Automatic provisioning and integration of devices

Abstract

Methods and systems for automated device provisioning include a computer system to authenticate a user using a first device. The computer system receives a request for automated provisioning of a second device. An authentication token and a request identifier of the request are associated with a provisioning data structure of the user. The request including the authentication token is sent to a third device. The computer system receives a unique identifier of the second device from the third device. Based on a determination that the unique identifier of the second device and the authentication token match the unique identifier and the authentication token in the provisioning data structure, the second device is authenticated, a configuration profile of the user is retrieved, and the configuration profile is caused to apply to one or more settings of the second device.

Description

Technical Field

[0001] This disclosure generally relates to methods and systems for the automated supply and integration of devices, according to some embodiments. Background Technology

[0002] The use of software and hardware technologies has become commonplace. In performing everyday tasks, a variety of hardware and software technologies are typically utilized for various purposes. Telephones, laptops, printers, speakers, and televisions are just a small fraction of the hardware technologies frequently used. With so many hardware devices in use, it is inevitable that some will need to be upgraded and / or replaced. Summary of the Invention

[0003] The ubiquity of electronic devices in daily life is an undeniable fact. However, at some point, these devices reach the end of their lifespan and need replacement. Providing new and / or replacement equipment to many people within an organization requires impeccable organizational and management skills. Instead of manually ordering, receiving, and installing electronic devices, the methods and systems envisioned in this paper provide a novel, simplified, and integrated platform for managing the supply and integration of electronic devices.

[0004] Embodiments of this disclosure include methods and systems for automated device provisioning that mitigate problems associated with the procurement and provision of new hardware devices. In some examples, a method for automated device provisioning includes authenticating a user using a first device accessing a network-based service. The method includes: receiving a request for the automated provisioning of a second device, the provisioning including authentication of the second device, and the provisioning being associated with a request identifier. The method includes: associating an authentication token and the request identifier with a provisioning data structure for the user. The method includes: sending a request, the request identifier, and the authentication token to a third device. The method includes: receiving a unique identifier for the second device and the request identifier from the third device. The method includes: using the request identifier to locate a provisioning data structure, and updating the provisioning data structure to include the unique identifier of the second device. The method includes: receiving an authentication request for the second device at a network-based service, the authentication request including an authentication token and the unique identifier of the second device. The authentication token has been pre-provisioned on the second device by the third device. The method includes: identifying the supply data structure and authenticating the device based on a unique identifier and by matching the authentication token and unique identifier included in the authentication request with the authentication token and unique identifier of the second device in the supply data structure; retrieving a configuration profile based on the user's supply data structure; and applying the configuration profile to one or more settings of the second device.

[0005] Furthermore, the claimed subject matter can be implemented as a method, apparatus, or article of manufacture that uses standard programming and engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computing device to implement the disclosed subject matter. As used herein, the term "article of manufacture" is intended to cover a computer program accessible from any computer-readable storage device or medium. Computer-readable storage media may include, but is not limited to, magnetic storage devices such as hard disks, floppy disks, magnetic stripes, optical disks, compact discs (CDs), digital multifunction discs (DVDs), smart cards, flash memory devices, etc. Conversely, computer-readable media (i.e., non-storage media) may additionally include communication media, such as transmission media for wireless signals, etc.

[0006] The present invention is provided to introduce a selection of concepts, which will be further described in the following detailed description. It is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. Attached Figure Description

[0007] The disclosed aspects will be described below in conjunction with the accompanying drawings, which are provided to illustrate and not limit the disclosed aspects.

[0008] Figure 1 A block diagram of an example system for the automated supply and integration of devices, according to some embodiments, is shown.

[0009] Figure 2 An example user interface application for the automatic provisioning and integration of devices, according to some embodiments, is shown.

[0010] Figure 3 A second view is shown of an example user interface application for the automatic provisioning and integration of devices, according to some embodiments.

[0011] Figure 4 An example user interface of a hardware electronic device according to some embodiments is shown.

[0012] Figure 5 A swimlane flowchart for providing automated supply and integrated operation is shown according to some embodiments.

[0013] Figure 6 A method for providing automated supply operations according to some embodiments is shown.

[0014] Figure 7 This is a block diagram depicting an example networked system in which embodiments can operate.

[0015] Figure 8 It is a block diagram of a computer system that implements one or more example embodiments. Detailed Implementation

[0016] Purchasing equipment from third-party systems can introduce numerous technical problems, threatening the security and integrity of the network to which the purchased equipment connects. For example, when a user receives and powers on the device, many settings may need to be configured for a successful connection. Misconfigured equipment, even those that may only be temporarily misconfigured, can cause a number of technical problems, such as wasted network resources when devices fail to connect (and subsequently retry); wasted power due to connection failures (and subsequent retries); unconfigured or misconfigured devices becoming targets for hackers and other malicious users who may exploit more permissive initial settings; performance degradation; and so on. Furthermore, even without malicious intent, misconfigured equipment can compromise the network. For example, a device might continuously attempt to connect to a server. Due to misconfiguration, connection attempts may fail. This can reduce the amount of resources available to other clients. Too many misconfigured devices can cause correctly configured devices to suffer a denial-of-service (DoS) attack.

[0017] This invention provides a technical solution to these problems. By providing automated device provisioning and configuration services, the system ensures that devices are optimally configured. This means that the devices are already properly configured, thus resolving the technical problems caused by misconfigured devices, as the devices should be optimally configured and ready for connection without issues. For example, by configuring the devices according to the settings of the network to which they will be used, the amount of wasted network resources is reduced. Furthermore, by starting pre-configuration or subsequently rapid configuration, the devices can be configured with appropriate security settings and are no longer vulnerable to hacking. Moreover, the risk to existing network resources is reduced or eliminated. These objectives are achieved through the technical solutions proposed herein; for example, by automatically providing authentication information and / or one or more settings to devices provided by third parties.

[0018] To provide these technical solutions, other technical problems arose and were solved through technical solutions. For example, the first system requesting equipment from the second system lacked a way to identify newly procured equipment, and therefore would be unable to recognize the device when it connected to the network. This could lead to delays in authenticating and configuring the device (e.g., especially for networks that only allow devices from a licensed device list to access the network). This technical problem was solved by using a supply data structure that associates a request identifier with an authentication token and a unique identifier of the supplied device. The second system provides the device's unique identifier; it also stores the authentication token on the device before delivery to the user. When a newly supplied device attempts to connect to the network, it can provide the system with the authentication token and unique identifier. The system can then recognize the token and identifier and accept the new device. This results in faster authentication and recognition of new devices within the network. The system can also use this information to retrieve the device's configuration information and configure the device.

