Persistent mobile device enrollment

• US 10,445,082 B2
• Filed: 10/13/2017
• Issued: 10/15/2019
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Reagan, Spencer, Sawant, Prasad
• Primary Examiner(s): Nguyen, Duy Khuong T
• Assistant Examiner(s): Hebert, Theodore E
• Application Number:
  US15/783,635
• Publication Number:
  US 20180052673A1
• Time in Patent Office: 732 Days
• Field of Search: 717177
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Embodiments of the disclosure are directed to a persistent enrollment of a device in a management system. Upon detection of a triggering event, detection of whether an activator application is installed is performed. Then, detection of whether an agent application is installed also performed. The agent application can then complete an enrollment of the device with a management system. Certain components of such a process can be bundled with the device operating system or as a system application.

Claims

1. A method for persistently enrolling a client device with a management system, comprising:

obtaining at the client device, by a loader service application installed on the client device, an installation status of an activator application configured to obtain an agent application, wherein the agent application is configured to enroll the client device with the management system;

providing the installation status of the activator application to a server external to the client device;

receiving, in response to providing the installation status to the registration server, the activator application for installation on the client device;

installing the activator application;

obtaining, by the activator application, the agent application; and

enrolling, by the agent application, the client device with the management system by accepting, at the client device, one or more administrator prompts on behalf of a user associated with the client device,

wherein the loader service is a component bundled, by an original equipment manufacturer (OEM), with the operating system installed on the device.

2. The method of claim 1, wherein accepting the one or more administrator prompts is performed by the activator application, which is platform-signed with an OEM security key.

3. The method of claim 1, wherein accepting the one or more administrator prompts is performed by the activator application based on an authentication credential obtained by the activator application from the management system.

4. The method of claim 3, wherein the authentication credential is obtained based on a device identifier associated with the client device.

5. The method of claim 1, wherein the agent application is obtained from a registration server external to the client device.

6. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a client device, performs a method comprising:

obtaining at the client device, by a loader service application installed on the client device, an installation status of an activator application configured to obtain an agent application, wherein the agent application is configured to enroll the client device with a management system;

providing the installation status of the activator application to a server external to the client device;

receiving, in response to providing the installation status to the registration server, the activator application for installation on the client device;

installing the activator application;

obtaining, by the activator application, the agent application; and

enrolling, by the agent application, the client device with the management system by accepting, at the client device, one or more administrator prompts on behalf of a user associated with the client device,

wherein the loader service is a component bundled, by an original equipment manufacturer (OEM), with the operating system installed on the device.

7. The non-transitory, computer-readable medium of claim 6, wherein accepting the one or more administrator prompts is performed by the activator application, which is platform-signed with an OEM security key.

8. The non-transitory, computer-readable medium of claim 6, wherein accepting the one or more administrator prompts is performed by the activator application based on an authentication credential obtained by the activator application from the management system.

9. The non-transitory, computer-readable medium of claim 8, wherein the authentication credential is obtained based on a device identifier associated with the client device.

10. The non-transitory, computer-readable medium of claim 6, wherein the agent application is obtained from a registration server external to the client device.

11. A client device, comprising:

a memory storage storing program code; and

a processor coupled to the memory storage, wherein, upon execution, the program code causes the processor to;

obtain at the client device, by a loader service application installed on the client device, an installation status of an activator application configured to obtain an agent application, wherein the agent application configured to enroll the client device with a management system;

provide the installation status of the activator application to a server external to the client device;

receive, in response to providing the installation status to the registration server, the activator application for installation on the client device;

install the activator application;

obtain, by the activator application, the agent application; and

enroll, by the agent application, the client device with the management system by accepting, at the client device, one or more administrator prompts on behalf of a user associated with the client device,

wherein the loader service is a component bundled, by an original equipment manufacturer (OEM), with the operating system installed on the device.

12. The client device of claim 11, wherein accepting the one or more administrator prompts is performed by the activator application, which is platform-signed with an OEM security key.

13. The client device of claim 11, wherein accepting the one or more administrator prompts is performed by the activator application based on an authentication credential obtained by the activator application from the management system.

14. The client device of claim 13, wherein the authentication credential is obtained based on a device identifier associated with the client device.

15. The client device of claim 11, wherein the agent application is obtained from a registration server external to the client device.