UNIFIED ENTERPRISE DEVICE ENROLLMENT

• US 20140282839A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cai, Zhi, Jain, Monty, Boudzko, Alexei, Kudrjavets, Gunnar, Zhu, Yuhang, McBride, Daniel Kevin, Strom, Clifford Paul
• Application Number:
  US13/842,660
• Publication Number:
  US 20140282839A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A unified enrollment client is described that allows authentication and communication with disparate enterprise management source types. A first enterprise management source type can have a corporate-based management server which is on the premises of the corporation. A second enterprise management source type can have a cloud-based management server in which a corporate server communicates through a federation gateway to a cloud-based management server. Authentication can be handled regardless of the source type through the use of a discovery request which identifies the source type so that the enrollment client knows how to tailor the authentication, if any is needed, to the particular enterprise management source.

Claims

1. A method of enrolling different enterprise source types with a client device, comprising:

from an enrollment client, transmitting a discovery request to an enterprise management source in order to determine a source type;

receiving a discovery response that identifies the source type;

performing authentication for enrollment if authentication is needed for the received source type.

2. The method of claim 1, wherein a first source type includes an on-premise corporate network, and a second source type is a hosted, cloud-based network, and wherein the on-premise corporate network does not require authentication whereas the cloud-based network does require authentication.

3. The method of claim 2, further including receiving a same user input whether the enrollment is for the first or second source types.

4. The method of claim 2, wherein the first source type requires a domain credential and the second source type requires authentication credentials.

5. The method of claim 1, further including after authentication, receiving a policy to control the client device.

6. The method of claim 1, wherein the client device is a mobile phone.

7. The method of claim 1, wherein if the source type is cloud-based, then performing a first authentication type and if the source type is corporate-network based then performing a second authentication type, different than the first authentication type.

8. The method of claim 7, wherein for the first authentication type, an organization identifier is generated in order to authenticate the source and wherein for the second authentication type, authentication is not needed.

9. A method of enrolling different enterprise source types with a client device, comprising:

providing a unified enrollment client that can couple to enterprise sources having different authentication requirements;

transmitting a discovery request to a first enterprise source;

receiving a discovery response indicating that the first enterprise source requires a first authentication requirement;

transmitting a discovery request to a second enterprise source;

receiving a discovery response indicating the that the second enterprise source has a second authentication requirement, different than the first enterprise requirement; and

authenticating the second enterprise source using the second authentication requirement.

10. The method of claim 9, wherein the first enterprise source includes an on-premise corporate network, and the second enterprise source includes a hosted, cloud-based network, and wherein the on-premise corporate network does not require authentication.

11. The method of claim 9, further including receiving a same user input whether the enrollment is for the first enterprise source or the second enterprise source.

12. The method of claim 9, further including after authentication, receiving a first policy to control the client device from the first enterprise source and a second policy to control the client device from the second enterprise source.

13. The method of claim 9, wherein the client device is a mobile phone.

14. The method of claim 9, wherein if the source type is cloud-based, then generating an organization identification and if the source type is corporate-network based then generating an organization identifier is not performed.

15. A system for enrolling different enterprise source types on a client device, comprising:

an enrollment client including a discovery client that transmits a discovery request to determine a source type and an authentication client to authenticate the source type based on a discovery response; and

a policy control coupled to the enrollment client for storing policies in association with provider identifications, wherein the policy control determines which of the stored policies to apply.

16. The system of claim 15, wherein the client device is a mobile phone.

17. The system of claim 15, further including a user interface for receiving a user'"'"'s credentials and sending the user'"'"'s credentials to the enrollment client.

18. The system of claim 15, wherein the source type is based on whether an enterprise management source includes a corporate-network based management server or a cloud-based management server.

19. The system of claim 18, wherein the cloud-based management server uses an organization identifier for authentication, and the corporate-network based management server does not use the organization identifier.

20. The system of claim 18, wherein only one enrollment client is used for both source types.