[0019] It should be understood that the solution not only retains the ability to automatically supply and integrate devices, but may also include any applications that provide content and / or devices to users.

[0020] This article uses the term "supply" to describe operations involving modifying, updating, or evolving equipment to a state in which it can be made available to end users.

[0021] This article uses the term "authentication" to describe operations involving verifying the identity of a user or device.

[0022] The subject matter of the invention will now be discussed with reference to several example implementations. It should be understood that these implementations are discussed to enable those skilled in the art to better understand and implement the embodiments of this disclosure, and not to limit the scope of the invention in any way.

[0023] The examples disclosed herein relate to methods for providing seamless device provisioning and integration services, apparatus comprising several modules, and apparatus comprising one or more processors and memory embodying executable instructions.

[0024] Having provided a general overview of some of the disclosed examples, please now refer to the accompanying drawings for further explanation of some additional details. Illustrated configurations and sequences of operation are provided to help the reader understand some aspects of the disclosed examples. The drawings are not intended to limit all examples; therefore, some examples may include different components, devices, or sequences of operation without departing from the scope of the disclosed examples discussed herein. In other words, some examples may be embodied or function in ways different from those shown.

[0025] It should be noted that the foregoing one or more aspects include the features fully described below and specifically pointed out in the claims. The following description and drawings set forth certain illustrative features of one or more aspects in detail. These features merely indicate various ways in which the principles of each aspect can be employed, and this disclosure is intended to include all such aspects and their equivalents.

[0026] Figure 1A block diagram of an example system for automated provisioning and integration of devices, according to some embodiments, is shown. System 100 provides automated provisioning and integration of devices for user 124 to a separate, new user device 126 via user device 102. Automated provisioning and integration of user device 126 can be provided via a communication platform module 114 available on either user device 102 and / or on a communication engine server 112. System 100 also includes a device provider 122 (e.g., a device manufacturer, supplier) that communicates with the communication engine server 112 (e.g., a Teams server) to send and receive communications regarding device procurement. The communication engine server 112, together with the communication platform module 104, can also provide communication services between two or more devices. Example communication services may include Teams, Skype, Outlook, and other similar applications and / or platforms. Example communications may include real-time or near real-time communication, such as online conferencing, video calls, chat messaging, content sharing, etc. Device provider 122 may be one or more computer systems that can provide one or more devices, such as user device 126. Equipment provider 122 can communicate with communication engine server 112 and user equipment 126. In some examples, equipment provider can also communicate with user 124 to supply and transport equipment.

[0027] Communication platform module 104 may be an instance of an application (e.g., Teams) to facilitate communication between user device 102 and one or more other devices in conjunction with communication engine server 114. Communication platform module 104 may facilitate communication between user device 102 and communication engine server 112 via a graphical user interface (GUI). In some embodiments, the GUI may be provided by communication engine server 112 for display at user device 102. Figures 2 to 3 As shown and described, the GUI can provide visual assistance for the automated provisioning and integration of devices. The displayed GUI may include Hypertext Markup Language (HTML), script files, content style sheets, code modules, script files, etc.

[0028] The communication platform module 104 of user equipment 102 may include a supply module 106, an authentication module 108, and a configuration module 110, etc. User equipment 102 may include... Figure 1Various other modules and sub-modules are not shown. The authentication module 108 can authenticate the user of user device 102 and / or user device 102 itself to the communication engine server 114. For example, by providing credentials (e.g., username / password, key, token, or the like). Once user device 102 and communication platform module 104 are authenticated by the communication engine server 114, the functionality of the communication engine server 112 is exposed to the user of user device 104. The configuration module 110 allows the user to set various configuration parameters for user device 102, and in the example where the user of user device 102 is an administrator, the configuration module 110 can allow the user to set various configuration parameters for other users and other devices. The configuration set by the configuration module 110 can include settings stored on user device 102 and / or communication engine server 112. The settings can relate to communication provided by the communication engine server 112 and can include security settings, device accessibility settings, user preferences, user interface settings, etc.

[0029] Supply module 106 can process equipment procurement requests from user 124 and, together with supply module 116 of communication engine server 112, handle the supply of the requested equipment. For example, supply module 106 can receive supply requests from users through one or more GUIs provided by communication platform module 104, such as... Figure 2 As shown. The supply request may include information about user 124, device 126, the user or network of user device 102, information about the communication engine server 114, etc. For example, such as... Figure 2 The fields shown.

[0030] In some embodiments, a device provisioning data structure is created at provisioning module 106. The provisioning data structure may be information about user 124, device 126, the user or network of user device 102, information about communication engine server 114, etc. Additionally, the provisioning data structure may have a request identifier that can be created to identify a specific request. The provisioning data structure may also have one or more fields for device identification information that may be specific to user device 126, such as a media access control address, UUID, etc. Provisioning requests may be sent to communication platform module 114, and particularly provisioning module 116. Provisioning requests may include a provisioning data structure. In other examples, the provisioning data structure may be created by communication platform module 114 in response to a request. The provisioning data structure may be stored at communication platform module 114 and / or user device 102.

[0031] Provisioning module 116 can receive provisioning requests and, if not yet completed, generate and store a provisioning data structure. Provisioning module 116 can contact authentication module 118 to generate one or more authentication tokens. Authentication tokens can be specific to user device 126 and / or user 124, and, alone or in combination with other information, can allow newly equipped devices to authenticate with communication engine server 112. In some examples, authentication module 118 can also generate challenge-response pairs. For example, user 124 will enter and send a unique PIN (e.g., a one-time password (OTP)) along with the token for authentication. In some examples, the authentication token authenticates user 124 based on authenticated user device 102 and / or the user authenticated using user device 102. Authentication tokens and challenge-response pairs can be stored in the provisioning data structure. Provisioning module 116 can receive configuration information and / or settings, and can also store these within the provisioning data structure. The provisioning data structure can be stored along with other provisioning data structures and can be indexed and located based on request identifiers and / or data about devices and / or users.

[0032] Provisioning module 116 can send authentication tokens and information about user device 126 to one or more computing devices associated with device provider 122. Device provider 122 can select a device from a list based on the type of the requested device, preload the authentication token to the device, and in some examples, preload configuration to the device. Device provider 122 can provide a unique identifier for the actual device 126 to communication platform module 114. This unique identifier may include a UUID, MAC address, etc. Communication platform module 114 can include the unique identifier in a provisioning data structure. In some examples, provisioning module 116 can also send the device's configuration to device provider 122. Device provider 122 can store this configuration on user device 126. Authentication tokens and / or configuration may be stored in a pre-specified location on user device 126, where the communication platform module instance on the user device knows to view it upon its first execution.

