Security device intermediating to a second

Abstract

The invention relates to a security device for interfacing to a second environmental system. One embodiment provides a method comprising: receiving, at a first environmental system, an enterprise configuration request from a device; verifying an identity of the device at the first environmental system; identifying, at the first environmental system, that the device is assigned to the second environmental system; and providing, at the first environmental system, instructions for the device to access the second environmental system, where providing includes providing encrypted information to the device to validate the second environmental system. Other aspects are claimed and described.

Description

Technical Field

[0001] The present invention relates to a safety device for referral to a second environment system. Background Art

[0002] When a device is acquired by a user or other entity, the device will initially communicate with the environment to receive configuration information. The configuration information typically provides the device with all the information needed to configure the device so that it has the latest software, firmware, is able to communicate with the communication network, etc. The configuration information may also include enterprise configuration information, which includes any certificates and encryption information required to connect to a network, server location, or other enterprise-specific location, as well as information about how to connect to the enterprise-specific location. For example, this information may include the identification of an endpoint at the enterprise-specific location. Once the device is configured, the device can connect to the enterprise-specific location. Summary of the invention

[0003] In summary, one aspect provides a method comprising: receiving an enterprise configuration request from a device at a first environment system; verifying the identity of the device at the first environment system; identifying that the device is assigned to a second environment system at the first environment system; and providing instructions for the device to access the second environment system at the first environment system, wherein providing includes providing encrypted information to the device to verify the second environment system.

[0004] On the other hand, a system is provided, which includes: a processor; a memory device storing instructions, which when executed by the processor cause the system to perform the following operations: receive an enterprise configuration request from a device at a first environment system; verify the identity of the device at the first environment system; identify that the device is assigned to a second environment system at the first environment system; and provide instructions for the device to access the second environment system at the first environment system, wherein the providing includes providing encrypted information to the device to verify the second environment system.

[0005] On the other hand, a product is provided, which includes: a computer-readable storage device storing executable code, which when executed by a processor causes the product to perform the following operations: receiving an enterprise configuration request from a device at a first environment system; verifying the identity of the device at the first environment system; identifying that the device is assigned to a second environment system at the first environment system; and providing instructions for the device to access the second environment system at the first environment system, wherein the providing includes providing encrypted information to the device to verify the second environment system.

[0006] The foregoing is a summary and thus may contain simplifications, generalizations, and omissions of detail; consequently, those skilled in the art will appreciate that the summary is illustrative only and is not intended to be in any way limiting.

[0007] For a better understanding of the embodiments, and other and further features and advantages thereof, reference is made to the following description taken in conjunction with the accompanying drawings.The scope of the invention will be pointed out in the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 An example of information handling device circuitry is shown.

[0009] Figure 2 Another example of information handling device circuitry is shown.

[0010] Figure 3 An example method for referring a device from a first environment system to a second environment system to obtain enterprise configuration information for the device corresponding to the second environment system is shown. DETAILED DESCRIPTION

[0011] It will be readily appreciated that, in addition to the described example embodiments, the components of the embodiments as generally described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations. Therefore, the following more detailed description of the example embodiments as illustrated in the drawings is not intended to limit the scope of the embodiments as claimed, but merely represents example embodiments.

[0012] Throughout this specification, references to "one embodiment" or "an embodiment" (etc.) mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the phrases "in one embodiment" or "in an embodiment" appearing in various places throughout this specification do not necessarily all refer to the same embodiment.

[0013] In addition, the described features, structures or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to give a thorough understanding of the embodiments. However, those skilled in the relevant art will recognize that various embodiments can be practiced without using one or more of the specific details or using other methods, components, materials, etc. In other cases, in order to avoid confusion, well-known structures, materials or operations are not shown or described in detail.

