Configuring a device with a certificate by sequencing asynchronous work requests

Abstract

This article describes a technique that can configure a device with a certificate by sequencing asynchronous work requests. The portion of the work required to perform the configuration of the device with the certificate is based at least in part on a triggering event indicating that the device is to be configured. An asynchronous work request is generated, and the asynchronous work request is configured to initiate the execution of the corresponding portion of the work when executed. A hierarchical work tree is generated, and the hierarchical work tree contains hierarchical nodes representing the corresponding portions of the work. The hierarchical work tree defines the order in which the portions of the work will be executed. The asynchronous work requests are executed in the order defined by the hierarchical work tree, which initiates the creation of the certificate and delivers the certificate to the device.

Description

Background Art

[0001] Mobile device management (MDM) is often used to help information technology (IT) administrators manage end-user devices. For example, MDM can enable IT administrators to configure email, virtual private network (VPN), WiFi, and certificate policies on end-user devices. An end user associated with an end-user device can enroll the end-user device with a cloud-based management solution that includes MDM capabilities. Examples of cloud-based management solutions include, but are not limited to, Microsoft Azure, which is developed and distributed by Microsoft Corporation. Developed and published by VMware Inc. Unified Endpoint Management developed and distributed by MobileIron, Inc. TM ; Tanium Core Platform developed and distributed by Tanium Inc. TM Registering end-user devices with a cloud-based management solution enables that solution to manage the end-user device. For example, IT administrators can use the solution to push the organization's configuration to end-user devices, enabling end users to set up their email, VPN, and WiFi and obtain certificates.

[0002] However, traditional cloud-based management solutions have limitations, including but not limited to relatively low scalability, security, IT administrator experience, end-user experience, and developer experience. For example, traditional cloud-based management solutions are often distributed across multiple services, which can result in (a) increased latency to complete end-to-end delivery, (b) reduced reliability of certificate delivery, self-service or error reporting to IT administrators, and troubleshooting (e.g., even if a single service encounters an issue), and (c) increased likelihood that adding new functionality will degrade or reduce the performance of other core functions. Traditional solutions may utilize iterative brute force techniques to configure devices to obtain certificates, which often results in performing redundant work, consuming more computing resources, and not being able to understand why work performance failed. Traditional solutions may utilize heuristics to determine when to renew certificates, which can result in end users being unable to access resources due to renewal delays or reliance on heuristics to renew. Traditional solutions may not be able to reliably revoke certificates or even retain information about certificates. As a result, IT administrators may not be able to control the certificate lifecycle of employee devices that are lost or leave the organization. Summary of the invention

[0003] Various methods are described herein for configuring a device to obtain a certificate by, among other things, sequencing asynchronous work requests. A certificate is electronic information (such as code or data, such as a file) that proves ownership of a public key (such as an asymmetric public key). Thus, a certificate can cryptographically link ownership of a public key to an entity that possesses the public key (i.e., the owner of the public key). For example, a certificate can include a public key, information about the public key, information about the identity of the owner of the public key, information about the certificate, and a signature (i.e., a public key signature) created by the issuer of the certificate. The certificate can be used to encrypt information related to the owner of the public key, sign such information, and authenticate the owner of the public key. The certificate can be configured in a format defined by the X.509 standard, which is defined by the International Telecommunication Union Standardization Sector (ITU-T). A certificate configured to have a format defined by the X.509 standard is referred to herein as an "X.509 certificate." X.509 certificates are used in a variety of network protocols, including Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), both of which are commonly used to encrypt Hypertext Transfer Protocol Secure (HTTPS) communications.

[0004] In one example method, portions of a work of configuring a device to have a certificate are performed based at least in part on a triggering event indicating that the device is to be configured. An asynchronous work request is generated, the asynchronous work request being configured to initiate execution of a corresponding portion of the work when executed. A hierarchical work tree is generated, the hierarchical work tree comprising hierarchical nodes representing corresponding portions of the work. The hierarchical work tree defines an order in which the portions of the work are to be executed based at least in part on rules indicating conditions under which the portions of the work are to be executed. The asynchronous work requests are executed in an order defined by the hierarchical work tree, which initiates creation of the certificate and delivery of the certificate to the device.

[0005] The present invention content introduces some concepts in a simplified form, and these concepts will be further described in the specific embodiments below. This invention content is not intended to identify the key features or basic features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection. In addition, it is worth noting that the present invention is not limited to the specific embodiments and / or the specific embodiments described in other sections of this document. These embodiments are presented herein for illustrative purposes only. Based on the teachings contained herein, other embodiments are obvious to those skilled in the relevant art. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings, which are incorporated herein and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, further serve to explain the principles involved and to enable one skilled in the relevant art to make and use the disclosed technology.

[0007] Figure 1 is a block diagram of an example hierarchical work sequencing system, according to an embodiment.

[0008] Figure 2 is an example activity diagram for configuring a device with credentials by sequencing asynchronous work requests according to an embodiment.

[0009] Figure 3 is a block diagram of an example hierarchical work tree according to an embodiment.

[0010] Figure 4 Depicted is a flow diagram of an example method of configuring a device with credentials by sequencing asynchronous work requests in accordance with an embodiment.

[0011] Figure 5 Depicted is a flow diagram of an example method for changing the state of a specified certificate by sequencing additional asynchronous work requests in accordance with an embodiment.

[0012] Figure 6 is a block diagram of an example computing system according to an embodiment.

[0013] Figure 7 An example computer is depicted upon which embodiments may be implemented.

[0014] Features and advantages of the disclosed technology will become more apparent from the detailed description described below when taken in conjunction with the accompanying drawings, in which like reference characters will identify corresponding elements throughout. In the drawings, like reference numerals generally indicate identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit in the corresponding reference numeral. DETAILED DESCRIPTION

[0015] 1. Introduction

[0016] The following detailed description refers to the accompanying drawings, which illustrate exemplary embodiments of the present invention. However, the scope of the present invention is not limited to these embodiments, but is defined by the appended claims. Therefore, embodiments other than the embodiments shown in the accompanying drawings, such as modified versions of the illustrated embodiments, may still be included in the present invention.

[0017] References in the specification to "one embodiment", "an embodiment", "an example embodiment", etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment may include the particular feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is assumed that, whether or not explicitly described, a person skilled in the relevant art knows how to implement such feature, structure, or characteristic in conjunction with other embodiments.

[0018] Descriptors such as "first," "second," "third," etc. are used to reference some elements discussed herein. Such descriptors are used to facilitate discussion of example embodiments and do not indicate a required order of the referenced elements unless an affirmative statement is made herein that such an order is required.

[0019] II. Example Embodiments

[0020] The example embodiments described herein can configure a device to have a certificate by sequencing asynchronous work requests. A certificate is an electronic message (such as code or data, such as a file) that proves the ownership of a public key (such as an asymmetric public key). Therefore, a certificate can cryptographically link the ownership of a public key to an entity that owns the public key (i.e., the owner of the public key). For example, a certificate can include a public key, information about the public key, information about the identity of the owner of the public key, information about the certificate, and a signature (i.e., a public key signature) created by the certificate issuer. The certificate can be used to encrypt information related to the owner of the public key, sign such information, and authenticate the owner of the public key. The certificate can be configured to a format defined by the X.509 standard, which is defined by the International Telecommunication Union Standardization Department (ITU-T). A certificate configured to have a format defined by the X.509 standard is referred to herein as an "X.509 certificate." X.509 certificates are used in a variety of network protocols, including Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), which are commonly used to encrypt Hypertext Transfer Protocol Secure (HTTPS) communications.

[0021] The asynchronous work request may be implemented as a software object and / or class, although the example embodiments are not limited in this respect. The asynchronous work request described herein may fully represent the information required to track the life cycle of a certificate, including but not limited to information required to issue a certificate, attributes set in the certificate, the type of certificate, and information indicating (e.g., describing) how to obtain the certificate.

[0022] The example techniques described herein have a variety of advantages over traditional techniques for configuring devices with certificates. For example, the example techniques may be able to ensure that certificates are delivered to devices and manage (e.g., track) certificates after they are delivered. Therefore, the example techniques may improve the security of devices. By defragmenting the processing and storage of data into a single certificate management service (CMS), the example techniques may centralize and streamline the processing of certificate delivery. The example techniques may reduce the likelihood of performing redundant work (e.g., when performing operations to configure a device to obtain a certificate). The processing of certificates may be tracked using a request model so that each asynchronous work request is independent of the type of certificate issued. IT administrators may use asynchronous work requests to track the lifetime of issued certificates and reliably revoke certificates as needed. Therefore, IT administrators may be able to control the certificate lifecycle of employee devices that lose their devices or leave the organization.

[0023] Example techniques may use information collected from tracking certificate processing to determine (e.g., automatically) renewal of a certificate prior to expiration. Thus, example techniques may enable (e.g., ensure) that certificates are renewed in a timely manner. Asynchronous work requests may represent processing status and may be used to avoid unnecessary (e.g., redundant) certificate issuance. A state machine based on the status represented by the asynchronous work requests may be utilized to provide IT administrators with more accurate and thorough reporting and auditing, while enhancing troubleshooting capabilities. Example techniques that configure devices based, at least in part, on sequencing asynchronous work requests may be more scalable than conventional techniques.

[0024] The example techniques may be implemented in a single service of a cloud-based management solution, which may result in (a) reduced latency to complete end-to-end delivery of certificates, (b) increased reliability of certificate delivery, self-service or error reporting to IT administrators, and troubleshooting, and (c) reduced likelihood that adding new functionality will degrade or degrade performance of other core functionality. By leveraging a common consistent model, the example techniques may reduce design complexity for a variety of certificate scenarios, thereby reducing development costs for cloud-based management solutions.

[0025] Example techniques can support complex chaining of asynchronous work requests, and rules for determining the order in which asynchronous work requests are to be executed can govern the allowed actions or states. Chaining and sequencing of asynchronous work requests can ensure that processing of a request that depends on completion data of another request does not begin until the other request is completed. Chaining of asynchronous work requests can provide significant advantages in coordinating several different types of requests, enforcing sequencing, avoiding failure of an entire operation due to failure of a single request, and allowing retry of some or all request failures. Chaining can enable already processed asynchronous work requests to be recovered and relinked if necessary.

