CERTIFICATE BASED PROFILE CONFIRMATION

• US 20180054442A1
• Filed: 11/01/2017
• Published: 02/22/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Dabbiere, Alan
• Granted Patent: US 10,560,453 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Disclosed are various embodiments for controlling access to resources in a network environment. Methods may include installing a profile on the device and installing a certificate included in or otherwise associated with the profile on the device. A request to execute an application, and/or access a resource using a particular application, is received and determination is made as to whether the certificate is installed on the device based on an identification of the certificate by the application. If the certificate is installed on the device, then execution of the application and/or access to the resource is allowed. If the certificate is not installed on the device, then the request for execution and/or access is refused.

Claims

1-20. -20. (canceled)

21. A method for managing a device, comprising:

sending, to the device from a remote server, a profile specifying that an application installed on the device is authorized to access a resource, wherein the profile comprises a certificate that uniquely identifies the profile from another profile;

receiving, at the remote server, a request from the application installed on the device to access the resource, the request including the certificate;

verifying that the certificate is valid; and

if the certificate is valid, providing the application with access to the resource.

22. The method of claim 21, further comprising:

if the certificate is not valid, denying access to the resource.

23. The method of claim 21, further comprising:

if the certificate is not valid, initiating a remedial measure defined by the profile.

24. The method of claim 23, wherein the remedial measure is one of at least:

causing the device to delete any resources originally accessed using the certificate;

disabling an enterprise application;

sending an alert to the device alerting a user of the device that access was denied;

sending an alert to an administrator; and

pursuing an alternate validation method.

25. The method of claim 21, wherein the profile is uniquely associated with the application.

26. The method of claim 21, wherein providing the application with access to the resource further comprises locating the resource and transmitting the resource to the device.

27. The method of claim 21, wherein providing the application with access to the resource further comprises providing the application with access to a plurality of additional resources authorized by the certificate.

28. A non-transitory, computer-readable medium comprising instructions that, when executed by a processor of a remote server, performs stages for managing a device, the stages comprising:

sending, to the device from the remote server, a profile specifying that an application installed on the device is authorized to access a resource, wherein the profile comprises a certificate that uniquely identifies the profile from another profile;

receiving, at the remote server, a request from the application installed on the device to access the resource, the request including the certificate;

verifying that the certificate is valid; and

if the certificate is valid, providing the application with access to the resource.

29. The non-transitory, computer-readable medium of claim 28, the stages further comprising:

if the certificate is not valid, denying access to the resource.

30. The non-transitory, computer-readable medium of claim 28, the stages further comprising:

if the certificate is not valid, initiating a remedial measure defined by the profile.

31. The non-transitory, computer-readable medium of claim 30, wherein the remedial measure is one of at least:

causing the device to delete any resources originally accessed using the certificate;

disabling an enterprise application;

sending an alert to the device alerting a user of the device that access was denied;

sending an alert to an administrator; and

pursuing an alternate validation method.

32. The non-transitory, computer-readable medium of claim 28, wherein the profile is uniquely associated with the application.

33. The non-transitory, computer-readable medium of claim 28, wherein providing the application with access to the resource further comprises locating the resource and transmitting the resource to the device.

34. The non-transitory, computer-readable medium of claim 28, wherein providing the application with access to the resource further comprises providing the application with access to a plurality of additional resources authorized by the certificate.

35. A server, comprising:

a memory storage storing program code; and

a processor coupled to the memory storage, wherein, upon execution, the program code causes the processor to;

send, to a device from the server, a profile specifying that an application installed on the device is authorized to access a resource, wherein the profile comprises a certificate that uniquely identifies the profile from another profile;

receive a request, from the application installed on the device, to access the resource, the request including the certificate;

verify that the certificate is valid; and

if the certificate is valid, provide the application with access to the resource.

36. The server of claim 35, wherein the program code causes the processor to, if the certificate is not valid, deny access to the resource.

37. The server of claim 35, wherein the program code causes the processor to, if the certificate is not valid, initiate a remedial measure defined by the profile.

38. The server of claim 37, wherein the remedial measure is one of at least:

causing the device to delete any resources originally accessed using the certificate;

disabling an enterprise application;

sending an alert to the device alerting a user of the device that access was denied;

sending an alert to an administrator; and

pursuing an alternate validation method.

39. The server of claim 35, wherein the profile is uniquely associated with the application.

40. The server of claim 35, wherein providing the application with access to the resource further comprises providing the application with access to a plurality of additional resources authorized by the certificate.