[0014] The creation of enterprise configuration information that can be deployed when a device performs an initial configuration is called zero-touch configuration, which means that the enterprise does not have to touch the device in order for the device to communicate appropriately with the enterprise location. Zero-touch configuration can be set up with the device when it is manufactured. However, because zero-touch configuration requires certificates and encryption information, the enterprise configuration information points to a server or network service provided by the manufacturer. This allows the manufacturer to create and store public and private keys associated with the device. The manufacturer can also provide the device with the appropriate keys, encryption information, and configuration information required to access the appropriate server or environment when the device is manufactured.

[0015] While many businesses or entities are accustomed to utilizing a manufacturer's servers or network services (referred to as a manufacturer environment) to support the business, some businesses prefer to use private servers or network services hosted by the business or another entity. Utilizing different servers, network services, or other environments causes problems with zero-touch configuration of devices. Specifically, the device must be touched to communicate with and access the desired environment rather than the manufacturer-specified environment, thereby negating the benefits of zero-touch configuration. Currently, there are no solutions that allow zero-touch configuration of environments that are different from the environment provided by the manufacturer.

[0016] In order to provide zero-touch configuration to different environments, manufacturers need a private key for each of the devices that will communicate with the different environments of the enterprise (also known as the second environment system or the enterprise environment). Since providing the manufacturer with a private key for each of the devices will expose the private key to the manufacturer, it is unlikely that the enterprise will be willing to continue with this approach. In addition, the enterprise needs to set the public key to a private key pair so that when the device accesses the enterprise environment, the enterprise environment can identify the device as a device that is allowed or should be allowed to access the enterprise environment. This will require the enterprise to be closely involved in the manufacture of the device, and will also require the enterprise's encryption information and configuration information to be exposed to the manufacturer, thereby causing security and privacy issues for the enterprise. Therefore, the current solution for allowing devices to communicate with the enterprise environment instead of the manufacturer environment is that the enterprise must touch all devices and configure the devices to communicate with the enterprise environment instead of the manufacturer environment.

[0017] Thus, the described systems and methods provide a technique for referring a device from a first environment system to a second environment system to obtain enterprise configuration information for the device corresponding to the second environment system. In other words, the described systems and methods provide a technique that allows a manufacturer environment to refer a device to an enterprise environment to obtain configuration information for accessing the enterprise environment while maintaining a zero-touch configuration approach and maintaining the security and privacy of the enterprise. The first environment system (also referred to as a manufacturer server or environment for ease of reading) receives an enterprise configuration request from a device. An enterprise configuration request is a request made by a device requesting access to connect to and communicate with a manufacturer environment in order to receive additional configuration information. The enterprise configuration request may include information provided by the device, such as encryption information, device information, etc., to allow the manufacturer environment to verify the identity of the device.

[0018] Based on the enterprise configuration request, the first environment system verifies the identity of the device. Specifically, the first environment system verifies that the device is a device that is authorized to communicate with the first environment system or is expected to communicate with the first environment system. In addition, the first environment system can identify that the device is assigned to the second environment system. Being assigned to the second environment system may include identifying that the device has a state indicating that it corresponds to an enterprise environment or a second environment that is different from the first environment. After successfully verifying the identity of the device and identifying that the device is assigned to the second environment system, the first environment system provides the device with instructions to access the second environment system, including providing encryption information so that the device can verify the second environment system. In other words, the first environment system provides information to the device so that the device knows how to access the second environment system, and allows the device to verify that the information at the specified location corresponds to the second environment system when accessing the specified location. The information may include endpoint identification information, a public key corresponding to the second environment system, other configuration and / or encryption information, and the like.