[0026] HTTP actions can execute triggers for creating certificates, state transitions, completing, and deleting asynchronous work requests. These actions can come from multiple sources, increasing the versatility of the example technology and making the example technology platform-independent. The example technology can reduce processing during device check-in. By using an asynchronous model, devices can delay long-running operations, such as certificate requests issued to a certificate delivery service (CDS) (also known as a certificate generator) and a certificate management system (CMS). The CDS and CMS can perform the operation and notify the device check-in when the processing is complete. Even a small time saving in processing time can allow millions of devices to use existing units of scale, thereby saving operating costs for cloud-based management systems. The example technology can be able to deterministically track (e.g., manage) the life cycle of all asynchronous work requests and their generated certificates, which can result in a better (e.g., more thorough, more accurate, and more precise) reporting experience for IT administrators.

[0027] This example technology can move some of the processing logic used to configure the device from a customer's on-premises deployment component to a server-side component of a cloud-based management system. Such a component can be bundled as a connector installer for on-premises deployment installations. Moving the processing logic to a server-side component can improve the ease and speed of telemetry, development, and bug fixing, simplify deployment for customers, and provide higher performance even if the customer is using less than ideal hardware.

[0028] The centralized platform-agnostic approach provides a framework to support the ever-changing environment in MDM. The example technology can mitigate (e.g., eliminate) repetitive development costs to support new MDM channels. The example technology can be able to notify end users to perform manual interactions required to complete the credential delivery flow and notify other services to resume processing or notify device check-in. The example technology can increase the resiliency of the credential delivery flow and reduce notification noise by mapping multiple triggers to a single notification action and retrying when the notification fails.

[0029] Example techniques may reduce the time and / or resources (e.g., processor cycles, memory, network bandwidth) required to configure a device to have a certificate. Example techniques may reduce costs associated with configuring a device to have a certificate. For example, by sequencing asynchronous work requests to configure a device, the amount of redundant work performed to configure the device may be reduced. Reducing redundant work may reduce the time, cost, and / or resource consumption associated with configuring a device to have a certificate. Example techniques may increase the efficiency of a computing system used to configure a device to have a certificate.

[0030] Example techniques may improve efficiency for IT administrators and / or end users. For example, by sequencing asynchronous work requests to configure a device, example techniques may reduce some of the steps performed by an IT administrator and / or end user, the amount of work expended by an IT administrator and / or end user, and / or the time spent by an IT administrator and / or end user to facilitate device configuration. Example techniques may improve the user experience for end users, IT administrators, and / or developers of cloud-based management solutions (e.g., by simplifying the solution).

[0031] Figure 1 is a block diagram of an example hierarchical work sequencing system 100 according to one embodiment. Generally speaking, the hierarchical work sequencing system 100 operates to provide information to a user in response to (e.g., based on) a request (e.g., a hypertext transfer protocol (HTTP) request) received from the user. The information may include a document (e.g., a web page, an image, an audio file, a video file, etc.), the output of an executable file, and / or any other suitable type of information. According to the example embodiment described herein, the hierarchical work sequencing system 100 configures a device with a certificate by sequencing asynchronous work requests.

[0032] like Figure 1 As shown, the hierarchical work sequencing system 100 includes a plurality of user devices 102A-102M, a network 104, a plurality of servers 106A-106N, and a management system 108. Communications between the user devices 102A-102M, the servers 106A-106, and the management system 108 are performed over the network 104 using well-known network communication protocols. The network 104 may be a wide area network (e.g., the Internet), a local area network (LAN), another type of network, or a combination thereof.

[0033] The user devices 102A-102M are processing systems capable of communicating with the servers 106A-106N. An example of a processing system is a system including at least one processor capable of operating data according to a set of instructions. For example, the processing system may be a computer, a personal digital assistant, or the like. The user devices 102A-102M are configured to provide requests to the servers 106A-106N for requesting information stored on the servers 106A-106N (or requested via the servers in other accessible ways). For example, a user may initiate a request to execute a computer program (e.g., an application) using a client (e.g., a web browser, a web crawler, or other type of client) deployed on the user device 102, which is owned by the user or otherwise accessible to the user. According to some example embodiments, the user devices 102A-102M are capable of accessing a domain (e.g., a website) hosted by the servers 106A-106N, so that the user devices 102A-102M can access information available through the domain. These domains may include web pages, which may be provided as Hypertext Markup Language (HTML) documents and objects (eg, files) linked therein.

[0034] Each of the user devices 102A-102M may include any client-enabled system or device, including but not limited to a desktop computer, a laptop computer, a tablet computer, a wearable computer such as a smart watch or a head-mounted computer, a personal digital assistant, a cellular phone, an Internet of Things (IoT) device, etc. It will be appreciated that any one or more of the user devices 102A-102M may communicate with any one or more of the servers 106A-106N.

[0035] For ease of illustration, the first user device 102A is shown to include a client-side hierarchical work sequencing logic 110A. The client-side hierarchical work sequencing logic 110A is configured to perform the client-side aspects of the example techniques described herein. For example, the client-side hierarchical work sequencing logic 110A can execute a trigger event indicating that the first user device 102A is to be configured. The trigger event can trigger an asynchronous work request generated to configure the first user device 102A. For example, by executing the trigger event, the client-side hierarchical work sequencing logic 110A can cause the server-side hierarchical work sequencing logic 110B to generate an asynchronous work request, which will be discussed in detail below. The client-side hierarchical work sequencing logic 110A can perform other operations (e.g., support operations) to help the server-side hierarchical work sequencing logic 110B configure the first user device 102A with a certificate.

[0036] Servers 106A-106N are processing systems capable of communicating with user devices 102A-102M. Servers 106A-106N are configured to execute computer programs that provide information to user devices 102A-102M. For example, servers 106A-106N can push such information to user devices 102A-102M, or provide information in response to requests received from user devices 102A-102M. Requests can be generated by users or without user participation. For example, policies applied to user devices are completed without explicit user requests. According to this example, policies are applied in the background even if no user is logged into the user device. Further according to this example, a user device (e.g., an agent thereon, such as client-side hierarchical work sequencing logic 110A) can poll a server for policies according to a schedule (e.g., once an hour) or an event (e.g., device wakeup, user unlocking, etc.). Further according to this example, a server can push policies to a user device (e.g., the agent above) via an open HTTP endpoint. The information provided by servers 106A-106N may include documents (e.g., web pages, images, audio files, video files, etc.), output of executable files, or any other suitable type of information. According to some example embodiments, servers 106A-106N are configured to host corresponding websites so that users of hierarchical work sequencing system 100 can access these websites.

[0037] For ease of illustration, the first server 106A is shown to include a server-side hierarchical work sequencing logic 110B. The server-side hierarchical work sequencing logic 110B is configured to perform the server-side aspects of the example technology described herein. For example, the server-side hierarchical work sequencing logic 110B can determine the part of the work that is to be executed to configure the first user device 102A to have a certificate based at least in part on the detection of a triggering event performed by the first user device 1024A. The server-side hierarchical work sequencing logic 110B can generate asynchronous work requests that are configured to initiate the execution of the corresponding part of the work when executed. The server-side hierarchical work sequencing logic 110B can generate a hierarchical work tree that includes hierarchical nodes representing the corresponding parts of the work. The hierarchical work tree defines the order in which the parts of the work are to be executed based at least in part on the rules that indicate the conditions under which the parts of the work are to be executed. For example, a rule can define a state machine that is used to determine the allowed states of the asynchronous work request and the valid conversion between states. The state at the beginning of the conversion (e.g., the source state) is called the "starting state". The state at the end of the conversion is called the "target state". Each transition from the starting state to the target state represents one or more actions to be performed to transition from the starting state to the target state. The server-side hierarchical work sequencing logic 110B can execute asynchronous work requests in the order defined by the hierarchical work tree, which will initiate the creation of certificates and the delivery of certificates to the first user device 102A. For example, the execution of the asynchronous work request may include sending a request to the certificate generator 112, which will be discussed in further detail below, requesting the generation (e.g., creation) of a certificate. The server-side hierarchical work sequencing logic 110B may be able to drive state changes from actions and generate notifications that can trigger other actions. The server-side hierarchical work sequencing logic 110B can determine the history of the certificate status based on the state of the asynchronous work request. The server-side hierarchical work sequencing logic 110B can monitor the operations performed to configure the first user device 102A and the certificate flow to identify service errors, defects, and customer environment issues. The certificate status can be used by IT administrators to audit certificates (e.g., determine to revoke a certificate on a lost device to prevent access to company resources).

[0038] For ease of illustration, the second server 106B is shown to include a certificate generator 112. The certificate generator 112 is configured to generate a certificate in response to a request to generate a certificate. For example, as described above, in response to receiving a request sent by the server-side hierarchical work sequencing logic 110B, the certificate generator 112 can generate a certificate to be provided to the first user device 102A. The certificate generator 112 can formally deliver each of the certificates to the client-side hierarchical work sequencing logic 110A in response to generating the corresponding certificate.

[0039] The management system 108 is a processing system capable of communicating with the servers 106A-106N. The management system 108 is configured to perform operations so as to configure the user devices 102A-102M in response to instructions received from an IT administrator of the hierarchical work sequencing system 100. For example, the management system 108 can provide a command to the first server 106A indicating which policies (i.e., configuration files) are to be downloaded to the user devices 102A-102M based on instructions received from the IT administrator who specifies these policies. Examples of policies include WiFi policies, VPN policies, email policies, and certificate policies. The WiFi policy specifies configuration settings that the user device is configured to utilize to access the WiFi network. The VPN policy specifies the configuration of the VPN. The email policy specifies the configuration of the email program. The certificate policy specifies the certificate to be utilized by the user device (e.g., for authentication, signing, and / or encryption). For example, the certificate policy can specify which of the certificates is used to access each of the WiFi network, VPN, and email program and / or for performing operations therein. For example, the certificate policy can specify that the first certificate is used to sign the email and the second certificate is used to encrypt the email.

[0040] Each of the client-side tiered work ordering logic 110A, the server-side tiered work ordering logic 110B, and the certificate generator 112 can be implemented in various ways to configure a device (e.g., any of the user devices 102A-102M) to possess a certificate by ordering asynchronous work requests (including being implemented in hardware, software, firmware, or any combination thereof). For example, each of the client-side tiered work ordering logic 110A, the server-side tiered work ordering logic 110B, and the certificate generator 112 can be implemented as computer program code configured to be executed in one or more processors. In another example, each of the client-side tiered work ordering logic 110A, the server-side tiered work ordering logic 110B, and the certificate generator 112 can be implemented at least in part as hardware logic / electrical circuitry. For example, each of the client-side tiered work ordering logic 110A, the server-side tiered work ordering logic 110B, and the certificate generator 112 may be implemented at least in part in a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), an application specific standard product (ASSP), a system on a chip (SoC), a complex programmable logic device (CPLD), etc. Each SoC may include an integrated circuit chip including a processor (such as a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces, and / or one or more of further circuits and / or embedded firmware to perform its functions.

