Dynamic Group Membership For Devices

• US 20160352526A1
• Filed: 09/30/2015
• Published: 12/01/2016
• Est. Priority Date: 05/31/2015
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Adler, Mitchell D., Brouwer, Michael, Whalley, Andrew R., Hurley, John C., Murphy, Richard F., Finkelstein, David P.
• Granted Patent: US 10,318,154 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0604 Improving or facilitating administration, e.g. storage management
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/0683 Plurality of storage devices
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 90/00 Systems or methods specially adapted for administrative, commercial, financial, managerial or supervisory purposes, not involving significant data processing
• CPC Class Codes: H04L 67/1044 Group management mechanisms management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 4/08 User group management

Abstract

Some embodiments provide a method for a first device that identifies definitions of different groups of devices, each of which is defined by a set of properties required for a device to be a member. The method monitors properties of the first device to determine when the device is eligible for membership in a group. When the first device is eligible for membership in a first group of which the device is not a member, the method sends an application for membership in the first group signed with at least a private key of the device to at least one other device that is a member of the first group. When the first device becomes ineligible for membership in a second group of which the first device is a member, the method removes the device from the second group and notifies other devices that are members of the second group.

Claims

1. A machine readable medium storing a program for execution by at least one processing unit of a first device, the program comprising sets of instructions for:

identifying definitions of different groups of devices, each group of devices defined by a set of properties required for a device to be a member of the group;

monitoring properties of the first device to determine when the first device is eligible for membership in one of the groups;

when the first device is eligible for membership in a first group of which the first device is not a member, sending an application for membership in the first group signed with at least a private key of the first device to at least one other device that is a member of the first group; and

when the first device becomes ineligible for membership in a second group of which the first device is a member, removing the first device from the second group and notifying other devices that are members of the second group.

2. The machine readable medium of claim 1, wherein membership in the first group requires knowledge of a particular private key, wherein the set of instructions for sending an application comprises sets of instructions for:

signing a public key of the first device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the first device;

signing the identity of the first device with a private key of the first device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

3. The machine readable medium of claim 1, wherein the program further comprises a set of instructions for receiving a notification, from one of the other devices that is a member of the first group, that the first device is accepted as a member of the first group, wherein the notification comprises a message, signed by the other device, that lists the members of the group including the first device.

4. The machine readable medium of claim 1, wherein the first device is a member of a plurality of different groups.

5. The machine readable medium of claim 1, wherein a particular one of the groups requires devices to have a particular operating system to join the group.

6. The machine readable medium of claim 1, wherein a particular one of the groups requires that a user verify a new device on a device that is established as a member of the group.

7. The machine readable medium of claim 1, wherein a particular one of the groups requires devices to be protected with a passcode of at least a specified length in order to join the group.

8. The machine readable medium of claim 1, wherein the program further comprises sets of instructions for:

from a second device, receiving an application for membership in a third group of which the first device is a member;

verifying that the second device meets the requirements for membership in the third group; and

when the second device meets said requirements, sending a notification to the other devices that are members of the third group specifying that the second device is a member of the third group.

9. The machine readable medium of claim 8, wherein the set of instructions for verifying that the second device meets the requirements for membership in the third group comprises a set of instructions for verifying that the request is signed by a private key the possession of which is required for membership in the third group.

10. The machine readable medium of claim 8, wherein the set of instructions for verifying that the second device meets the requirements for membership in the third group comprises a set of instructions for prompting a user to allow the second device into the third group.

11. The machine readable medium of claim 1, wherein the application for membership is sent to all devices that are members of the first group.

12. The machine readable medium of claim 1, wherein the application for membership is sent to only a subset of the devices that are members of the first group.

13. An electronic device comprising:

a set of processing units; and

a machine readable medium storing a program for execution by at least one of the processing units of the first device, the program comprising sets of instructions for;

identifying definitions of different groups of devices, each group of devices defined by a set of properties required for a device to be a member of the group;

monitoring properties of the electronic device to determine when the electronic device is eligible for membership in one of the groups;

when the electronic device is eligible for membership in a first group of which the electronic device is not a member, sending an application for membership in the first group signed with at least a private key of the electronic device to at least one other device that is a member of the first group; and

when the electronic device becomes ineligible for membership in a second group of which the electronic device is a member, removing the electronic device from the second group and notifying other devices that are members of the second group.

14. The electronic device of claim 13, wherein the first group requires knowledge of a particular private key, wherein the set of instructions for sending an application comprises sets of instructions for:

signing a public key of the electronic device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the electronic device;

signing the identity of the electronic device with a private key of the electronic device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

15. The electronic device of claim 13, wherein the program further comprises a set of instructions for receiving a notification, from one of the other devices that is a member of the first group, that the electronic device is accepted as a member of the first group, wherein the notification comprises a message, signed by the other device, that lists the members of the group including the electronic device.

16. The electronic device of claim 13, wherein the electronic device is a first device, wherein the program further comprises sets of instructions for:

from a second device, receiving an application for membership in a third group of which the first device is a member;

verifying that the second device meets the requirements for membership in the third group; and

when the second device meets said requirements, sending a notification to the other devices that are members of the third group specifying that the second device is a member of the third group.

17-18. -18. (canceled)

19. For a first device, a method comprising:

identifying definitions of different groups of devices, each group of devices defined by a set of properties required for a device to be a member of the group;

monitoring properties of the first device to determine when the first device is eligible for membership in one of the groups; and

when the first device is eligible for membership in a first group of which the first device is not a member, sending an application for membership in the first group signed with at least a private key of the first device to at least one other device that is a member of the first group,

wherein when the first device becomes ineligible for membership in a second group of which the first device is a member, the first device removes itself from the second group and notifies other devices that are members of the second group.

20. The method of claim 19, wherein membership in the first group requires knowledge of a particular private key, wherein sending an application comprises:

signing a public key of the first device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the first device;

signing the identity of the first device with a private key of the first device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

22. The method of claim 19, wherein the application for membership is sent to all devices that are members of the first group.

23. The method of claim 19, wherein the application for membership is sent to only a subset of the devices that are members of the first group.

21. (canceled)