Adaptive device enrollment

• US 10,749,870 B2
• Filed: 11/21/2017
• Issued: 08/18/2020
• Est. Priority Date: 11/21/2017
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Brouillette, Nicholas, Patel, Harit, Naik, Ujwal, Jain, Vinay, Ravuri, Sridevi, Jain, Adarsh, Shetty, Nischit
• Primary Examiner(s): Zhao, Don G
• Assistant Examiner(s): Gadalla, Hany S.
• Application Number:
  US15/818,798
• Publication Number:
  US 20190158498A1
• Time in Patent Office: 1,001 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Examples described herein include systems and methods for dynamically determining enrollment requirements and enrolling a user device into a management system. The systems and methods can differ based on the type and version of operating system executing on the user device. With some operating systems, enrollment can be completed through a single application that performs other functionality, such providing single-sign-on access to enterprise resources. With other operating systems, enrollment can be completed by pausing the first application and requiring installation of an agent application to complete enrollment. The determination of how and when to enroll a user device can be done automatically and can be based on an organizational group to which the user belongs.

Claims

1. A method for enrolling a user device with a management system using a portal application, comprising:

receiving, at a management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user'"'"'s credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;

in response to selection of the selected application, establishing management control over the user device by;

requesting, by the portal application, enrollment of the user device with the management server;

receiving, at the portal application, policies from the management server and

enforcing, at the portal application, the policies with respect to the selected application.

2. The method of claim 1, further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.

3. The method of claim 1, wherein the policies include compliance rules for the user device to comply with.

4. The method of claim 1, wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.

5. The method of claim 1, wherein enrolling comprises sending an access token from the management server to the portal application.

6. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor, perform stages for enrolling a user device with a management system using a portal application, the stages comprising:

receiving, at a management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user'"'"'s credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;

in response to selection of the selected application, establishing management control over the user device by;

requesting, by the portal application, enrollment of the user device with the management server;

receiving, at the portal application, policies from the management server and

enforcing, at the portal application, the policies with respect to the selected application.

7. The non-transitory, computer-readable medium of claim 6, the stages further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.

8. The non-transitory, computer-readable medium of claim 6, wherein the policies include compliance rules for the user device to comply with.

9. The non-transitory, computer-readable medium of claim 6, wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.

10. The non-transitory, computer-readable medium of claim 6, wherein enrolling comprises sending an access token from the management server to the portal application.

11. A system for enrolling a user device with a management system using a portal application, comprising:

a management server having a processor, display, and memory storage;

wherein the memory storage contains a non-transitory, computer-readable medium comprising instructions that, when executed by the processor, carry out stages comprising;

receiving, at the management server, an enrollment request from the portal application installed locally on the user device, the portal application storing a user'"'"'s credentials and displaying icons corresponding to a plurality of applications available to the user, wherein the portal application provides access to a selected application of the plurality of applications by authenticating the user to the selected application;

in response to selection of the selected application, establishing management control over the user device by;

requesting, by the portal application, enrollment of the user device with the management server;

receiving, at the portal application, policies from the management server and

enforcing, at the portal application, the policies with respect to the selected application.

12. The system of claim 11, the stages further comprising, as a result of enrolling, allowing the portal application to provide access to an enterprise application.

13. The system of claim 11, wherein the policies include compliance rules for the user device to comply with.

14. The system of claim 11, wherein the portal application authenticates the user to the selected application using a single-sign-on (SSO) service.

15. The system of claim 11, wherein enrolling comprises sending an access token from the management server to the portal application.