[0041] For purposes of illustration and without intent to be limiting, the client-side hierarchical work sequencing logic 110A is shown as being included in the first user device 102A. It will be appreciated that the client-side hierarchical work sequencing logic 110A can be incorporated into any of the user devices 102A-102M. For purposes of illustration and without intent to be limiting, the server-side hierarchical work sequencing logic 110B is shown as being incorporated into the first server 106A. It will be appreciated that the server-side hierarchical work sequencing logic 110B can be incorporated into any one or more of the servers 106A-106N. For purposes of illustration and without intent to be limiting, the certificate generator 112 is shown as being incorporated into the second server 106B. It will be appreciated that the certificate generator 112 can be incorporated into any one or more of the servers 106A-106N.

[0042] Figure 2 is an example activity diagram 200 for configuring a device with credentials by sequencing asynchronous work requests, according to an embodiment. Figure 2 The client device 202, the hierarchical work ordering logic 210 and the certificate generator 212 are described, which are respectively Figure 1 10, and 112. The hierarchical work sequencing logic 210 includes configuration logic 214, a certificate management system (CMS) 216, and a work processor 218. Activities 220, 222, 224, 226, 228, 230, 232, 234, 236, and 238 will now be described with reference to the client device 202, the configuration logic 214, the certificate management system 216, the work processor 216, and the certificate generator 212.

[0043] In activity 220, the client device 202 executes a triggering event. The triggering event indicates that the client device 202 is to be configured. For example, the triggering event may include the client device 202 powering on, booting or rebooting, installing new software or hardware, or logging into a cloud-based management system. The configuration of the client device 202 may include setting parameters for software (e.g., email, VPN, or WiFi software) to be run on the client device 302.

[0044] In activity 222, configuration logic 214 requests a certificate to be provided to client device 202 to facilitate configuration of client device 202. For example, configuration logic 244 can request a certificate based on (e.g., based at least in part on) the performance of a triggering event. According to this example, the triggering event can trigger configuration logic 214 to request a certificate.

[0045] In activity 224, CMS 216 generates a hierarchical tree structure that defines the order of work items (i.e., parts of work) to be executed to configure client device 202. For example, CMS 226 can determine the work items based on the determination of which work items are to be executed and generate a hierarchical tree structure. The hierarchical tree structure includes nodes representing corresponding work items. The nodes are arranged hierarchically in the hierarchical tree structure to reflect the order in which the work items are to be executed. For example, the hierarchical tree structure can include subsets of nodes in corresponding hierarchies of the hierarchical tree structure. According to this example, the first level (i.e., the highest) of the hierarchical tree structure can include a first subset of nodes; the second level of the hierarchical tree structure located directly below the first level can include a second subset of nodes; the third level of the hierarchical tree structure is located directly below the second level and can include a third subset of nodes, and so on. The first subset includes the root node of the hierarchical tree structure. Each other subset includes one or more nodes in the node. A rule may be established to require that at each given hierarchical level in a hierarchical tree structure, a work item represented by a node is executed before a work item represented by a node in the next higher hierarchical level that has a dependency on the node in the given hierarchical level. Figure 3 An example of sequencing work items is described in more detail.

[0046] In activity 226 , CMS 226 provides each work item to work processor 218 in the order defined by the hierarchical tree structure.

[0047] In activity 228, work processor 218 processes the corresponding work item. Processing the corresponding work item may include setting software and / or hardware parameters, storing information, and / or instructing other entities (e.g., certificate generator 212) to perform operations. For example, processing the corresponding work item may include initiating the creation of a certificate. According to this example, work processor 218 may provide a request to certificate generator 212 requesting the creation of a certificate. Further according to this example, certificate generator 212 may generate a certificate based on the request received from work processor 218. It can be appreciated that the creation of the certificate requested in activity 222 is initiated by processing the corresponding work item in activity 228.

[0048] In an example embodiment, the work item is associated with a corresponding asynchronous work request. According to this embodiment, processing the corresponding work item in activity 228 includes executing the corresponding asynchronous work request. For example, executing the asynchronous work request can initiate processing of the corresponding work item.

[0049] In activity 230, work processor 218 provides a result of processing the corresponding work item to CMS 216. The result may include information about parameters that have been set, information that has been stored, and / or operations that have been instructed to be performed by other entities (e.g., the results of such operations). The result of processing the corresponding work item may indicate a status of one or more of the certificates. For example, the result may indicate whether one or more of the certificates has been created.

[0050] In activity 232, CMS 216 provides the result to the parent work item of the corresponding work item (i.e., the work item that has a dependency on the corresponding work item). It can be appreciated that multiple work items may have dependencies on the corresponding work item. CMS 216 can provide the result to each of the work items that have a dependency on the corresponding work item.

[0051] Activities 226, 228, 230, and 232 are executed for each work item represented by a node in the hierarchical tree structure. Therefore, activities 226, 228, 230, and 232 can be iteratively executed, wherein these activities are executed for each work item in the corresponding iteration. For example, activities 226, 228, 230, and 232 can be executed for the first work item represented by the first node in the hierarchical tree structure during the first iteration; activities 226, 228, 230, and 232 can be executed for the second work item represented by the second node in the hierarchical tree structure during the second iteration, and so on. Any two or more iterations in an iteration can be executed simultaneously, as long as each work item (or subset of work items) that has a dependency on another work item (or subset of work items) is not processed until another (or subset) work item is processed. Any two or more iterations in an iteration can be executed continuously.

[0052] In activity 234, the CMS 216 forwards the certificates to the client device 202 to facilitate configuration of the client device 202. For example, in response to the work processor 218 initiating the creation of the corresponding certificates in activity 228, the CMS 216 can provide each of the certificates to the CMS 216. The certificate generator 212 can provide the certificates to the CMS 216 one at a time as the certificates are created, or the certificate generator 212 can provide two or more (e.g., all) certificates to the CMS 216 at the same time (i.e., after two or more certificates are created). When receiving the certificates from the certificate generator 212, the CMS 216 can forward the certificates to the client device 202 one at a time, or the CMS 216 can forward any two or more (e.g., all) certificates to the client device 202 at the same time (i.e., after receiving the two or more certificates from the certificate generator 121).

[0053] In an example embodiment, the CMS 216 does not receive the certificate from the certificate generator 212, and therefore, the CMS 216 does not forward the certificate to the client device 202 in activity 234. According to this embodiment, the certificate generator 121 provides the certificate to the client device 302 without passing the certificate through the CMS 216. Therefore, the certificate generator 212 can provide the certificate directly to the client device 202.

[0054] In activity 236, metadata for the certificate is stored by CMS 216. For example, certificate generator 212 may provide metadata to CMS 216 for storage. The metadata may include a work item identifier identifying each work item (or an asynchronous work request associated therewith), a timestamp indicating the time when the (e.g., specific) work item was processed, the result of the work item (e.g., the creation of a certificate, the setting of parameters, and / or the storage of information), and an endpoint identifier for identifying the name and / or uniform resource identifier (URI) of the certificate generator that created each certificate. For example, each URI may be a uniform resource name (URN) or a uniform resource locator (URL). The metadata for each certificate may uniquely identify the corresponding certificate. For example, the metadata for each certificate may include a certificate fingerprint specific to the corresponding certificate. Thus, the metadata for each certificate may distinguish the corresponding certificate from other certificates. Certificate generator 212 may perform activity 236 whenever the condition (e.g., state) of a certificate changes.

[0055] In activity 238, CMS 216 tracks the certificates using the metadata. For example, CMS 216 may monitor the state of each certificate indicated by the metadata to determine whether to process additional work items for the corresponding certificate. For example, a change in the state of a certificate from a first state to a second state may indicate that work processor 218 is to process a particular work item. If CMS 216 determines that additional work items are to be processed, CMS 216 may provide work instructions to work processor 218 to instruct work processor 216 to process the additional work items. For example, the additional work items may be configured to generate a WiFi profile indicating configuration settings to be applied to the client device 202 to enable the client device 202 to access a WiFi network; a VPN profile indicating a configuration of a VPN, e.g., including an identification of a certificate to be used by the client device 202 to authenticate a user of the client device 202 to the VPN; an email profile indicating a configuration of an email program to be used by the client device 202, e.g., including an identification of a certificate to be used by the client device 202 to authenticate a user of the client device 202 to the email program; and / or a certificate profile indicating one or more certificates to be used by the client device 202 to authenticate the user of the client device 202 to an entity (e.g., a software program installed on the client device 202 or a cloud service), signing information, and / or encryption information. The CMS 216 may provide the WiFi profile, the VPN profile, the email profile, and / or the certificate profile to the client device 202 to further facilitate the client device 202.

[0056] Figure 3 is a block diagram of an example hierarchical working tree 300 according to one embodiment. Figure 3As shown, the hierarchical work tree 300 includes hierarchical nodes 304A-304G, which represent corresponding work items AG. Work item A is configured to configure an email account on the user's device. Work item B is configured to enable a signature certificate to be installed on the device. For example, processing work item B can install a signature certificate on the device, or instruct other entities (e.g., certificate generator 112 or 212) to install a signature certificate on the device. Work item C is configured to enable encryption certificate #1 to be installed on the device. Work item D is configured to enable encryption certificate #2 to be installed on the device. Work item E is configured to enable a signature certificate to be set on the device. Work item F is configured to re-encrypt the PFX password associated with encryption certificate #1. Work item G is configured to re-encrypt the PFX password associated with encryption certificate #2. PFX is an archive file format for storing multiple encrypted objects in a single file. A PFX password is a password that can bind a certificate and a private key associated with the certificate according to the PFX file format. For example, a PFX password can be used to encrypt a file that includes a certificate and further contains a private key. PKCS#12 is another archive file format used to store multiple cryptographic objects in a single file. PKCS#12 is the successor to PFX. It is recognized that a PKCS#12 password can be used instead of a PFX password to bind a certificate and the private key associated with the certificate.

[0057] Hierarchical work tree 300 includes a first hierarchical level 302A, a second hierarchical level 302B, and a third hierarchical level 302C. First hierarchical level 302A includes node 304A representing work item A. Second hierarchical level 302B includes nodes 304-B-304D identifying corresponding work items BD. Third hierarchical level 302C includes nodes 304E-304G representing corresponding work items EG. Work item A depends on each of work items BD. Work item B depends on work item E. Work item C depends on work item F. Work item D depends on work item G.