[0033] Once user 124 receives user device 126 and powers it on, user device 126 can be configured to look up an authentication token and / or configuration information; apply the configuration information; and contact communication platform module 114 to authenticate using the authentication token and / or user device 126's unique identifier. In some examples, user device 126 queries user 124 in response to a challenge-response, providing the challenge response as part of the authentication. User device 126 can pass the authentication token, unique identifier, and / or challenge-response to authentication module 108. Authentication module 108 is configured to authenticate one or more devices within the networking environment. For example, the authentication module will compare user device 126's unique identifier to look up a provisioned data structure. The authentication token in the provisioned data structure can be compared with the authentication token submitted by user device 126. If the authentication token matches the unique identifier and / or challenge-response, user 124 and / or device 126 can be authenticated to communication engine server 114.

[0034] In some examples, once device 126 is authenticated, configuration module 120 can provide the device with one or more configuration profiles of user 124 stored in a provisioning data structure. Configuration module 120 can obtain information from the provisioning data structure of authentication module 108. The user's configuration profile may include device-specific settings, security profiles, and other personal settings previously selected by the user. As previously described, the configuration profile can be provided to user device 126 for installation on the device. That is, configuration module 120 can send a configuration file to user device 126. The configuration profile can be automatically installed on user device 126 without manual intervention in response to authentication. In some embodiments, various configuration profiles may be stored at communication engine server 112 by configuration module 110 and / or configuration module 120. For example, user 124 has a first configuration profile for a telephone device and a second configuration profile for a laptop computer device. Each configuration profile is maintained at configuration module 110 and / or 120 and associated with user 124.

[0035] In some examples, the functionality of various modules, such as supply module 116, configuration module 120, and authentication module 118, can be provided by user equipment 102.

[0036] Figure 2 An example user interface application for automated provisioning and integration of devices, according to some embodiments, is illustrated. The graphical user interface (GUI) 200 includes an example view of a graphical user interface connecting to a communication platform (e.g., Teams Admin Center) for secure procurement of electronic devices. According to some examples, GUI 200 may be provided by a communication engine server 112 to be used by… Figure 1The communication platform module 104 is displayed on the user equipment 102. In some examples, the GUI can be provided for display on an electronic device different from the user's normal or commonly used device. The user can authenticate himself / herself with the communication platform using his / her user credentials and then use the GUI further. In this way, the user does not need to use a specific electronic device to access the GUI 300.

[0037] As shown in the figure, electronic device 202 is an available device to be procured through the GUI provided by the communication platform (e.g., communication platform module 114). Electronic device 202, which is not currently part of the user's electronic device library, can be procured via the communication engine server 112 and by... Figure 1 The equipment provider 122 supplies and provides the equipment. Users (e.g., by clicking the button 204 labeled "GetNow") can access the equipment. Figure 1 User 124 (and also referred to as User in this document) may request the purchase of electronic equipment 202.

[0038] In some embodiments, before submitting a purchase request, a user can select various configuration profiles 206 using a drop-down menu provided by the communication platform. In some embodiments, a user can select a configuration profile that is available to multiple users (e.g., a global profile). In some embodiments, a user can select a private configuration profile. A private configuration profile can be specific to the user accessing the GUI. Additional configuration profiles may include security and privacy settings to be applied to the device, which allow administrators to monitor device usage and / or activity.

[0039] The GUI 200 can provide additional information, including the physical location of multiple procurement units 208, equipment 210, and various other information about electronic equipment, including model, description, category, equipment type, and the number of previously procured equipment that can be seen within the GUI 200.

[0040] Figure 3 A second view of an example graphical user interface (GUI) application for automated device provisioning and integration, according to some embodiments, is shown. The GUI 300 includes a second example view of a communication platform (e.g., communication platform module 104) and may be an extension of the GUI 200. The GUI 300 includes a user-submitted electronic device (e.g., Figure 2 The view of the communication platform following the procurement request for electronic equipment (202).

[0041] Section 302 of GUI 300 provides details regarding the authentication tasks provided to the user for installing various programs on a newly acquired electronic device (e.g., electronic device 202). It should be understood that in some examples, the user is not required to perform the installation. In some embodiments, the installation is performed automatically via a communication platform, via a third party (e.g., an IT technician), or virtually (e.g., via a Virtual Private Network (VPN)).

[0042] Section 304 includes logs of the user's unique device identifier (e.g., MAC ID) for each device. (See also: Regarding...) Figure 5 As described in detail, a unique device identifier is provided by the device provider (e.g., device provider 122) to identify the device and map it to the user. Additionally, the unique device identifier is used for automatically supplying associated devices without manual intervention, as per [reference to...]. Figure 6 A more detailed description.

[0043] The information displayed in section 304 may be stored in one or more provisioning data structures that the user has access to. For example, if the user is an administrator of an organization, pending information specific to that organization may be displayed from the provisioning data structures. Section 306 includes details of the verification code sent to the device for verification and / or authentication of the device used by the user. Figure 5 The details described in more detail can be applied to new assistive devices (e.g., Figure 2 Electronic devices 202 Figure 1 User equipment 126) provides a challenge-response in the form of a verification code. The verification code is used to verify the device's identity to the network and can also be used to authenticate the device. In some examples, the verification code is a six-digit number, a password, a token, or a security certificate. In some embodiments, the user is not the only user accessing the device. The user can purchase devices on behalf of other users and maintain logs for active devices, pending devices, and inactive devices.

[0044] GUI 300 includes physical location information 308 to manage the physical installation location of each electronic device. In some embodiments, the intended physical location of the device is stored in the user's provisioning data structure. Once the device is determined to be within or at a threshold distance (e.g., 200 feet) of the intended physical location, authentication of the device can be performed. GUI 300 may maintain a log of the physical locations associated with each of the user's electronic devices. Additionally, GUI 300 may provide a graphical representation of each of the user's electronic devices and its corresponding location.

[0045] Physical location can be determined based on GPS data provided by the device when attempting authentication, IP addresses mapped to the location (e.g., IP addresses can be mapped to various locations or rooms), etc.

[0046] Figure 4 An example user interface of a hardware electronic device according to some embodiments is shown. Hardware electronic device 400 includes user interface 402. The hardware electronic device may be... Figure 2 The requested electronic device 202. After one or more programs are successfully installed on device 400, user interface 402 can reflect one or more configuration profiles applied to the user at the device.

