Enforcing enterprise requirements for devices registered with a registration service

• US 10,505,983 B2
• Filed: 11/09/2016
• Issued: 12/10/2019
• Est. Priority Date: 11/09/2016
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Jones, Kevin, Pitchandi, Naveen
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US15/347,480
• Publication Number:
  US 20180131721A1
• Time in Patent Office: 1,126 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Disclosed are various examples for enforcing enterprise requirements for client device deployment. One example includes receiving a device enrollment request that is part of an activation of a client device that is registered with a registration service. A whitelist including a management application is enforced on the client device by installing a first profile on the client device. The management application is executed in a kiosk mode. The management application obtains at least one enterprise requirement including a terms of service. A second profile is installed on the client device causing the client device to cease enforcing the whitelist and the kiosk mode.

Claims

1. A system for enforcement of enterprise requirements for a deployment of client devices, comprising:

at least one computing device; and

a data store comprising executable instructions that, when executed by at least one processor, cause the at least one computing device to at least;

receive a device enrollment request that is part of an activation sequence of a client device that is registered with a registration service;

in response to the device enrollment request, transmit, to the client device, a command to install a first profile on the client device, wherein the first profile enforces a whitelist that permits only a management application to be accessed, and prohibits other applications from being accessed;

transmit to the client device, a command to execute the management application on the client device with a kiosk mode enabled to enforce at least one enterprise requirement comprising a user acceptance of a terms of use, wherein the kiosk mode requires the client device to display the management application comprising the terms of use;

identify a completion of the at least one enterprise requirement based on the user acceptance of the terms of use being obtained through the management application; and

in response to the completion of the at least one enterprise requirement for the deployment, transmit, to the client device, a command that causes a second profile to be installed on the client device, the second profile causing the client device to cease enforcing the kiosk mode and the whitelist.

2. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:

cause the management application to obtain authentication data.

3. The system of claim 2, wherein the authentication data comprises at least one of a username, a password, a personal identification number (PIN), biometric data, or a combination thereof.

4. The system of claim 2, wherein the authentication data is obtained through at least one of Security Assertion Markup Language (SAML) based authentication, token based authentication, or directory based authentication.

5. The system of claim 2, wherein the terms of use are determined based at least in part on a user profile associated with the authentication data.

6. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the client device to at least:

determine whether the management application initiates a requirement to create a device passcode to access an application, wherein the second profile is installed on the client device.

7. The system of claim 1, wherein the first profile further restricts at least one settings option associated with the client device.

8. A non-transitory computer-readable medium embodying executable instructions for enforcement of enterprise requirements for a deployment of client devices, wherein the instructions, when executed by at least one processor, cause a client device to at least:

transmit, to a management service, a device enrollment request that initiates enrollment of the client device with the management service, the management service being identified in enrollment data that is received from a registration service as part of an activation sequence of the client device;

install a first profile received from the management service in response to the device enrollment request, the first profile comprising a whitelist that permits only a management application to be accessed on the client device, and prohibits other applications from being accessed;

execute a command to run the management application with a kiosk mode enabled to enforce at least one enterprise requirement comprising a user acceptance of a terms of use, wherein the kiosk mode requires the client device to display the management application;

present the terms of use that is rendered by the management application;

identify a completion of the at least one enterprise requirement based on the user acceptance of the terms of use and communicate the completion of the at least one enterprise requirement to the management service; and

install a second profile received from the management service based on the completion of the at least one enterprise requirement for the deployment of client devices, the second profile ceasing to enforce the whitelist and the kiosk mode.

9. The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed by at least one processor, further cause the client device to at least:

obtain user authentication data, wherein the terms of use are determined based at least in part on the authentication data.

10. The non-transitory computer-readable medium of claim 9, wherein the authentication data comprises at least one of a username, a password, a personal identification number (PIN), biometric data, or a combination thereof.

11. The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed by the at least one processor, further cause the client device to at least:

authenticate the client device with the management service using a security assertion markup language (SAML) based authentication.

12. The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed by the at least one processor, further cause the client device to at least:

authenticate the client device with the management service using a lightweight directory access protocol (LDAP) based authentication.

13. The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed by the at least one processor, further cause the client device to at least:

authenticate the client device with the management service using a token based authentication.

14. The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed by the at least one processor, further cause the client device to at least:

present a series of content through a secure content locker application; and

communicate completion of the series of content to the management service.

15. The non-transitory computer-readable medium of claim 8, wherein the terms of use is associated with an enterprise that owns the client device.

16. A computer-implemented method for enforcement of enterprise requirements for a deployment of client devices, the method comprising:

receiving a device enrollment request that is part of an activation sequence of a client device that is registered with a registration service;

in response to the device enrollment request, transmit, to the client device, a command to install a first profile on the client device, the first profile comprising a whitelist that permits only a management application to be accessed on the client device, and prohibits other applications from being accessed;

transmitting, to the client device, a command to execute the management application on the client device in a kiosk mode to enforce at least one enterprise requirement comprising a user acceptance of a terms of use, the kiosk mode requiring the client device to display the management application comprising the terms of use; and

identifying a completion of the at least one enterprise requirement based on the user acceptance of the terms of use that is rendered on the client device by the management application; and

in response to the completion of the at least one enterprise requirement for the deployment, transmitting, to the client device, a command to install a second profile, the second profile causing the client device to cease enforcing the whitelist and the kiosk mode.

17. The computer-implemented method of claim 16, further comprising:

identifying a completion of at least one enterprise requirement that includes identifying the user acceptance of the terms of use.

18. The computer-implemented method of claim 17, wherein identifying the completion of the at least one enterprise requirement further includes identifying a presentation of a series of content through a secure content locker application.

19. The computer-implemented method of claim 17, wherein identifying the completion of the at least one enterprise requirement further includes identifying an authentication using at least one of Security Assertion Markup Language (SAML) based authentication, token based authentication, or directory based authentication.

20. The computer-implemented method of claim 17, wherein identifying the completion of the at least one enterprise requirement further includes obtaining authentication data comprising at least one of a username, a password, a personal identification number (PIN), or biometric data.