[0058] A rule may indicate conditions under which work items AG are to be executed. For ease of illustration, assume a rule states that if a given work item depends on another work item, the other work item must be processed (e.g., completed) before the given work item is processed. Applying this rule, we see that work item E must be processed before work item B because work item B depends on work item E. Therefore, the signing certificate is provided before the signing certificate is installed. Work item B must be processed before work item A because work item A depends on work item B. Therefore, the signing certificate is installed before email is configured. Work item F must be processed before work item C because work item C depends on work item F. Therefore, the PFX password associated with encryption certificate #1 is re-encrypted before encryption certificate #1 is installed. Work item C must be processed before work item A because work item A depends on work item C. Therefore, encryption certificate #1 is installed before email is configured. Work item G must be processed before work item D because work item D depends on work item G. Therefore, the PFX password associated with encryption certificate #2 is re-encrypted before encryption certificate #2 is installed. Work item D must be processed before work item A because work item A depends on work item D. Therefore, encryption certificate #2 is installed before configuring email.

[0059] Figure 4 A flowchart 400 is depicted of an example method for configuring a device with credentials by sequencing asynchronous work requests in accordance with an embodiment. Figure 5 Flowchart 500 is a flow chart describing an example method for changing the state of a specified certificate by queuing additional asynchronous work requests according to one embodiment. For example, flow charts 400 and 500 may be implemented by Figure 1 The client-side hierarchical work ordering logic 110A shown in Figure 1 For ease of explanation, consider Figure 6 Flowcharts 400 and 500 are described with reference to a computing system 600 shown. Computing system 600 includes hierarchical work sequencing logic 610, which is an example implementation of client-side hierarchical work sequencing logic 110A, server-side hierarchical work sequencing logic 110B, or a combination thereof. Hierarchical work sequencing logic 610 includes determination logic 602, request logic 604, tree logic 606, and execution logic 608. Further structural and operational embodiments will be apparent to those skilled in the relevant art(s) based on the discussion of flowcharts 400 and 500.

[0060] like Figure 4As shown, the method of flowchart 400 begins at step 402. In step 402, a portion of work to be performed is determined to configure the device with a certificate based at least in part on a triggering event indicating that the device is to be configured. In an example implementation, determination logic 602 determines the portion of work to be performed to configure the device with a certificate based at least in part on a triggering event 612 indicating that the device is to be configured. Depending on the implementation, determination logic 602 may generate a work indicator 614 indicating the portion of work to be performed.

[0061] At step 404, an asynchronous work request is determined. The asynchronous work request is configured to initiate execution of a corresponding portion of the work when executed. The asynchronous work requests can be interrelated, meaning that the asynchronous work requests have a mutual or reciprocal relationship (e.g., based on being configured to facilitate initiating creation of one or more certificates). In an example implementation, request logic 604 determines asynchronous work request 616, which is configured to initiate execution of a corresponding portion of the work when executed. For example, request logic 604 can generate asynchronous work request 616. According to the implementation, request logic 614 can generate the asynchronous work request based at least in part on receiving work indicator 614 (e.g., based at least in part on work indicator 6.14 indicating a portion of the work to be performed).

[0062] At step 406, a hierarchical work tree is generated. The hierarchical work tree includes hierarchical nodes representing corresponding parts of the work. The hierarchical work tree defines the order in which the parts of the work are to be executed based at least in part on rules indicating conditions under which the parts of the work are to be executed. In an example implementation, the tree logic 606 generates a hierarchical work tree 618, which includes hierarchical nodes representing various parts of the work. The hierarchical work tree 618 defines the execution order of the parts of the work. According to the implementation, the tree logic 606 may generate the hierarchical work tree 618 based at least in part on receiving the work indicator 614 (e.g., based at least in part on the work indicator 6.14 indicating the parts of the work to be executed). For example, the tree logic 606 may analyze the parts of the work indicated by the work indicator 614 to determine the dependencies between the parts of the work. According to this example, the tree logic 606 may determine each part of the work that has a dependency and the part of the work that the part has a dependency. Further according to this example, the tree logic 606 may determine the order in which the parts of the work are to be executed based at least in part on the dependencies determined by the tree logic 607. For example, the rules may indicate that each portion of the work that has a dependency on another portion of the work must not be executed until the other portion of the work is completed. Thus, tree logic 606 may apply the rules to the portions of the work based at least in part on the knowledge of the dependencies to determine the order in which the portions of the work are to be executed. Tree logic 606 may arrange the nodes of hierarchical work tree 618 to reflect the order.

[0063] At step 408, the asynchronous work request is executed in the order defined by the hierarchical work tree, which initiates the creation of the certificate and the delivery of the certificate to the device. For example, executing the asynchronous work request at step 408 may cause one or more certificates to be created. In an example implementation, the execution logic 608 executes the asynchronous work request 616 in the order defined by the hierarchical work tree 618. For example, the execution 616 of the asynchronous work request may include generating a certificate creation instruction 620, which instructs the certificate generator (e.g., certificate generator 112) to create a certificate. It can be appreciated that the execution logic 608 can generate a certificate creation instruction 620 for each certificate. The execution logic 608 can generate a creation notification 622 to notify the determination logic 602 that the creation of the certificate has been initiated. It can be appreciated that the execution logic 608 can provide a creation notification 622 for each certificate, notifying the determination logic 602 that the creation of the corresponding certificate has been initiated (e.g., requested).

[0064] In an example embodiment, determining the portion of work in step 402 includes determining, based at least in part on the triggering event, a subset of work to be performed to configure the device with the corresponding certificate. According to this embodiment, each subset of work includes multiple portions of work. Further according to this embodiment, the hierarchical work tree defines an order in which the subsets of work are to be performed based at least in part on a rule indicating a condition under which the subsets of work are to be performed.

[0065] According to this embodiment, determining a subset of work may include determining a first subset and a second subset of work to be performed to configure the device to have corresponding first and second certificates. According to this embodiment, the rules may indicate that after completing the portion of the work included in the second subset based at least in part on the first subset being dependent on the second subset (e.g., based at least in part on at least a portion of the work in the first subset being dependent on at least a portion of the work in the second subset), initiating execution of the portion of the work included in the first subset. If an attempt to execute a subset of the work fails, a report may be generated to notify an IT administrator that the attempt failed and / or that execution of the subset may be automatically attempted again (e.g., independent of other subsets of work).

[0066] In another example embodiment, determining the portion of work in step 402 includes determining a specified portion of the work based at least in part on a triggering event, the specified portion of the work to be executed to configure the device to have a specified certificate. According to this embodiment, generating an asynchronous work request in step 404 includes generating a specified asynchronous work request, the asynchronous work request being configured to initiate execution of a corresponding specified portion of the work when executed. Further according to this embodiment, a specific asynchronous work request included in the specified asynchronous work request is configured to, when executed, initiate a notification to a device user of an action to be performed by the user based at least in part on the execution of an action that is a prerequisite for creating the specified certificate. Further according to this embodiment, executing the asynchronous work request in sequence in step 408 includes stopping execution of the specified asynchronous work request to wait for execution of the action, and also includes resuming execution of the specified asynchronous work request based at least in part on execution of the action. Execution of the specified asynchronous work request will initiate creation of the specified certificate and delivery of the specified certificate to the device.

[0067] It should be noted that if a user notification cannot be initiated or the execution of the action does not occur, the hole can notify the IT administrator of this information. For example, the execution logic 608 can notify the IT administrator. The user's notifications can be tracked and orchestrated in a similar manner to the certificates described herein. For example, the determination logic 602 can track and orchestrate these notifications.

[0068] In some exemplary embodiments, one or more steps 402, 404, 406, and / or 408 of flowchart 400 may not be performed. In addition, steps other than steps 402, 404, 406, and / or 408 or steps in place of steps 402, 404, 406, and 408 may also be performed. For example, in an exemplary embodiment, the triggering event indicates that the device is to be configured to access a WiFi network. According to the present embodiment, the method of flowchart 400 also includes providing a WiFi profile to the device. For example, execution logic 608 may provide a WiFi profile to the device. The WiFi profile indicates (e.g., a specific) configuration setting with which the device is configured to access a WiFi network. For example, the WiFi profile may indicate a service set identifier (SSID) with which the device will access the WiFi network. According to the present embodiment, the configuration setting indicates that a certificate will be used to authenticate the user to the WiFi network. Further according to the present embodiment, the method of flowchart 400 also includes configuring the device to access the WiFi network by associating a specific certificate contained in the certificate with the WiFi profile, which configures the device to authenticate the user to the WiFi network according to the configuration setting using the specific certificate. For example, execution logic 608 may configure the device to access a WiFi network.

[0069] In another example embodiment, the triggering event indicates that the device is to be configured to access a private computer network using a virtual private network (VPN). According to this embodiment, the method of flowchart 400 also includes providing a VPN profile to the device. For example, execution logic 608 can provide a VPN profile to the device. The VPN profile specifies the configuration of the VPN. The configuration of the VPN indicates that a certificate will be used to authenticate the user to the VPN. Further according to this embodiment, the method of flowchart 400 also includes configuring the device to access the private computer network using the VPN by associating a specific certificate contained in the certificate with the VPN profile, which configures the device to authenticate the user to the VPN using a specific certificate according to the configuration of the VPN. For example, execution logic 608 can configure the device to access the private computer network using the VPN.

[0070] In another example embodiment, the trigger event indicates that the device is to be configured to use an email program. According to the present embodiment, the method of flow chart 400 also includes providing an email profile to the device. For example, execution logic 608 can provide an email profile to the device. The configuration of the specific email program of the email profile. The configuration indication of the email program will use a certificate to authenticate the user to the email program. Further according to the present embodiment, the method of flow chart 400 also includes configuring the device to utilize the email program by associating the specific certificate contained in the certificate with the email profile, and it configures the device to use a specific certificate to authenticate the user to the email program according to the configuration of the email program. For example, execution logic 608 can configure the device to utilize the email program. It can be recognized that the device can be configured to use a specific certificate or other certificates to sign and / or encrypt emails. For example, the device can be notified that such certificates are to be used to sign and / or encrypt emails. Any certificate that the device is configured to use with respect to the email program can be configured to comply with the security / multipurpose network mail extension (S / MIME) standard.

[0071] It will be appreciated that the relationship between a certificate (e.g., a certificate profile) and a device profile (e.g., a WiFi profile, a VPN profile, or an email profile) can be encoded. For example, the relationship can be encoded in an algorithm used to configure a device.