[0019] Therefore, the system provides a technical improvement over conventional methods for configuring a device to access an environment system. By providing a technique for handing over a device to a second environment system for a first environment system, the described system and method provide a technique for maintaining the security and privacy of the second environment while still allowing zero-touch configuration of the device. The first environment system can verify the identity of the device, thereby ensuring that the device is a device authorized to communicate with the first environment system and the second environment system. After this verification, the first environment system can provide information to the device so that the device can access the second environment system, and can also ensure that the access point actually belongs to the second environment system. An additional security layer allows the second environment system to also verify the identity of the device to prevent authorized access to the second environment system by a device that has stolen the access information of the second environment system. Therefore, the described system and method provide a technical improvement over conventional methods by allowing zero-touch configuration of the device even when the device will communicate with an environment different from the environment set when the device was manufactured.

[0020] The illustrated example embodiments will be best understood by referring to the accompanying drawings.The following description is intended to be by way of example only and simply illustrates certain example embodiments.

[0021] Although various other circuits, circuit systems, or components may be used in an information processing device, with respect to smartphone and / or tablet circuit system 100, Figure 1 The examples shown in include system-on-chip designs found, for example, in tablet computers or other mobile computing platforms. The software and processor are combined in a single chip 110. As is well known in the art, the processor includes internal arithmetic units, registers, cache memory, bus, input / output (I / O) ports, etc. The internal bus, etc., depend on different suppliers, but basically all peripheral devices (120) can be attached to a single chip 110. The circuit system 100 combines the processor, memory control, and I / O controller hub all into a single chip 110. In addition, this type of system 100 does not typically use serial advanced technology attachment (SATA) or peripheral component interconnect (PCI) or low pin count (LPC). For example, common interfaces include secure digital input / output (SDIO) and internal integrated circuit (I2C).

[0022] There is a power management chip 130, such as a battery management unit BMU, which manages power supplied, for example, via a rechargeable battery 140, which can be recharged by connection to a power source (not shown). In at least one design, a single chip, such as 110, is used to provide basic input / output system (BIOS)-like functions and dynamic random access memory (DRAM) memory.

[0023] The system 100 typically includes one or more of a wireless wide area network (WWAN) transceiver 150 and a wireless local area network (WLAN) transceiver 160 for connecting to various networks, such as telecommunication networks and wireless Internet devices, such as access points. In addition, a device 120 is typically included, such as a wireless communication device, an external storage device, etc. The system 100 typically includes a touch screen 170 for data input and display / rendering. The system 100 also typically includes various storage devices, such as flash memory 180 and synchronous dynamic random access memory (SDRAM) 190.

[0024] Figure 2 A block diagram depicting another example of an information handling device circuit, circuitry, or component. Figure 2 The examples depicted in the may correspond to a computing system such as a personal computer or other device. As is apparent from the description herein, embodiments may include Figure 2 Other features or only some of the features of the examples shown in .

[0025] Figure 2 An example of includes a so-called chipset 210 (a group of integrated circuits or chips that work together, a chipset) having an architecture that can vary depending on the manufacturer. The architecture of the chipset 210 includes a core and a memory control group 220 and an I / O controller hub 250 that exchange information (e.g., data, signals, commands, etc.) via a direct management interface (DMI) 242 or a link controller 244. Figure 2 In the embodiment of the present invention, DMI 242 is a chip-to-chip interface (sometimes referred to as the link between the "North Bridge" and the "South Bridge"). Core and memory control group 220 includes one or more processors 222 (e.g., single core or multi-core) and memory controller hub 226 that exchange information via front-side bus (FSB) 224; note that the components of group 220 can be integrated in a chip that replaces the conventional "North Bridge" type architecture. One or more processors 222 include internal arithmetic units, registers, cache memory, buses, I / O ports, etc. as known in the art.

[0026] exist Figure 2 , the memory controller hub 226 interfaces with the memory 240 (e.g., to provide support for a type of random access memory (RAM) that may be referred to as "system memory" or "memory"). The memory controller hub 226 also includes a low voltage differential signaling (LVDS) interface 232 for a display device 292 (e.g., a cathode ray tube (CRT), a flat panel, a touch screen, etc.). Block 238 includes some technologies that may be supported via the low voltage differential signaling (LVDS) interface 232 (e.g., serial digital video, high definition multimedia interface / digital visual interface (HDMI / DVI), display port). The memory controller hub 226 also includes a PCI-express interface (PCI-E) 234 that may support an independent graphics card 236.