[0047] For example, device 400 is a desktop phone used in a user's office. Users can have various configuration profiles specific to different devices, and an appropriate configuration profile for a desktop phone may include pre-configured settings specific to the user's or device's preferences. In some embodiments, the user prefers a background image for device 404 and pre-installed shortcuts for contacting the cafeteria, IT, security, and company shuttle 406. These pre-configured settings or configuration profiles are automatically applied to device 400.

[0048] Figure 5 A swimlane flowchart for providing automated supply and integrated operation to a received device, according to some embodiments, is shown. Method 500 can be executed by processing logic, which may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, device hardware, integrated circuits, etc.), software (e.g., instructions that run or execute on the processing device), or a combination thereof. Although shown in a specific sequence or order, the order of processes may be modified unless otherwise stated. Therefore, the embodiments shown should be understood as examples only, and the processes shown may be executed in different orders, and some processes may be executed in parallel. In addition, one or more processes may be omitted in various embodiments. Therefore, not all processes are required in every embodiment. Other process flows are also possible.

[0049] Method 500 begins with operation 502, where a user (e.g., a tenant) requests the purchase of equipment via a communication platform (e.g., Teams). For example, an IT manager (e.g., a tenant) submits a purchase request via an online communication platform to place a new projector in a meeting room (e.g., via GUI 200, GUI 300). The online communication platform can provide a GUI that allows administrators or IT managers to select from available equipment, provide information about the intended end-user, and provide configuration information as previously described.

[0050] At the server system (e.g., a communication platform server), operation 504 includes recording the purchase request made by the user. In some embodiments, the purchase request is recorded and saved as part of the user profile (e.g., as part of a file with the user's profile). Figure 1This is part of the supply data structure associated with the user in the communication platform module 104. The procurement record may include equipment identifiers (e.g., brand and model), request identifiers (e.g., invoice number), authentication tokens (e.g., security certificates), and other identifiers related to equipment procurement. Each entry from the procurement record may also be stored in a data structure (e.g., a supply data structure) for future reference and access. Additionally, authentication information (e.g., tokens) and / or configuration information may be generated. This information may be sent to the equipment provider.

[0051] At the equipment provider, the equipment provider (e.g., equipment provider 122) receives an equipment procurement request (operation 506) and provides a unique identifier (e.g., a MAC address) for the equipment to be sent to the server (operation 508). In operation 510, the server receives the unique identifier (e.g., the MAC address) from the equipment procurement center and records the unique identifier of the procured equipment, and in some embodiments, associates the unique identifier of the procured equipment with a user profile within a user and / or supply data structure.

[0052] In operation 512, the device provider is configured to deliver the device to the user. In operation 514, the user receives the device and initiates the installation process (operation 516). The installation process may include powering on the device. The installation process may also include connecting to an internet connection via a local access network, wireless network, or other suitable connection. Once the device initiates the installation process, the server generates a one-time password (OTP) to be used to authenticate the device and configure the device for the user (operation 518). Then, in operation 520, the server sends the OTP or other suitable authentication task to the user. In some examples, the OTP may be provided and / or generated in an earlier step. In some examples where multiple devices are delivered to the user, the server is configured to provide a single OTP to be used to authenticate each device. In some embodiments, the OTP is provided after the user receives each device from a device purchase request.

[0053] In operation 522, the user receives an OTP from the server and installs the device by entering the OTP. The device may also be authenticated in other ways, including determining whether the authentication token and unique device identifier match the authentication token and unique device identifier stored in the device user's provisioning data structure. In some embodiments, once the device is shipped from the device provider to the user, the server receives a notification that the device is en route to its destination (e.g., to the user), and may also display the notification and / or visual representation of the device graphically (e.g., GUI 200, GUI 300).

[0054] After successful device authentication, the server sends one or more configuration profiles associated with the user for installation on the device (operation 524). The configuration profile may include various settings and licenses associated with the user. In some embodiments, when the device does not have any associated, optional configuration profiles, the device is provided to the user without installing any settings or licenses. In some embodiments, when a configuration profile is unavailable to the device or the user, the server provides the user with the option to create a new configuration profile and stores the new profile in a data structure associated with the user. In some embodiments, the server prompts the user to create a new configuration profile before device authentication.

[0055] In operation 526, the user's device receives and installs one or more configuration profiles, and in operation 528, the device is ready for use.

[0056] After a purchase request is submitted, a unique identifier for the equipment being purchased will be added to the user profile on the communication platform. Continuing the example above, the IT manager has a profile with the communication platform, in which the unique identifier for her new projector has been added.

[0057] For multiple devices that need to be supplied and integrated for users, the operation of method 500 can be repeated.

[0058] Figure 6 A method 600 for seamless device provisioning according to some embodiments is illustrated. Method 600 can be executed by processing logic, which may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, device hardware, integrated circuits, etc.), software (e.g., instructions that run or execute on the processing device), or a combination thereof. Although shown in a specific sequence or order, the order of processes may be modified unless otherwise stated. Therefore, the illustrated embodiments should be understood as examples only, and the illustrated processes may be executed in different orders, and some processes may be executed in parallel. Additionally, one or more processes may be omitted in various embodiments. Therefore, not all processes are required in every embodiment. Other process flows are also possible.

[0059] Method 600 begins with operation 602, wherein the computing device (e.g., Figure 1 The mobile computing device user equipment 102) uses the first device to authenticate the user on a network-based service (e.g., Teams).

[0060] In operation 604, the computing device receives a request for the automatic provision of a second device via a graphical user interface corresponding to a network-based service. This provision includes authenticating the second device and is associated with a request identifier. The second device is distinct from both the first device and the computing device.

[0061] In operation 606, the computing device associates the authentication token with a provisioned data structure associated with the user. For example, the data structure includes user-specific data such as device name, type, configuration settings, configuration profile, authentication token, and device identifier.

[0062] In operation 608, the computing device sends a purchase request for the second device, a request identifier, and an authentication token to a third computing device (e.g., a device vendor) that is different from the computing device, the first device, and the second device. In some embodiments, the computing device generates a security certificate to be installed on the second device and provides the security certificate to the third computing device for installation on the second device. In some embodiments, authenticating the second device includes verifying that the security certificate installed on the second device matches the generated security certificate sent to the third computing device.