[0072] In another example embodiment, the method of flowchart 400 includes initiating creation of a specific certificate contained within the certificates in a first workflow, the first workflow including a first portion of work that is dependent on a subset of the portion of work used to create the specific certificate. For example, execution logic 608 may initiate creation of the specific certificate in the first workflow. According to this embodiment, the method of flowchart 400 also includes initiating creation of the specific certificate for it in the first workflow, rather than initiating re-creation of the specific certificate in a second workflow, the second workflow including a second portion of work that is dependent on a subset of the portion of work. For example, execution logic 608 may initiate creation of the specific certificate for it in the first workflow, rather than initiating re-creation of the specific certificate in the second workflow.

[0073] like Figure 5 As shown, the method of flowchart 500 begins at step 502. In step 502, the status of a specified certificate contained in the certificate is monitored over time based at least in part on the specified certificate created and delivered to the device, and at least in part on metadata associated with the specified certificate. For example, the metadata may indicate the status of the specified certificate. In an example implementation, determination logic 602 monitors the status of the specified certificate over time based at least in part on the specified certificate created and delivered to the device, and further based at least in part on certificate metadata 624 associated with the specified certificate. For example, determination logic 602 may monitor the status of the specified certificate based at least in part on certificate metadata 624 indicating the status of the specified certificate.

[0074] At step 504, a portion of additional work is determined to be performed to change the state of the specified certificate from the first state to the predefined second state. The above determination is performed at least in part based on metadata associated with the specified certificate (the metadata indicates that the specified certificate is in the first state), and further at least in part based on metadata related to the specified certificate indicating that one or more criteria for changing the state of the specified certificate from the first state to the predefined second state are satisfied. For example, the determination can be performed at least in part based on configuration changes made by an IT administrator. The additional work may include renewing, revoking, reviewing and / or reporting the specified certificate. In an example implementation, the determination logic 602 determines the portion of additional work to be performed to change the state of the specified certificate from the first state to the predefined second state based at least in part on certificate metadata 624 indicating that the specified certificate is in the first state, and further at least in part on certificate metadata 624 indicating that one or more criteria for changing the state of the specified certificate from the first state to the predefined second state are satisfied. According to the implementation, the determination logic 602 can generate a work indicator 614 indicating the portion of additional work to be performed.

[0075] At step 506, additional asynchronous work requests are generated. The additional asynchronous work requests are configured to initiate execution of the corresponding portion of the additional work when executed. In one example implementation, request logic 604 generates the additional asynchronous work requests. For example, the additional asynchronous work requests may be included in asynchronous work requests 616. According to this implementation, request logic 604 may generate additional asynchronous work requests 616 based at least in part on receiving work indicators 614 (e.g., based at least in part on work indicators 614 indicating the portion of the additional work to be performed).

[0076] At step 508, a second hierarchical work tree is generated. The second hierarchical work tree includes a second hierarchical node, which represents a corresponding portion of the additional work. The second hierarchical work tree defines the order in which the portions of the additional work are to be executed based at least in part on a second rule indicating a condition under which the portion of the additional work is to be executed. In an example implementation, the tree logic 606 generates the second hierarchical work tree. According to the implementation, the tree logic 606 may generate the second hierarchical work tree based at least in part on the received work indicator 614 (e.g., based at least in part on the work indicator 614 indicating the portion of the additional work to be executed). For example, the tree logic 606 may analyze the portion of the additional work indicated by the work indicator 614 to determine the dependency between the portions of the additional work. According to this example, the tree logic 606 may determine each portion of the additional work that has a dependency, and the portion of the additional work that the portion has a dependency. Further according to this example, the tree logic 606 may determine the order in which the portions of the additional work are to be executed based at least in part on the dependency determined by the tree logic 607. For example, the rule may indicate that each portion of the additional work that depends on the other portion of the additional work must not be executed before another portion of the additional work is executed. Thus, tree logic 606 may apply the rule to the portions of the additional work based at least in part on the dependency knowledge to determine the order in which the portions of the additional work are to be performed.Tree logic 606 may arrange the nodes of the second hierarchical work tree to reflect the order.

[0077] At step 510, the additional asynchronous work requests are executed in the order defined by the second hierarchical work tree, which changes the state of the specified certificate from the first state to a predefined second state. In one example implementation, execution logic 608 executes the additional asynchronous work requests in the order defined by the second hierarchical work tree.

[0078] In one example embodiment, the first state is characterized by the specified certificate expiring or about to expire within a threshold time period, and the predefined second state is characterized by the specified certificate being renewed. According to this embodiment, the portion of the additional work to be performed at step 504 is determined to be based at least in part on metadata associated with the specified certificate indicating that the specified certificate has expired or will expire within a threshold time period, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for renewing the specified certificate are met. Further according to this embodiment, executing the additional asynchronous work request at step 510 causes the specified certificate to be renewed.

[0079] It will be appreciated that expired certificates may be maintained (e.g., stored) on the device and / or other devices. For example, maintaining expired certificates in this manner may enable e-mails encrypted with expired certificates to be retrieved and read.

[0080] In another example embodiment, the first state is characterized by the specified certificate being available for use by the device, and the predefined second state is characterized by the specified certificate being revoked. According to this embodiment, determining at step 504 the portion of the additional work to be performed is based at least in part on metadata associated with the specified certificate indicating that the specified certificate is available for use by the device, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for revoking the specified certificate are met. Further according to this embodiment, executing the additional asynchronous work request at step 510 causes the specified certificate to be revoked.

[0081] In some exemplary embodiments, one or more steps 502, 504, 506, 508, and / or 510 of flowchart 500 may not be performed. In addition, steps other than or in place of steps 502, 504, 506, 508, and / or 510 may be performed.

[0082] It can be appreciated that computing system 600 may not include one or more of determination logic 602, request logic 604, tree logic 606, execution logic 608, and / or hierarchical work sequencing logic 610. Furthermore, computing system 60 may include components in addition to or in place of determination logic 604, request logic 60, tree logic 60, execution logic 60, and / or hierarchical work sequencing logic 610.

[0083] Although the operations of some methods in the disclosed method are described in a specific order for the convenience of presentation, it should be understood that this description includes rearrangement unless the specific language described herein requires a specific order. For example, in some cases, the operations described in sequence can be rearranged or performed concurrently. In addition, for simplicity, the accompanying drawings may not show the various ways in which the disclosed method can be used in combination with other methods. It can be recognized that the parts of the work represented by the various hierarchical nodes of the hierarchical work tree will be executed in the order defined by the hierarchical work tree. Therefore, the asynchronous work request configured to initiate the execution of the corresponding part of the work when executed will be executed in the order defined by the hierarchical work tree.

[0084] Any one or more of the client-side hierarchical work sequencing logic 110A, the server-side hierarchical work sequencing logic 110B, the certificate generator 112, the hierarchical work sequencing logic 210, the certificate generator 212, the configuration logic 214, the CMS 216, the work processor 218, the determination logic 602, the request logic 604, the tree logic 606, the execution logic 608, the hierarchical work sequencing logic 610, the activity diagram 200, the flowchart 400 and / or the flowchart 500 may be implemented in hardware, software, firmware or any combination thereof.

[0085] For example, any one or more of the client-side hierarchical work sequencing logic 110A, the server-side hierarchical work sequencing logic 110B, the certificate generator 112, the hierarchical work sequencing logic 210, the certificate generator 212, the configuration logic 214, the CMS 216, the work processor 218, the determination logic 602, the request logic 604, the tree logic 606, the execution logic 608, the hierarchical work sequencing logic 610, the activity diagram 200, the flowchart 400 and / or the flowchart 500 can be at least partially implemented as computer program code configured to be executed in one or more processors.

[0086] In another example, any one or more of the client-side hierarchical work ordering logic 110A, the server-side hierarchical work ordering logic 110B, the certificate generator 112, the hierarchical work ordering logic 210, the certificate generator 212, the configuration logic 214, the CMS 216, the work processor 218, the determination logic 602, the request logic 604, the tree logic 606, the execution logic 608, the hierarchical work ordering logic 610, the activity diagram 200, the flowchart 400 and / or the flowchart 500 can be implemented at least in part as hardware logic / circuitry. Such hardware logic / circuitry may include one or more hardware logic components. Examples of hardware logic components include, but are not limited to, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chips (SoCs), complex programmable logic devices (CPLDs), etc. For example, an SoC may include an integrated circuit chip that includes one or more processors in a processor (e.g., a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces and / or other circuits and / or embedded firmware to perform its functions.

[0087] III. Further Discussion of Some Example Embodiments

[0088] The example system includes a memory and one or more processors coupled to the memory. The one or more processors are configured to determine multiple parts of work based at least in part on a triggering event indicating that the device is to be configured, and the multiple parts of the work are to be executed to configure the device to have one or more certificates. The one or more processors are also configured to generate multiple asynchronous work requests, and the asynchronous work requests are configured to initiate the execution of the corresponding parts of the work when executed. The one or more processors are also configured to generate a hierarchical work tree, and the hierarchical work tree includes multiple hierarchical nodes representing the corresponding parts of the work. The hierarchical work tree defines the order in which the parts of the work are to be executed based at least in part on rules indicating the conditions under which the parts of the work are to be executed. The one or more processors are also configured to execute the asynchronous work requests in the order defined by the hierarchical work tree, which will initiate the creation of one or more certificates, and the delivery of one or more certificates to the device.

[0089] In a first aspect of the example system, one or more processors are configured to determine, based at least in part on a triggering event, a plurality of subsets of work to be performed to configure a device to have a plurality of corresponding certificates, each subset of work comprising a plurality of portions of the work. According to the first aspect, a hierarchical work tree defines an order in which the subsets of work are to be performed based at least in part on a rule indicating a condition under which the subsets of work are to be performed.

[0090] In an implementation of the first aspect of the example system, one or more processors are configured to determine a first subset of work to be performed to configure the device with a first certificate. According to the implementation, the one or more processors are configured to determine a second subset of work to be performed to configure the device with a second certificate. According to this embodiment, the rule indicates that after the first subset is dependent on the second subset to complete the portion of the work included in the second subset, the execution of the portion of the work included in the first subset is initiated.

[0091] In a second aspect of the example system, one or more processors are configured to determine, based at least in part on a triggering event, a specified portion of work to be executed to configure the device with a specified certificate. According to the second aspect, one or more processors are configured to generate a specified asynchronous work request, which is configured to initiate the execution of the corresponding specified portion of the work when executed. According to the second aspect, a specific asynchronous work request contained in the specified asynchronous work request is configured to initiate a notification to a user of the device of an action to be performed by the user when executed, based at least in part on the execution of an action that is a prerequisite for creating a specified certificate. According to the second aspect, the one or more processors are also configured to stop executing the specified asynchronous work request to wait for the execution of the action. According to the second aspect, the one or more processors are also configured to resume the execution of the specified asynchronous work request based at least in part on the execution of the action, wherein the execution of the specified asynchronous work request will initiate the creation of the specified certificate and the delivery of the specified certificate to the device. The second aspect of the example system can be implemented in combination with the first aspect of the example system, although the example embodiments are not limited in this respect.

