to one of expiration of the authentication certificate and deletion of a key associated with the authentication certificate.

15. The method of claim 1 , wherein an unauthorized action comprises one or more of:
connecting to an unauthorized network;
installing an unauthorized application on the electronic device; and
executing an unauthorized application on the electronic device.

16. An apparatus, comprising:
a data module configured to receive configuration information associated with an electronic device in response to detecting a compliance action executed by the electronic device;
a verification module configured to verify that the configuration information complies with a policy;
a certificate module configured to issue an authentication certificate to the electronic device in response to verifying that the configuration information complies with the policy, the authentication certificate expiring after a predetermined period of time; and
a compliance module configured to determine a list of one or more predetermined actions that the electronic device is authorized to perform, wherein the policy comprises the one or more predetermined actions, and to invalidate the authentication certificate in response to determining the electronic device performed an unauthorized action not on the list of the one or more predetermined actions.

17. The apparatus of claim 16 , wherein the compliance module is further configured to update the policy and send the updated policy to the electronic device.

18. The apparatus of claim 16 , wherein the verification module comprises a mobile device manager (MDM), the MDM configured to run a health check on the configuration information in order to verify the configuration information complies with the policy.

19. The apparatus of claim 18 , wherein the health check comprises performing one or more verification actions related to the configuration information, the verification actions comprising:
determining applications installed on the electronic device;
determining a hardware configuration for the electronic device; and
determining an operating system configuration for the electronic device.

20. The apparatus of claim 16 , wherein the certificate module comprises a certificate authority for an airline that created the policy, the certificate authority issuing an authentication certificate that authorizes the electronic device to access a secure resource of an airplane computer system.

21. The apparatus of claim 16 , wherein the predetermined period of time is a function of a predefined amount of time for the electronic device to complete a task associated with the authentication certificate.

22. A computer program product comprising a non-transitory computer readable storage medium storing computer usable program code executable to perform operations, the operations comprising:
detecting a compliance action for an electronic device, the compliance action associated with verifying the electronic device is in compliance with a policy;
sending configuration information for the electronic device to a compliance authenticator in response to the compliance action, the compliance authenticator verifying that the configuration information complies with the policy;

receiving an authentication certificate in response to the compliance

Assignees

• Boeing Co

Inventors

• Angus Ian G
• Reid Travis S

Classifications

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L2463/121

  Timestamp · CPC title