[0063] In operation 610, the computing device receives a unique device identifier from the second device from the third computing device. This unique device identifier may include a device-specific MAC address. Additional information may be collected and stored, including product identifiers, product names, model numbers, order numbers, stock unit numbers (SKU numbers), etc.

[0064] In operation 612, the computing device updates the supply data structure to include the unique identifier and authentication token of the second device. For example, user A sends a purchase request for device B. When the manufacturer of device B sends a unique device identifier for user A's device B, that unique device identifier is stored under user A's supply data structure.

[0065] In some embodiments, the computing device stores the location of devices to be configured in the network. For example, device B requested by user A will be installed in conference room C. The location, i.e., conference room C, is stored in association with the user's profile (e.g., a supply data structure) at the communication platform.

[0066] In operation 614, the computing device receives an authentication request for a second device. This authentication request includes an authentication token pre-configured on the second device and a unique identifier for the second device. In some embodiments, the computing device receiving the authentication token from a third computing device is an indication pre-supplied on the second device. In some embodiments, the computing device determines the device's location (e.g., conference room C) before providing an authentication task to the user. In some embodiments, the authentication task includes sending a one-time password to the user to be entered at the device via a communication platform. In some embodiments, the authentication task includes verifying that the security certificate installed on the device matches a generated security device.

[0067] In operation 616, the computing device identifies the supply data structure based on the unique identifier of the second device. In some embodiments, the supply data structure is identified based on an authentication token, the unique identifier of the second device, or both the authentication token and the unique identifier of the second device. Then, in operation 618, the computing device determines whether the authentication token and unique identifier included in the authentication request match the authentication token and unique identifier of the second device in the supply data structure. Based on the determination that the authentication token and unique identifier of the authentication request match the authentication token and unique identifier of the second device in the supply data structure, the second device is authenticated (operation 620).

[0068] Then, the computing device retrieves a configuration profile for the user from the supply data structure (operation 622), and in operation 624 causes the configuration profile to be applied to one or more device settings of the second device.

[0069] In some embodiments, after successful device authentication, the computing device configures the device for use on the user's network. In response to successful device authentication, the computing device provides a configuration profile for installation on the device. For example, the configuration profile includes settings, wallpaper, password, privacy rights, security certificates, access rights, and other user-specific configuration settings. In some embodiments, the configuration profile is generated for the user based at least in part on the user's access level. For example, user A purchases device B. User A has a high access level and full control over the device. However, user C also purchases device D. User C has a low access level and is allowed limited access or control over the device commensurate with user C's access level.

[0070] In some embodiments, the configuration profile is not available for the device, or the user does not have a configuration profile to apply to the second device. In this case, the device is configured using a standard out-of-the-box configuration profile installed by the manufacturer.

[0071] In some embodiments, after the device is authenticated, the computing device displays a graphical representation of the device within the user's domain. For example, an office layout diagram includes multiple meeting rooms, and device B is identified as a graphical icon of an electronic device installed and / or located in meeting room C.

[0072] Optionally, in operation 626, the second device receives an error indication at the device. In some embodiments, based on the second device receiving a threshold number of error indications at the device, in operation 628, the user is offered the option to purchase a replacement device. For example, the device is defective and / or has a problem and needs to be replaced. The user may be offered the option to purchase another device of the same brand and model as the originally purchased device to replace the faulty original device. After operation 628, the computing device may receive a request for a replacement device, at which operations 604-618 of method 600 may be repeated.

[0073] Figure 7 A block diagram illustrating an example environment 700 including an example client device 702 for collecting and providing user and environmental data is depicted. In some examples, the client device 702 has at least one processor 708, a transceiver 710, one or more presentation components 712, one or more input / output I / O ports 714, and memory 726. The client device 702 can be in the form of a mobile computing device or any other portable device, such as a mobile phone, laptop computer, tablet, computing board, notebook, gaming device, portable media player, etc. The client device 702 can also include less portable devices, such as desktop personal computers, kiosks, desktop devices, industrial control equipment, etc. Other examples may incorporate the client device 702 as part of a multi-device system, where two separate physical devices share or otherwise provide access to the illustrated components of the computing device 702.

[0074] Processor 708 may include any number of processing units and is programmed to execute computer-executable instructions for implementing aspects of the present disclosure. The instructions may be executed by a processor or multiple processors within a computing device or by a processor external to the computing device. In some examples, processor 708 is programmed to execute, for example, append... Figures 5 to 6 The method shown.

[0075] Alternatively or concurrently, some examples may allow the processor 708 to be programmed to interact with the user interface (“UI”) (e.g., Figures 2 to 4 The experience is presented in the UI shown herein. Furthermore, in some examples, processor 708 may represent an implementation of the technology used to perform the operations described herein.

[0076] Transceiver 710 is an antenna capable of transmitting and receiving radio frequency (“RF”) signals. Those skilled in the art will recognize and understand that various antennas and corresponding chipsets can be used to provide communication capabilities between client device 702 and other remote devices. However, the examples are not limited to RF signaling, as various other communication modes can be used alternatively.

[0077] Presentation component 712 presents information visually or audibly on computing device 702. Examples of presentation component 712 include, but are not limited to, computer monitors, televisions, projectors, touchscreens, telephone displays, flat panel displays, wearable device screens, speakers, vibration devices, and any other device configured to display, verbally communicate, or otherwise indicate image search results to a user. In some examples, client device 702 may be a smartphone or mobile tablet including a speaker capable of playing audible search results to a user. In other examples, client device 702 is a computer in a vehicle that audibly presents the search response via a vehicle speaker system, visually presents the search response on a display screen in the vehicle, such as located in the vehicle's dashboard, headrest, drop-down screen, etc., or combinations thereof. Other examples may use a variety of other display or audio presentation components 712 to present the disclosed search response.

[0078] I / O port 714 allows client device 702 to be logically coupled to other devices and I / O components 716, some of which may be built into client device 702, while others may be external. Specifically, in the example discussed herein, I / O component 716 includes microphone 718, one or more sensors 720, camera 722, and touch device 724. Microphone 718 captures voice from user 702 and / or voice from user 704, or voice emitted by user 704. Sensor 720 may include any number of sensors on or in a mobile computing device, electronic toy, game console, wearable device, television, vehicle, or other computing device 702. Furthermore, sensor 720 may include accelerometers, magnetometers, pressure sensors, photometers, thermometers, global positioning system (“GPS”) chips or circuitry, bar scanners, biometric scanners for scanning fingerprints, palm prints, blood, eyes, etc., gyroscopes, near field communication (“NFC”) receivers, or any other sensors configured to capture data from user 702 or the environment. Camera 722 captures images or video of user 704. Touch device 724 may include a touchpad, trackpad, touchscreen, or other touch capture device. The I / O component 716 shown is merely one example of an I / O component that may be included on client device 100. Other examples may include additional or alternative I / O components 716, such as a sound card, vibration device, scanner, printer, wireless communication module, or any other component used to capture information related to the user or user environment.