[0092] In a third aspect of the example system, the one or more processors are further configured to monitor the state of the specified certificate over time based at least in part on a specified certificate included in one or more certificates created and delivered to the device, and further based at least in part on metadata associated with the specified certificate. According to the third aspect, the one or more processors are further configured to: determine multiple parts of additional work to be executed to change the state of the specified certificate from the first state to the predefined second state based at least in part on metadata associated with the specified certificate indicating that the specified certificate is in a first state, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for changing the state of the specified certificate from the first state to the predefined second state are satisfied. Further according to the third aspect, the one or more processors are further configured to: generate multiple additional asynchronous work requests, and the multiple additional asynchronous work requests are configured to initiate the execution of corresponding parts of the additional work when executed. Further according to the third aspect, the one or more processors are further configured to generate a second hierarchical work tree, the second hierarchical work tree including multiple second hierarchical nodes representing corresponding parts of the additional work. The second hierarchical work tree defines the order in which the parts of the additional work are to be executed based at least in part on a second rule indicating the conditions under which the parts of the additional work are to be executed. According further to the third aspect, the one or more processors are further configured to execute additional asynchronous work requests in an order defined by the second hierarchical work tree, which changes the state of the specified certificate from the first state to a predefined second state. The third aspect of the example system may be implemented in conjunction with the first and / or second aspects of the example system, although the example embodiments are not limited in this respect.

[0093] In a first implementation of the third aspect of the example system, one or more processors are configured to: determine, based at least in part on metadata associated with the specified certificate indicating that the specified certificate is expired or about to expire, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for renewing the specified certificate are satisfied, multiple portions of additional work to be performed to change the state of the specified certificate from a first state in which the specified certificate is expired or about to expire to a predefined second state in which the specified certificate is renewed. According to this implementation, the one or more processors are configured to cause the specified certificate to be renewed by executing an additional asynchronous work request.

[0094] In a second implementation of the third aspect of the example system, one or more processors are configured to: determine, based at least in part on metadata associated with the specified certificate indicating that the specified certificate is available for use by the device, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for revoking the specified certificate are satisfied, multiple portions of additional work to be performed to change the state of the specified certificate from a first state in which the specified certificate is available for use by the device to a predefined second state in which the specified certificate is revoked. According to this implementation, the one or more processors are configured to cause the specified certificate to be revoked by executing an additional asynchronous work request.

[0095] In a fourth aspect of the example system, a triggering event indicates that the device is to be configured to access a WiFi network. According to the fourth aspect, one or more processors are further configured to provide a WiFi profile to the device. The WiFi profile specifies configuration settings, and the device is configured to access the WiFi network using the configuration settings. The configuration settings indicate that a certificate is to be used to authenticate the user to the WiFi network. Further according to the fourth aspect, the one or more processors are also configured to configure the device to access the WiFi network by associating a specific certificate of one or more certificates with the WiFi profile, which configures the device to use a specific certificate to authenticate the user to the WiFi network according to the configuration settings. The fourth aspect of the example system can be implemented in combination with the first, second, and / or third aspects of the example system, although the example embodiments are not limited in this respect.

[0096] In a fifth aspect of the example system, a triggering event indicates that the device is to be configured to access a private computer network using a virtual private network (VPN). According to the fifth aspect, one or more processors are also configured to provide a VPN profile to the device. The VPN profile specifies the configuration of the VPN. The configuration of the VPN indicates that a certificate is to be used to authenticate the user to the VPN. According to the fifth aspect, the one or more processors are also configured to configure the device to access the private computer network using the VPN by associating a specific certificate of one or more certificates with the VPN profile, which configures the device to use a specified certificate to authenticate the user to the VPN according to the configuration of the VPN. The fifth aspect of the example system can be implemented in combination with the first, second, third and / or fourth aspects of the example system, although the example embodiments are not limited in this respect.

[0097] In a sixth aspect of the example system, the triggering event indicates that the device is to be configured to use an email program. According to the sixth aspect, one or more processors are further configured to provide an email configuration file to the device. The email configuration file specifies the configuration of the email program. The configuration of the email program indicates that a certificate is to be used to authenticate a user to the email program. Further according to the sixth aspect, one or more processors are further configured to configure the device to utilize the email program by associating a specific certificate of one or more certificates with the email configuration file, which configures the device to use a specific certificate to authenticate a user to the email program according to the configuration of the email program. The sixth aspect of the example system can be implemented in combination with the first, second, third, fourth and / or fifth aspects of the example system, although the example embodiments are not limited in this respect.

[0098] In a seventh aspect of the example system, one or more processors are configured to initiate creation of a specific certificate of one or more certificates in a first workflow, the first workflow comprising a first portion of work that is dependent on a subset of the portion of work used to create the specific certificate. According to the seventh aspect, the one or more processors are configured to use the specific certificate for which creation was initiated in the first workflow, rather than initiating re-creation of the specific certificate in a second workflow, the second workflow comprising a second portion of work that is dependent on the subset of the portion of work. The seventh aspect of the example system can be implemented in combination with the first, second, third, fourth, fifth and / or sixth aspects of the example system, although the example embodiments are not limited in this respect.

[0099] In one example method, multiple portions of work to be performed in order to configure a device to have one or more certificates are determined based at least in part on a triggering event indicating that the device is to be configured. Multiple asynchronous work requests are configured to initiate execution of corresponding portions of the work when executed. A hierarchical work tree is generated, the hierarchical work tree including multiple hierarchical nodes representing corresponding portions of the work. The hierarchical work tree defines an order in which the portions of the work are to be performed based at least in part on rules indicating conditions under which portions of the work are to be performed. The asynchronous work requests are executed in an order defined by the hierarchical work tree, which initiates the creation of one or more certificates, and the delivery of the one or more certificates to the device.

[0100] In a first aspect of the example method, determining the plurality of portions of work includes determining, based at least in part on the triggering event, a plurality of subsets of work to be performed to configure the device with a plurality of corresponding certificates, each subset of work including the plurality of portions of work. According to the first aspect, the hierarchical work tree defines an order in which the subsets of work are to be performed based at least in part on rules indicating conditions under which the subsets of work are to be performed.

[0101] In an implementation of the first aspect of the example method, determining the subset of work includes determining a first subset of work to be performed to configure the device with the first certificate, and determining a second subset of work to be performed to configure the device with the second certificate. According to this embodiment, the rule indicates that after the first subset is dependent on the second subset to complete the execution of the portion of the work included in the second subset, the execution of the portion of the work included in the first subset is initiated.

[0102] In a second aspect of the example method, determining a plurality of portions of work includes determining a specified portion of work to be executed to configure the device with a specified certificate based at least in part on a triggering event. According to the second aspect, generating a plurality of asynchronous work requests includes generating a specified asynchronous work request, the asynchronous work request being configured to initiate execution of a corresponding specified portion of the work when executed. Further according to the second aspect, a specific asynchronous work request contained in the specified asynchronous work request is configured to initiate, when executed, a notification to a user of the device that an action will be performed by the user based at least in part on the execution of an action that is a prerequisite for creating the specified certificate. Further according to the second aspect, executing the asynchronous work request in sequence includes stopping execution of the specified asynchronous work request to wait for execution of the action. Further according to the second aspect, executing the asynchronous work request in sequence includes resuming execution of the specified asynchronous work request based at least in part on the execution of the action. Further according to the second aspect, execution of the specified asynchronous work request will initiate creation of a specified certificate, and delivery of the specified certificate to the device. The second aspect of the example method may be implemented in conjunction with the first aspect of the example method, although the example embodiments are not limited in this respect.

[0103] In a third aspect of the example method, the example method further includes monitoring the state of the specified certificate over time based at least in part on a specified certificate included in one or more certificates created and delivered to the device, and based at least in part on metadata associated with the specified certificate. According to the third aspect, the example method further includes: based at least in part on metadata associated with the specified certificate indicating that the specified certificate is in a first state, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for changing the state of the specified certificate from the first state to a predefined second state are satisfied, determining multiple parts of additional work, the multiple parts of the additional work are to be executed to change the state of the specified certificate from the first state to the predefined second state. Further according to the third aspect, the example method further includes generating multiple additional asynchronous work requests, the multiple additional asynchronous work requests being configured to initiate execution of corresponding parts of the additional work when executed. Further according to the third aspect, the example method further includes generating a second hierarchical work tree, the second hierarchical tree including multiple second hierarchical nodes representing corresponding parts of the additional work. The second hierarchical work tree defines the order in which the parts of the additional work are to be executed based at least in part on rules indicating conditions under which the parts of the additional work are to be executed. According to the third aspect, the example method further includes executing additional asynchronous work requests in an order defined by the second hierarchical work tree, thereby changing the state of the specified certificate from the first state to a predefined second state. The third aspect of the example method can be implemented in conjunction with the first and / or second aspects of the example method, although the example embodiments are not limited in this respect.

[0104] In a first implementation of the third aspect of the example method, determining portions of additional work to be performed includes: determining portions of additional work to be performed to change a state of the specified certificate from a first state in which the specified certificate is expired or about to expire to a predefined second state in which the specified certificate is renewed based at least in part on metadata associated with the specified certificate indicating that the specified certificate is expired or about to expire, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for renewing the specified certificate are satisfied. According to the first implementation, executing the additional asynchronous work request causes the specified certificate to be renewed.

[0105] In a second implementation of the third aspect of the example method, determining portions of additional work to be performed includes: based at least in part on metadata associated with the specified certificate indicating that the specified certificate is available for use by the device, and further based at least in part on metadata associated with the specified certificate indicating that one or more criteria for revoking the specified certificate are satisfied, determining portions of additional work to be performed to change a state of the specified certificate from a first state in which the specified certificate is available for use by the device to a predefined second state in which the specified certificate is revoked. According to the second implementation, the additional asynchronous work request is performed to cause the specified certificate to be revoked.

