Persistent mobile device enrollment

• US 9,921,819 B2
• Filed: 12/29/2014
• Issued: 03/20/2018
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Reagan, Spencer, Sawant, Prasad
• Primary Examiner(s): Bullock, Jr., Lewis A
• Assistant Examiner(s): HEBERT, THEODORE E
• Application Number:
  US14/584,681
• Publication Number:
  US 20160188307A1
• Time in Patent Office: 1,177 Days
• Field of Search: 717177
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Embodiments of the disclosure are directed to a persistent enrollment of a device in a management system. Upon detection of a triggering event, detection of whether an activator application is installed is performed. Then, detection of whether an agent application is installed also performed. The agent application can then complete an enrollment of the device with a management system. Certain components of such a process can be bundled with the device operating system or as a system application.

Claims

1. A method for persistently enrolling a client device with a management system, comprising:

determining, by a loader service application installed on a client device, in response to determining that the client device has been powered on, whether an activator application is installed upon the client device, the activator application being configured to initiate registration with the management system by obtaining an agent application;

transmitting, from the client device, an indication that the activator application is not installed to a first computing environment external to the client device and accessible through a network;

obtaining, from the first computing environment, the activator application in response to determining that the activator application is not installed;

installing, on the client device, the activator application in response to determining that the activator application is not installed;

determining, by the activator application, whether the agent application is installed on the client device, the agent application being configured to enroll the client device with the management system; and

obtaining, by the activator application, the agent application from a second computing environment accessible through the network in response to determining that the agent application is not installed on the client device.

2. The method of claim 1, further comprising:

transmitting, from the activator application, a device identifier associated with the client device to the second computing environment; and

obtaining, using the activator application, a credential associated with an account in the second computing environment.

3. The method of claim 2, further comprising enrolling the client device in a management system implemented by the second computing environment using the credential associated with the account.

4. The method of claim 2, wherein the credential comprises an authentication token associated with a user account in a management system.

5. The method of claim 1, further comprising installing, by the activator application, the agent application on the client device in response to determining that the agent application is not installed on the client device.

6. The method of claim 1, wherein the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.

7. The method of claim 1, wherein determining whether the agent application is installed on the client device further comprises detecting, using the activator application, deletion of the agent application from the client device.

8. The method of claim 7, wherein detecting deletion of the agent application from the client device further comprises obtaining, using the activator application, an event triggered by the agent application signifying uninstallation of the agent application.

9. A non-transitory computer-readable medium embodying program instructions executable in a client device that persistently enroll a client device with a management system, the program instructions being configured to cause the client device to at least:

determine, by a loader service application installed on the client device, in response to determining that the client device has been powered on, whether an activator application is installed upon the client device, the activator application being configured to initiate registration with the management system by obtaining an agent application;

transmit, to a first computing environment external to the client device, an indication that the activator application is not installed upon the client device;

obtain the activator application in response to determining that the activator application is not installed;

install the activator application in response to determining that the activator application is not installed;

determine whether an agent application is installed on the client device, the agent application being configured to enroll the client device with the management system; and

obtain the agent application from a second computing environment accessible from the network in response to determining that the agent application is not installed on the client device.

10. The non-transitory computer-readable medium of claim 9, the program further being configured to cause the client device to at least:

transmit a device identifier associated with the client device to the second computing environment; and

obtain a credential associated with an account in the second computing environment.

11. The non-transitory computer-readable medium of claim 10, the program further being configured to cause the client device to at least enroll the client device in a management system implemented by the second computing environment using the credential associated with the account.

12. The non-transitory computer-readable medium of claim 9, wherein startup of the client device comprises a boot-up of an operating system or a powering on of the client device.

13. The non-transitory computer-readable medium of claim 9, the program further being configured to cause the client device to at least:

install the agent application on the client device in response to determining that the agent application is not installed on the client device.

14. The non-transitory computer-readable medium of claim 9, wherein the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.

15. The non-transitory computer-readable medium of claim 9, wherein the agent application is determined to be installed on the client device by detecting deletion of the agent application from the client device.

16. The non-transitory computer-readable medium of claim 15, wherein deletion of the agent application from the client device is detected by obtaining an event triggered by the agent application signifying uninstallation of the agent application.

17. A client device configured to be persistently enrolled with a management system, comprising:

an operating system executable by at least one processor associated with the client device; and

a loader service application bundled with the operating system, the loader service application, in response to the client device powering on, configured to cause the client device to at least;

determine that an activator application is not installed;

install, on the client device, the activator application in response to determining that the activator application is not installed, wherein the activator application is configured to initiate registration with the management system by obtaining an agent application; and

install, on the client device, an agent application on the client device in response to determining that the agent application is not installed, the agent application being configured to enroll the client device with the management system.

18. The client device of claim 17, wherein the activator application is configured to activate elevated privileges within the client device without user intervention.

19. The client device of claim 17, wherein the activator application is configured to:

transmit a device identifier associated with the client device to a second computing environment; and

obtain a credential associated with an account in the second computing environment.

20. The client device of claim 17, wherein the loader service application is a system application bundled with the operating system and the activator application is platform-signed by a private key associated with an original equipment manufacturer associated with the client device.