[0079] Memory 726 includes any number of memories associated with or accessible by computing device 702. Memory 726 may be internal to client device 702, such as... Figure 8 As shown, outside of client device 100, in Figure 4Not shown, or both. Examples of memory 726 may include, but are not limited to, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical or holographic media, cassette tape, magnetic tape, disk storage or other magnetic storage devices, memory connected to an analog computing device, or any other medium used to encode desired information and accessed by client device 702. The terms computer-readable medium, machine-readable medium, and storage device exclude carrier waves, such that carrier waves are considered too transient. Memory 726 may also take the form of volatile and / or non-volatile memory; it may be removable, non-removable, or a combination thereof; and it may include various hardware devices such as solid-state memory, hard disk drives, optical disc drives, etc. Alternatively or additionally, memory 726 may be distributed across multiple client devices 702, for example in a virtualized environment where instruction processing is performed on multiple client devices 702. Memory 726 stores, among other data, various device applications that operate to perform functions on client devices 702 when executed by processor 708. Examples of applications may include search apps, instant messaging apps, email apps, web browsers, calendar apps, address book apps, messaging apps, media apps, location-based services, and search programs. Applications may communicate with corresponding applications or services, such as web services accessible via a network 706. For example, an application may include a client-side application corresponding to a server-side application running on a remote server in the cloud or a computing device.

[0080] Specifically, the instructions stored in memory 726 include communication interface application 728, user interface application 730, and streaming application 732. In some examples, communication interface application 728 includes computer-executable instructions for operating the network interface card and / or drivers for operating the network interface card. Communication between client device 702 and other devices can be performed using any protocol or mechanism via wired or wireless connection or via network 706. In some examples, communication interface application 728 can be operated using RF and short-range communication technologies such as electronic tags (e.g., NFC tags, Bluetooth® branded tags, etc.).

[0081] In some examples, user interface application 730 includes a graphical application for displaying data to and receiving data from the user. User interface application 730 may also include computer-executable instructions for operating a graphics card to display search results and corresponding images or audio on or through rendering component 712. User interface application 730 may also interact with various sensors 720 and cameras 722 to capture and present information through rendering component 712.

[0082] Figure 8 This is a block diagram of a network environment 800 used to provide image search results and recommendations on client device 802. The network environment 800 may include multiple client devices 802, or as... Figure 7 The diagram shows only one client device 802, with the device supply engine server 808 communicating via network 806. In some examples, user and environmental data are transmitted from client device 802 to device supply engine server 808 via network 806, and device supply engine server 808 provides or facilitates device procurement and / or supply for the user of client device 802.

[0083] Figure 8 The network environment 800 shown is merely an example of a suitable computing system environment and is not intended to imply any limitation on the scope or functionality of the examples disclosed herein. The network environment 800 shown should also not be construed as having any dependencies or requirements relating to any individual component, module, index, or combination thereof.

[0084] Network 806 may include any computer network, such as the Internet, a private network, a local area network (LAN), a wide area network (WAN), etc. Network 806 may include various network interfaces, adapters, modems, and other network devices for communicatively connecting client device 802 and device provisioning engine server 808. Network 806 may also include configurations for point-to-point connections. Computer networks are well known to those skilled in the art and therefore do not need to be discussed in detail here.

[0085] Client device 802 can be referenced above. Figure 1 This discussion pertains to any type of client device. Each client device 802 can capture user and / or environment data from its respective user and transmit the captured user and environment data to the device provisioning engine server 808 via network 806. For this purpose, each device may be equipped with as described in the reference above. Figure 7 The communication interface discussed is application 728. In response, the equipment supply overlay engine server 808 can provide the client device 802 with records of purchase requests, records of purchased equipment, and various other records and indicators related to equipment purchase via network 806.

[0086] Client device 802 may be equipped with various software applications and presentation components 712 for communicating via communication platform module 812 for automated device provisioning and integration. For example, a mobile phone may display a communication platform (e.g., a Teams application) for communication within an organization. The communication platform includes features that support one or more users of the communication platform in procuring and integrating new devices. In some embodiments, new devices are procured and integrated for one or more users of the communication platform within the same organization. The client devices and the foregoing presentation mechanisms shown are not an exhaustive list covering all examples. Many different variations of client device 802 and presentation technologies can be used for procuring and integrating devices.

[0087] Device provisioning engine server 808 represents a server or set of servers configured to execute various web service computer-executable instructions. Device provisioning engine server 808 includes a processor 804 for processing executable instructions, a transceiver 810 for communicating via a network 806, and a memory 814 embodying at least the following executable instructions: a communication platform module 812, an acquisition module 816, a procurement module 820, an authentication module 824, and a configuration module 826. Memory 814 may also include instructions for an accounting module 828 and an installation module 830. Accounting module 828 may include price lists, costs of procured equipment, replacement equipment costs, and other details related to the cost of procuring one or more devices. Installation module 830 may store applications, security certificates, configuration profiles, and various other files and applications that can be installed on one or more devices. Although device provisioning engine server 808 is shown as a single box, those skilled in the art will recognize that device provisioning engine server 808 can actually be expanded. For example, the device supply engine server 808 may include multiple servers for various parts of the operating software, which together supply and integrate devices for users of client devices (e.g., client device 802).

[0088] The procurement module 832 provides backend storage for web, user, and environmental data, which can be accessed via network 806 by the device supply engine server 808 or client device 802 and used by the device supply engine server 808 to supply and integrate devices. The web, user, and environmental data stored in the database includes, for example, but not limited to, user profiles 818, a storage module 822, etc. The storage module 822 may include historical logs of active devices, inactive devices, pending devices, faulty devices, devices requiring repair, and other information related to devices associated with users within the network and / or organization. Additionally, although not shown for clarity, the servers for the procurement module 832 may include their own processors, transceivers, and memory. Furthermore, while the network environment 800 describes the procurement module 832 as a collection of individual devices from the device supply engine server 808, the example may actually store the web, user, and environmental data discussed in the procurement module 832 on the device supply engine server 808.