[0106] In a fourth aspect of the example method, the triggering event indicates that the device is to be configured to access a WiFi network. According to the fourth aspect, the example method also includes providing a WiFi profile to the device. The WiFi profile specifies configuration settings, and the device is configured to access the WiFi network using the configuration settings. The configuration settings indicate that a certificate is to be used to authenticate the user to the WiFi network. Further according to the fourth aspect, the example method also includes configuring the device to access the WiFi network by associating a specific certificate of one or more certificates with the WiFi profile, which configures the device to use a specific certificate to authenticate the user to the WiFi network according to the configuration settings. The fourth aspect of the example method can be implemented in combination with the first, second and / or third aspects of the example method, although the example embodiments are not limited in this respect.

[0107] In a fifth aspect of the example method, a triggering event indicates that the device is to be configured to access a private computer network using a virtual private network (VPN). According to the fifth aspect, the example method also includes providing a VPN profile to the device. The VPN profile specifies the configuration of the VPN. The configuration of the VPN indicates that a certificate is to be used to authenticate the user to the VPN. Further according to the fifth aspect, the example method also includes configuring the device to access the private computer network using the VPN by associating a specific certificate of one or more certificates with the VPN profile, which configures the device to authenticate the user to the VPN using a specified certificate according to the configuration of the VPN. The fifth aspect of the example method can be implemented in combination with the first, second, third and / or fourth aspects of the example method, although the example embodiments are not limited in this respect.

[0108] In a sixth aspect of the example method, the triggering event indicates that the device is to be configured to utilize an email program. According to the sixth aspect, the example method also includes providing an email profile to the device. The email profile specifies the configuration of the email program. The configuration of the email program indicates that a certificate is to be used to authenticate the user to the email program. Further according to the sixth aspect, the example method also includes configuring the device to utilize the email program by associating a specific certificate of one or more certificates with the email profile, which configures the device to use a specific certificate to authenticate the user to the email program according to the configuration of the email program. The sixth aspect of the example method can be implemented in combination with the first, second, third, fourth and / or fifth aspects of the example method, although the example embodiments are not limited in this respect.

[0109] In a seventh aspect of the example method, the example method includes initiating creation of a specific certificate of one or more certificates in a first workflow, the first workflow including a first portion of work, the first portion of work being dependent on a subset of the portion of work used to create the specific certificate. According to the seventh aspect, the example method includes utilizing the specified certificate for which creation was initiated in the first workflow, rather than initiating re-creation of the specified certificate in a second workflow, the second workflow including a second portion of work, the second portion of work being dependent on the subset of the portion of work. The seventh aspect of the example method may be implemented in conjunction with the first, second, third, fourth, fifth and / or sixth aspects of the example method, although the example embodiments are not limited in this respect.

[0110] An example computer program product includes a computer-readable storage medium having recorded thereon instructions for enabling a processor-based system to perform operations. The operations include determining multiple parts of work based at least in part on a triggering event indicating that a device is to be configured, the multiple parts of work to be executed to configure the device to have one or more certificates. The operations also include generating multiple asynchronous work requests, which are configured to initiate the execution of corresponding parts of the work when executed. The operations also include generating a hierarchical work tree, the hierarchical work tree including multiple hierarchical nodes representing corresponding parts of the work. The hierarchical work tree defines the order in which the parts of the work are to be executed based at least in part on rules indicating conditions under which the parts of the work are to be executed. The operations also include initiating the creation of one or more certificates and delivering the one or more certificates to the device by executing the asynchronous work requests in an order defined by the hierarchical work tree to configure the device.

[0111] 4. Computer System Example

[0112] Figure 7 An example computer 700 is depicted in which embodiments may be implemented. Figure 1Any one or more of the user devices 102A-102M, any one or more of the servers 106A-106N, and / or the management system 108 shown in FIG. Figure 2 The client device 202 shown in FIG. 1 ; and / or Figure 6 The computing system 600 shown in the figure can be implemented using a computer 700, including one or more features and / or alternative features of the computer 700. The computer 700 can be a general-purpose computing device in the form of a conventional personal computer, a mobile computer, or a workstation, or the computer 700 can be a special-purpose computing device. The description of the computer 700 provided herein is for illustrative purposes and is not provided for the purpose of limitation. The embodiments can be implemented in more types of computer systems, which will be known to those skilled in the relevant art.

[0113] like Figure 7 As shown, computer 700 includes a processing unit 702, a system memory 704, and a bus 706 that couples various system components (including system memory 704) to the processing unit 702. Bus 706 represents any one or more of several bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. System memory 704 includes read-only memory (ROM) 708 and random access memory (RAM) 710. Basic input / output system 712 (BIOS) is stored in ROM 708.

[0114] The computer 700 also has one or more of the following drives: a hard disk drive 714 for reading and writing to a hard disk, a disk drive 716 for reading and writing to a removable disk 718, and an optical drive 720 for reading and writing to a removable optical disk 722 such as a CD ROM, DVD ROM or other optical disk media. The hard disk drive 714, the disk drive 716 and the optical drive 720 are connected to the bus 706 via a hard disk drive interface 724, a disk drive interface 726 and an optical drive interface 728, respectively. The drives and their associated computer-readable storage media provide non-volatile storage of computer-readable instructions, data structures, program modules and other data for the computer. Although a hard disk, a removable disk and a removable optical disk are described, other types of computer-readable storage media can be used to store data, such as flash memory cards, digital video disks, random access memory (RAM), read-only memory (ROM), etc.

[0115] Many program modules may be stored on a hard disk, a disk, an optical disk, a ROM, or a RAM. These programs include an operating system 730, one or more application programs 732, other program modules 734, and program data 736. Application programs 732 or program modules 734 may include, for example, a client-side hierarchical work ordering logic 110A, a server-side hierarchical work ordering logic 110B, a certificate generator 112, a hierarchical work ordering logic 210, a certificate generator 212, a configuration logic 214, a CMS 216, a work processor 218, a determination logic 602, a request logic 604, a tree logic 606, an execution logic 608, a hierarchical work ordering logic 610, an activity diagram 200 (including any activity of the activity diagram 200), a flowchart 400 (including any steps of the flowchart 400), and / or a flowchart 500 (including any steps of the flowchart 500) as described herein.

[0116] A user may enter commands and information into the computer 700 through input devices such as a keyboard 738 and pointing device 740. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, touch screen, camera, accelerometers, gyroscopes, etc. These and other input devices are typically connected to the processing unit 702 through a serial port interface 742 connected to the bus 706, but may be connected by other interfaces such as a parallel port, game port or a universal serial bus (USB).

[0117] A display device 744 (eg, a monitor) is also connected to bus 706 via an interface, such as a video adapter 746. In addition to display device 744, computer 700 may also include other peripheral output devices (not shown), such as speakers and printers.

[0118] The computer 700 is connected to a network 748 (eg, the Internet) via a network interface or adapter 750, a modem 752, or other means of establishing communications over the network. The modem 752 may be internal or external and is connected to the bus 706 via the serial port interface 742.

[0119] As used herein, the terms "computer program medium" and "computer readable storage medium" generally refer to media (e.g., non-transitory media) such as hard disks associated with hard disk drives 714, removable disks 718, removable optical disks 722, and other media such as flash memory cards, digital video disks, random access memory (RAM), read-only memory (ROM), etc. A computer readable storage medium is not a signal such as a carrier signal or a propagating signal. For example, a computer readable storage medium may not include a signal. Therefore, a computer readable storage medium itself does not constitute a signal. A computer readable storage medium is distinct from a communication medium and does not overlap with (do not include) a communication medium. A communication medium contains computer readable instructions, data structures, program modules, or other data in a modulated data signal (such as a carrier wave). The term "modulated data signal" refers to a signal having one or more characteristics, and the way in which one or more characteristics are set or changed can encode information in the signal. For example, but not limited to, communication media include wireless media such as acoustic, RF, infrared and other wireless media as well as wired media. Example embodiments are also directed to such communication media.

[0120] As described above, computer programs and modules (including application programs 732 and other program modules 734) can be stored on a hard disk, disk, optical disk, ROM or RAM. These computer programs can also be received through the network interface 750 or the serial port interface 742. When the application program executes or loads these computer programs, the computer 700 can implement the features of the embodiments discussed herein. Therefore, these computer programs represent the controller of the computer 700.

[0121] Example embodiments are also directed to a computer program product comprising software (e.g., computer-readable instructions) stored on any computer-usable medium. When the software is executed in one or more data processing devices, the data processing devices are caused to operate as described herein. Embodiments may use any computer-usable or computer-readable medium known now or in the future. Examples of computer-readable media include, but are not limited to, storage devices such as RAM, hard drives, floppy disks, CD-ROMs, DVD ROMs, compressed disks, magnetic tapes, magnetic storage devices, optical storage devices, MEMS-based storage devices, nanotechnology-based storage devices, and the like.

[0122] It should be appreciated that the disclosed technology is not limited to any particular computer or hardware type. Certain details of suitable computers and hardware are well known and need not be elaborated in the present invention.

[0123] V. Conclusion

[0124] Although the technical solution has been described in language specific to structural features and / or behaviors, it should be understood that the technical solution defined in the appended claims is not necessarily limited to the specific features or behaviors described above. On the contrary, the specific features and behaviors described above are disclosed as examples of implementing the claims, and other equivalent features and behaviors are also intended to be within the scope of the claims.

Claims

1. A system comprising: Memory; as well as One or more processors, coupled to the memory, the one or more processors configured to: determining, based at least in part on a triggering event indicating that a device is to be configured, a plurality of portions of work to be performed to configure the device with one or more credentials; generating a plurality of asynchronous work requests, the plurality of asynchronous work requests being configured to initiate execution of respective portions of the work when executed; generating a hierarchical work tree, the hierarchical work tree comprising a plurality of hierarchical nodes representing respective portions of the work, the hierarchical work tree defining an order in which the portions of the work are to be performed based at least in part on rules indicating conditions under which the portions of the work are to be performed; as well as The asynchronous work requests are executed in the order defined by the hierarchical work tree, initiating creation of the one or more credentials and delivery of the one or more credentials to the device.

2. The system of claim 1, wherein the one or more processors are configured to: determining, based at least in part on the triggering event, a plurality of subsets of the work to be performed to configure the device with a plurality of corresponding credentials, each subset of the work comprising a plurality of portions of the work; and Wherein the hierarchical work tree defines an order in which the subsets of the work are to be performed based at least in part on the rules indicating conditions under which the subsets of the work are to be performed.

3. The system of claim 2, wherein the one or more processors are configured to: determining a first subset of the work to be performed to configure the device with a first credential; as well as determining a second subset of the work to be performed to configure the device with a second credential; and Wherein the rule indicates that, based at least in part on the first subset being dependent on the second subset, execution of the portion of the work included in the first subset is to be initiated after execution of the portion of the work included in the second subset is completed.