[0027] exist Figure 2In the embodiment, the I / O hub controller 250 includes a SATA interface 251 (e.g., for a hard disk drive (HDD), a solid state drive (SSD), etc. 280), a PCI-E interface 252 (e.g., for a wireless connection 282), a universal serial bus (USB) interface 253 (e.g., for devices such as a digitizer, a keyboard, a mouse, a camera, a phone, a microphone, a storage device, other connected devices, etc. 284), a network interface 254 (e.g., a local area network (LAN)), a general purpose I / O (GPIO) interface 255, an LPC interface 270 (for an application specific integrated circuit (ASIC) 271, a trusted platform module (TPM) 272, a super I / O 273, firmware hub 274, BIOS support 275 and various types of memory 276 such as read-only memory (ROM) 277, flash memory 278 and non-volatile RAM (NVRAM) 279), power management interface 261, clock generator interface 262, audio interface 263 (e.g., for speaker 294), time control operation (TCO) interface 264, system management bus interface 265, and serial peripheral interface (SPI) flash memory 266 which may include BIOS 268 and boot code 290. I / O hub controller 250 may include Gigabit Ethernet support.

[0028] At power-up, the system may be configured to execute boot code 290 for BIOS 268 as stored within SPI flash memory 266, and subsequently process data under the control of one or more operating systems and application software (e.g., stored in system memory 240). The operating system may be stored in any of a variety of locations and may be accessed, for example, according to instructions from BIOS 268. As described herein, a device may include a boot code 290 for BIOS 268 and a boot code 290 for BIOS 268. Figure 2 There are fewer or more features than shown in the system.

[0029] For example Figure 1 or Figure 2 The information processing device circuit system outlined in the invention can be used in devices such as tablet computers, smart phones, personal computer devices in general, and / or electronic devices that can be used in devices or systems set up for zero-touch configuration, environments that communicate with devices, etc. For example, Figure 1 The circuit system outlined in can be implemented in a tablet or smartphone embodiment, and Figure 2 The circuit system outlined in can be implemented in a personal computer implementation.

[0030] Figure 3An example method for referring a device from a first environment system to a second environment system to obtain enterprise configuration information of the device corresponding to the second environment system is shown. The method may be performed on a processor, a memory device, an output device (e.g., a display device, a printer, etc.), an input device (e.g., a keyboard, a touch screen, a mouse, a microphone, a sensor, a biometric scanner, etc.), an image capture device, and / or other components such as a combination thereof. Figure 1 and / or Figure 2 The components discussed are implemented on a system. Although the system may include known hardware components and software components and / or hardware components and software components developed in the future, the system itself is specifically programmed to perform the functions as described herein to refer a device from one environment to a second environment to obtain configuration information for the device from the second environment. In addition, the secure device referral system includes modules and features that are unique to the described system.

[0031] The secure device referral system facilitates communication between three entities, namely, the device, the first environment and the second environment. For ease of reading, the first environment will be referred to as the manufacturer environment, and the second environment will be referred to as the enterprise environment. This is because the most common configuration of the system may be to transfer the device from the manufacturer environment to an environment associated with an enterprise or other entity. However, this is not intended to limit the scope of the present disclosure to this, because other possible environments can be utilized. The device can be any type of device with the ability to communicate with different environments. Therefore, the device can be a portable information processing device (e.g., a smart phone, a tablet computer, a laptop computer, a virtual reality headset, an augmented reality headset, a smart watch, etc.), an independent user device (e.g., a desktop computer, a smart appliance, a smart TV, etc.), a physical component or device (e.g., a server, a router, a network access point, etc.) and / or any other device, system and / or component with communication capabilities.