[0089] Here, a "user profile" refers to a collection of electronically stored information related to a user. This information may be stored based on the user's explicit consent or "optional" participation. This information includes the user's name, age, gender, height, weight, demographic data, current location, place of residence, citizenship, family, friends, education, occupation, hobbies, skills, interests, web searches, health information, birthday, anniversaries, holidays, mood, user status, and any other personalized information associated with the user. A user profile includes static profile elements, such as name and place of birth, as well as dynamic profile elements that change over time, such as place of residence, age, and status. User profiles can be constructed by asking users questions or by analyzing user behavior on one or more client devices.

[0090] Additionally, user profiles 818 can include static and / or dynamic data parameters for each user. Examples of user profile data include, but are not limited to, a user's age, gender, name, location, interests, web search history, social media connections and interactions, purchasing history, daily behavior, occupation, or virtually any unique data point specific to the user. User profiles 818 can be expanded to encompass various other aspects of a user's life.

[0091] This disclosure relates to systems and methods for automated supply and integration of equipment, at least according to the examples provided in the following sections:

[0092] (A1) In one aspect, some embodiments or examples include a method performed at a client device (e.g., user equipment 102) communicating data with a network (e.g., network 706). The method includes: authenticating a user using a first device (e.g., operation 602), accessing a network-based service (e.g., communication platform module 812), receiving a request to automatically provision a second device (e.g., operation 604), and provisioning the authenticated second device, the provision being associated with a request identifier. The request may be submitted via a graphical user interface corresponding to the network-based service. The method includes: associating an authentication token and the request identifier with the user's provision data structure, and sending the request, request identifier, and authentication token associated with the second device to a third device different from the computer system, the first device, and the second device. The method includes: receiving a unique identifier of the second device and the request identifier from the third device. The method includes: using the request identifier to locate the provision data structure and updating the provision data structure to include the unique identifier of the second device. The method includes: receiving an authentication request for a second device at the network-based service, the authentication request including an authentication token and a unique identifier of the second device, the authentication token being pre-supplied on the second device by the third device. The method includes: identifying the provisioning data structure based on the unique identifier; authenticating the second device based on a determination that the authentication token and the unique identifier included in the authentication request match both the authentication token and the unique identifier of the second device in the provisioning data structure; retrieving a configuration profile based on the user's provisioning data structure; and causing the configuration profile to be applied to one or more settings of the second device.

[0093] (A2) In some embodiments of A1, the method includes generating a security certificate to be installed on a device, sending the security certificate to a third device (e.g., a device supplier, a procurement center) for installation on a second device, and wherein the authentication task includes verifying whether the security certificate on the second device matches the generated security certificate.

[0094] (A3) In some embodiments of A1-A2, authenticating the second device includes displaying a one-time password at a graphical user interface (e.g., operations 518 and 520) and receiving an indication from the second device that the one-time password has been entered (e.g., operation 522).

[0095] (A4) In some embodiments of A1-A3, the device configuration profile includes privacy, security and access configurations of the device associated with the user.

[0096] (A5) In some embodiments of A1-A4, the method includes: receiving an authentication token from a third device as an indication that it is pre-supplied on a second device.

[0097] (A6) In some embodiments of A1-A5, the method includes: storing the physical location of the second device to be authenticated at a supply data structure.

[0098] (A7) In some embodiments of A1-A6, the method includes: determining that the second device is in the physical location, and authenticating the second device based on the determination that the device is in the physical location.

[0099] (A8) In some embodiments of A1-A7, the method includes providing an indication at a graphical user interface that the second device has been successfully pre-supplied and displaying a graphical representation of the second device.

[0100] (A9) In some embodiments of A1-A8, the method includes: receiving an indication of a device error from the second device; and providing a user of the second device with an option to purchase a replacement device via a graphical user interface corresponding to the network-based service.

[0101] (A10) In some embodiments of A1-A9, the alternative device is different from the second device and has the same device type as the second device.

[0102] (B1) In another aspect, a system for automatically authenticating a user's hardware device includes: units for authenticating a user using a first device accessing a network-based service; units for receiving a request for automatically provisioning a second device via a graphical user interface corresponding to the network-based service, the provision including authentication of the second device, the provision being associated with a request identifier. The system includes: units for associating an authentication token and the request identifier with a provisioning data structure for the user; units for sending the request associated with the second device, the request identifier, and the authentication token to a third device different from the first device and the second device; and units for receiving a unique identifier of the second device and the request identifier from the third device. The system includes: units for using the request identifier to locate the provisioning data structure and updating the provisioning data structure to include the unique identifier of the second device; units for receiving an authentication request for the second device at the network-based service, the authentication request including an authentication token and the unique identifier of the second device, the authentication token being pre-provisioned on the second device by the third device; and units for identifying the provisioning data structure based on the unique identifier. Based on the determination that the authentication token and the unique identifier included in the authentication request match both the authentication token and the unique identifier of the second device in the supply data structure, the system includes: a unit for authenticating the second device; a unit for retrieving a configuration profile based on the user's supply data structure; and a unit for applying the configuration profile to one or more settings of the second device.

[0103] In another aspect, a system includes: a processor; and a memory device coupled to the processor and having a program stored thereon for the processor to execute to perform operations including any of the methods described in A1-A10 above.

[0104] In another aspect, some embodiments include a non-transitory computer-readable storage medium storing one or more programs executed by one or more processors of a storage device, the one or more programs including instructions for performing any of the methods described herein (e.g., A1-A10 above).

[0105] While some embodiments have been described in detail above, other modifications are possible. For example, the logical flow depicted in the figures does not require the shown order or sequential order to achieve the desired result. Other steps may be provided, or steps may be eliminated from the described flow, and other components may be added to or removed from the described system. Other embodiments are within the scope of the appended claims.

[0106] In this description, reference is made to the accompanying drawings, which form a part thereof, and specific embodiments that can be practiced are illustrated by way of illustration in the drawings. These embodiments have been described in sufficient detail to enable those skilled in the art to practice the invention, and it should be understood that other embodiments may be utilized, and structural, logical, and electrical changes may be made without departing from the scope of the invention. Therefore, the description of the included exemplary embodiments should not be construed as limiting, and the scope of the invention is defined by the appended claims.