4. The system of claim 1 , wherein the one or more processors are configured to: determining, based at least in part on the triggering event, a specified portion of the work to be performed to configure the device with specified credentials; generating a specified asynchronous work request, the specified asynchronous work request being configured to initiate execution of the corresponding specified portion of the work when executed, wherein a particular asynchronous work request included in the specified asynchronous work request is configured to, when executed, initiate notification to a user of the device that the action is to be performed by the user based at least in part on the performance of the action being a prerequisite to the creation of the specified certificate; Stop the execution of the specified asynchronous work request to wait for the execution of the action; as well as The execution of the specified asynchronous work request is resumed based at least in part on the execution of the action, wherein the execution of the specified asynchronous work request initiates the creation of the specified credential and the delivery of the specified credential to the device.

5. The system of claim 1 , wherein the one or more processors are further configured to: Based at least in part on a designated certificate being created and delivered to the device, and further based at least in part on metadata associated with the designated certificate, monitoring a status of the designated certificate over time, the designated certificate being included among the one or more certificates; determining, based at least in part on the metadata associated with the designated certificate indicating that the designated certificate is in a first state, and further based at least in part on the metadata associated with the designated certificate indicating that one or more criteria for changing the state of the designated certificate from the first state to a predefined second state are satisfied, a plurality of portions of additional work to be performed to change the state of the designated certificate from the first state to the predefined second state; generating a plurality of additional asynchronous work requests, the plurality of additional asynchronous work requests being configured to initiate execution of respective portions of the additional work when executed; generating a second hierarchical work tree including a plurality of second hierarchical nodes representing respective portions of the additional work, the second hierarchical work tree defining an order in which the portions of the additional work are to be performed based at least in part on a second rule indicating conditions under which the portions of the additional work are to be performed; as well as The additional asynchronous work requests are executed in the order defined by the second hierarchical work tree, which changes the state of the specified certificate from the first state to the predefined second state.

6. The system of claim 5, wherein the one or more processors are configured to: determining, based at least in part on the metadata associated with the specified certificate indicating that the specified certificate is expired or about to expire, and further based at least in part on the metadata associated with the specified certificate indicating that the one or more criteria for renewing the specified certificate are satisfied, the plurality of portions of the additional work to be performed to change the state of the specified certificate from the first state in which the specified certificate is expired or about to expire to the predefined second state in which the specified certificate is renewed; and The specified certificate is caused to be renewed by executing the additional asynchronous work request.

7. The system of claim 5, wherein the one or more processors are configured to: determining, based at least in part on the metadata associated with the specified certificate indicating that the specified certificate is available for use by the device, and further based at least in part on the metadata associated with the specified certificate indicating that the one or more criteria for revoking the specified certificate are satisfied, the plurality of portions of the additional work to be performed to change the state of the specified certificate from the first state in which the specified certificate is available for use by the device to the predefined second state in which the specified certificate is revoked; and The specified certificate is caused to be revoked by executing the additional asynchronous work request.

8. The system of claim 1, wherein the triggering event indicates that the device is to be configured to access a WiFi network; and The one or more processors are further configured to: providing a WiFi profile to the device, the WiFi profile specifying configuration settings, the device being configured to access the WiFi network using the configuration settings, the configuration settings indicating that credentials are to be used to authenticate a user to the WiFi network; and The device is configured to access the WiFi network by associating a specific certificate of the one or more certificates with the WiFi profile, which configures the device to authenticate the user to the WiFi network using the specific certificate according to the configuration settings.

9. The system of claim 1, wherein the triggering event indicates that the device is to be configured to access a private computer network using a virtual private network (VPN); and The one or more processors are further configured to: providing a VPN profile to the device, the VPN profile specifying a configuration of the VPN, the configuration of the VPN indicating that a certificate is to be used to authenticate a user to the VPN; and The device is configured to utilize the VPN to access the private computer network by associating a particular certificate of the one or more certificates with the VPN profile, which configures the device to authenticate the user to the VPN using the particular certificate in accordance with the configuration of the VPN.

10. The system of claim 1, wherein the triggering event indicates that the device is to be configured to utilize an email program; and The one or more processors are further configured to: providing an email configuration file to the device, the email configuration file specifying a configuration of the email program, the configuration of the email program indicating that a certificate is to be used to authenticate a user to the email program; and The device is configured to utilize the email program by associating a particular certificate of the one or more certificates with the email profile, which configures the device to authenticate the user to the email program using the particular certificate in accordance with the configuration of the email program.

11. The system of claim 1 , wherein the one or more processors are configured to: initiating creation of a particular certificate of the one or more certificates in a first workflow, the first workflow comprising a first portion of the work, the first portion of the work being dependent on a subset of the portion of the work used to create the particular certificate; and Utilizing the specific certificate for which creation was initiated in the first workflow, rather than initiating re-creation of the specific certificate in a second workflow, the second workflow includes a second portion of the work, the second portion of the work being dependent on the subset of the portion of the work.

12. A method comprising: determining, based at least in part on a triggering event indicating that a device is to be configured, a plurality of portions of work to be performed to configure the device with one or more credentials; generating a plurality of asynchronous work requests, the plurality of asynchronous work requests being configured to initiate execution of respective portions of the work when executed; generating a hierarchical work tree, the hierarchical work tree comprising a plurality of hierarchical nodes representing respective portions of the work, the hierarchical work tree defining an order in which the portions of the work are to be performed based at least in part on rules indicating conditions under which the portions of the work are to be performed; as well as The asynchronous work requests are executed in the order defined by the hierarchical work tree, initiating creation of the one or more credentials and delivery of the one or more credentials to the device.

13. The method of claim 12, wherein determining the plurality of portions of the work comprises: determining, based at least in part on the triggering event, a plurality of subsets of the work to be performed to configure the device with a plurality of corresponding credentials, each subset of the work comprising a plurality of portions of the work; and Wherein the hierarchical work tree defines an order in which the subsets of the work are to be performed based at least in part on rules indicating conditions under which the subsets of the work are to be performed.

14. The method of claim 13, wherein determining the subset of the work comprises: determining a first subset of the work to be performed to configure the device with a first credential; as well as determining a second subset of the work to be performed to configure the device with a second credential; and Wherein the rule indicates that, based at least in part on the first subset being dependent on the second subset, execution of the portion of the work included in the first subset is to be initiated after execution of the portion of the work included in the second subset is completed.

15. The method of claim 12, wherein determining the plurality of portions of the work comprises: determining, based at least in part on the triggering event, a specified portion of the work to be performed to configure the device with specified credentials; The generating of the plurality of asynchronous work requests comprises: generating a specified asynchronous work request, the specified asynchronous work request being configured to initiate execution of the corresponding specified portion of the work when executed; wherein a particular asynchronous work request included in the specified asynchronous work requests is configured to, when executed, initiate a notification to a user of the device that the action is to be performed by the user based at least in part on the performance of the action being a prerequisite to the creation of the specified certificate; and Wherein executing the asynchronous work requests in the order comprises: Stopping the execution of the specified asynchronous work request to wait for the execution of the action; and The execution of the specified asynchronous work request is resumed based at least in part on the execution of the action, wherein the execution of the specified asynchronous work request initiates the creation of the specified credential and the delivery of the specified credential to the device.

16. The method according to claim 12, further comprising: Based at least in part on a designated certificate being created and delivered to the device, and further based at least in part on metadata associated with the designated certificate, monitoring a status of the designated certificate over time, the designated certificate being included among the one or more certificates; determining, based at least in part on the metadata associated with the designated certificate indicating that the designated certificate is in a first state, and further based at least in part on the metadata associated with the designated certificate indicating that one or more criteria for changing the state of the designated certificate from the first state to a predefined second state are satisfied, a plurality of portions of additional work to be performed to change the state of the designated certificate from the first state to the predefined second state; generating a plurality of additional asynchronous work requests, the plurality of additional asynchronous work requests being configured to initiate execution of respective portions of the additional work when executed; generating a second hierarchical work tree including a plurality of second hierarchical nodes representing respective portions of the additional work, the second hierarchical work tree defining an order in which the portions of the additional work are to be performed based at least in part on a second rule indicating conditions under which the portions of the additional work are to be performed; as well as The additional asynchronous work requests are executed in the order defined by the second hierarchical work tree, which changes the state of the specified certificate from the first state to the predefined second state.

17. The method of claim 16, wherein determining the plurality of portions of the additional work to be performed comprises: determining, based at least in part on the metadata associated with the specified certificate indicating that the specified certificate is expired or about to expire, and further based at least in part on the metadata associated with the specified certificate indicating that the one or more criteria for renewing the specified certificate are satisfied, the plurality of portions of the additional work to be performed to change the status of the specified certificate from the first status in which the specified certificate is expired or about to expire to the predefined second status in which the specified certificate is renewed; as well as Executing the additional asynchronous work request causes the specified certificate to be renewed.

18. The method of claim 16, wherein determining the plurality of portions of the additional work to be performed comprises: determining, based at least in part on the metadata associated with the designated certificate indicating that the designated certificate is available for use by the device, and further based at least in part on the metadata associated with the designated certificate indicating that the one or more criteria for revoking the designated certificate are satisfied, the plurality of portions of the additional work to be performed to change the status of the designated certificate from the first status in which the designated certificate is available for use by the device to the predefined second status in which the designated certificate is revoked; as well as Execution of the additional asynchronous work request causes the specified certificate to be revoked.

19. The method according to claim 12, comprising: initiating creation of a particular certificate of the one or more certificates in a first workflow, the first workflow comprising a first portion of the work, the first portion of the work being dependent on a subset of the portion of the work for creating the particular certificate; as well as Utilizing the specific certificate for which creation was initiated in the first workflow, rather than initiating re-creation of the specific certificate in a second workflow, the second workflow includes a second portion of the work, the second portion of the work being dependent on the subset of the portion of the work.

20. A computer program product comprising a computer-readable storage medium having recorded thereon instructions for enabling a processor-based system to perform operations comprising: determining, based at least in part on a triggering event indicating that a device is to be configured, a plurality of portions of work to be performed to configure the device with one or more credentials; generating a plurality of asynchronous work requests, the plurality of asynchronous work requests being configured to initiate execution of respective portions of the work when executed; generating a hierarchical work tree, the hierarchical work tree comprising a plurality of hierarchical nodes representing respective portions of the work, the hierarchical work tree defining an order in which the portions of the work are to be performed based at least in part on rules indicating conditions under which the portions of the work are to be performed; as well as The device is configured by executing the asynchronous work requests in the order defined by the hierarchical work tree to initiate creation of the one or more credentials and delivering the one or more credentials to the device.

Images