[0107] This function can be configured to perform operations using, for example, software, hardware, firmware, etc. For example, the phrase "configured as" can refer to the logical circuit structure of the hardware element that implements the relevant function. The phrase "configured as" can also refer to the logical circuit structure of the hardware element used in the coded design to implement the relevant function of the firmware or software. The term "module" refers to a structural element that can be implemented using any suitable hardware (e.g., processor, etc.), software (e.g., application, etc.), firmware, or any combination of hardware, software, and firmware. The term "logic" encompasses any function used to perform a task. For example, each operation shown in the flowchart corresponds to the logic used to perform that operation. Operations can be performed using software, hardware, firmware, etc. The terms "component," "system," etc., can refer to computer-related entities, hardware, and executing software, firmware, or combinations thereof. A component can be a process, object, executable file, program, function, subroutine, computer, or a combination of software and hardware running on a processor. The term "processor" can refer to a hardware component, such as the processing unit of a computer system.

[0108] Furthermore, the claimed subject matter can be implemented as a method, apparatus, or article of manufacture that uses standard programming and engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computing device to implement the disclosed subject matter. As used herein, the term "article of manufacture" is intended to cover a computer program accessible from any computer-readable storage device or medium. Computer-readable storage media may include, but is not limited to, magnetic storage devices such as hard disks, floppy disks, magnetic stripes, optical disks, compact discs (CDs), digital multifunction discs (DVDs), smart cards, flash memory devices, etc. Conversely, computer-readable media (i.e., non-storage media) may additionally include communication media, such as transmission media for wireless signals.

Claims

1. A computer system for automatically authenticating a user's hardware devices, comprising: One or more processors; as well as A memory that stores computer-executable instructions, which, when executed, cause the one or more processors to perform the following operations: Authenticate the user using the first device accessing the network-based service; A request for automatic provisioning of a second device is received via a graphical user interface corresponding to the web-based service, the provisioning including authenticating the second device, the provisioning being associated with a request identifier; Associate the authentication token and the request identifier with the user's supply data structure; The request, the request identifier, and the authentication token associated with the second device are sent to a third device that is different from the computer system, the first device, and the second device; Receive the unique identifier of the second device and the request identifier from the third device; Use the request identifier to locate the supply data structure and update the supply data structure to include the unique identifier of the second device; The authentication request for the second device is received at the network-based service. The authentication request includes the authentication token and the unique identifier of the second device, the authentication token being pre-supplied on the second device by the third device. The supply data structure is identified based on the unique identifier; Based on the determination that both the authentication token and the unique identifier included in the authentication request match both the authentication token and the unique identifier of the second device in the supply data structure: Authenticate the second device; Retrieve the configuration profile based on the user's supply data structure; as well as This allows the configuration profile to be applied to one or more settings of the second device.

2. The computer system according to claim 1, wherein, Sending the authentication token includes: Generate a security certificate for the second device; The security certificate to be installed on the second device is sent to the third device; and Authenticating the second device includes verifying that the security certificate on the second device matches the generated security certificate.

3. The computer system according to claim 1, wherein, Authentication of the second device also includes: Display a one-time password at the graphical user interface corresponding to the web-based service; and Receive an indication from the second device that the one-time password has been entered.

4. The computer system according to claim 1, wherein, The configuration profile includes privacy, security, and access configurations based at least in part on the user's access level.

5. The computer system according to claim 4, further comprising: The third device receives an instruction that the authentication token is pre-supplied on the second device.

6. The computer system according to claim 1, further comprising: The physical location of the second device to be authenticated is stored in the supply data structure.

7. The computer system according to claim 6, further comprising: It is determined that the second device is located at the physical location; as well as The second device is authenticated based on the determination that the second device is located at the physical location.

8. The computer system according to claim 1, further comprising: An indication that the second device has been successfully pre-supplied is provided at the graphical user interface corresponding to the network-based service; as well as Display a graphical representation of the second device.

9. The computer system according to claim 8, further comprising: Receive a device error indication from the second device; as well as The user of the second device is provided with the option to purchase alternative equipment via the graphical user interface corresponding to the network-based service.

10. The computer system according to claim 9, wherein, The alternative device is different from the second device but has the same device type as the second device.

11. A computer-implemented method for supplying automated equipment, the method comprising: Authenticate the user using the first device accessing the network-based service; A request for automatic provisioning of a second device is received via a graphical user interface corresponding to the web-based service, the provisioning including authenticating the second device, the provisioning being associated with a request identifier; Associate the authentication token and the request identifier with the user's supply data structure; The request, the request identifier, and the authentication token associated with the second device are sent to a third device that is different from the first device and the second device; Receive the unique identifier of the second device and the request identifier from the third device; Use the request identifier to locate the supply data structure and update the supply data structure to include the unique identifier of the second device; The network-based service receives an authentication request for the second device, the authentication request including the authentication token and the unique identifier of the second device, the authentication token being pre-supplied on the second device by the third device; The supply data structure is identified based on the unique identifier; Based on the determination that both the authentication token and the unique identifier included in the authentication request match both the authentication token and the unique identifier of the second device in the supply data structure: Authenticate the second device; Retrieve the configuration profile based on the user's supply data structure; as well as This allows the configuration profile to be applied to one or more settings of the second device.

12. The method according to claim 11, wherein, Sending the authentication token includes: Generate a security certificate for the second device; The security certificate to be installed on the second device is sent to the third device; and Authenticating the second device includes verifying that the security certificate on the second device matches the generated security certificate.

13. The method according to claim 11, wherein, Authentication of the second device also includes: Display a one-time password at the graphical user interface corresponding to the web-based service; and Receive an indication from the second device that the one-time password has been entered.

14. The method according to claim 11, wherein, The configuration profile includes privacy, security, and access configurations based at least in part on the user's access level.

15. A system for automatically authenticating a user's hardware device, the system comprising: A unit for authenticating users using a first device for accessing network-based services; A unit for receiving a request for automatically provisioning a second device via a graphical user interface corresponding to the network-based service, the provisioning including authenticating the second device, the provisioning being associated with a request identifier; Unit for associating the authentication token and the request identifier with the user's supply data structure; A unit for sending the request, the request identifier, and the authentication token associated with the second device to a third device that is different from the first device and the second device; A unit for receiving the unique identifier of the second device and the request identifier from the third device; A unit for using the request identifier to locate the supply data structure and update the supply data structure to include the unique identifier of the second device; A unit for receiving an authentication request for the second device at the network-based service, the authentication request including the authentication token and the unique identifier of the second device, the authentication token being pre-supplied on the second device by the third device; Units used to identify the supply data structure based on the unique identifier; The system comprises, based on the determination that both the authentication token and the unique identifier included in the authentication request match both the authentication token and the unique identifier of the second device in the supply data structure: A unit used for authenticating the second device; A unit for retrieving a configuration profile based on the user's supply data structure; and A unit for applying the configuration profile to one or more settings of the second device.

Images