[0032] For example, the second environment can be another environment that is different from the default environment and is associated with the manufacturer. For example, a manufacturer may have two cloud service environments that run independently of each other. Although the device may be manufactured to communicate with the first cloud service environment by default, the manufacturer may want to transfer the communication to the second cloud service environment. The described system and method can be used to facilitate such a transfer. It is also noted that although most of the content of this disclosure discusses the initial configuration of transferring the device to the second environment, the disclosed technology can also be applied to transfer the device to the second environment at any time during the life of the device. For example, before transferring to the second environment, the device may operate on the first environment and communicate with the first environment for days, months, or even years. In this case, the next time the device communicates with the first environment, the first environment can provide the device with instructions and other necessary information for connecting to the second environment.

[0033] The first environment system and / or the second environment system can be networks, services and / or other environments of associated entities. The primary example used throughout this is that the first environment system and the second environment system are servers associated with cloud services. However, this is not intended to limit the scope of the present disclosure to only cloud services. Other possible environments include physical networks, Internet or intranet sites, network servers or other network components, data storage locations, etc. Therefore, the term "server" is not intended to limit the scope of the present disclosure to only servers, as other components or services may be utilized.

[0034] The described system may be configurable to some extent by the second environment entity. Specifically, some of the security measures selected and used may be selected by the second environment entity. As an example, the second environment entity may choose to create a certificate and provide a public key to the first environment system, rather than the first environment system generating the public key. As another example, when a device accesses the second environment system, the second environment system may choose to verify the identity of the device. Therefore, different entities communicating with the manufacturer may have different switching strategies implemented at the manufacturer or device initiator. Regardless of these choices, the described technology still allows the device to be switched to the second environment system while maintaining the security and privacy required by the entity.

[0035] When the device is manufactured, the device may include instructions that inform the device to contact a specific location upon startup or initialization. Typically, this may be the manufacturer's environment. However, this may be a different environment. For example, the device may be programmed by the retailer to access the retailer environment upon initialization or startup. Alternatively, the device may have software or hardware components installed that override any manufacturer programming. For example, a subscriber identity module (SIM) card may be installed in the device, indicating that the device is connected to the retailer environment rather than the manufacturer environment. Therefore, although most of this disclosure will discuss the manufacturer environment as the first environment system, it should be noted that this may not be the manufacturer environment, but rather some initial environment programmed into the device.

[0036] The device may also include a certificate embedded in a secure enclave of the device, such as a TPM, a secure enclave chip other than a TPM, a secure firmware location, or other secure enclave. Thus, a private key is stored on the device. The private key is part of a public key / private key pair cryptographic set. The corresponding public key is stored at the first environment system. Thus, when the device accesses the first environment system, the device can communicate with the first environment system using the public key / private key pair.

[0037] In the event that the device does not have a secure enclave for storing private keys, or the entity hosting the first environment system is unable to distribute the private keys to all devices, the device may have software installed on the device. The software may have a built-in signed certificate that includes a signature generated from the first environment system. When accessing the first environment system, the device may authenticate the first environment system by comparing the signature received from the first environment system with the signature of the signed certificate to verify that communication with the expected entity is occurring.

[0038] At 301, a first environment system may receive an enterprise configuration request from a device. When a device is first initialized or started, the device is programmed with instructions to access a specific environment to receive configuration instructions. Thus, the device executes these instructions and accesses the environment provided in the instructions. This environment is a first environment system. Therefore, the first environment may also be referred to as an initial environment or an initial configuration environment.

[0039] The device accesses the first environment to receive instructions regarding the configuration of the device. The device may also receive additional information, including encryption information (e.g., public and / or private keys, certificates, etc.), firmware and / or software updates or configurations, access point identifications, etc. A request made by a device to receive instructions regarding the configuration of a device is referred to as an enterprise configuration request. Thus, an enterprise configuration request may be a request made by a device requesting instructions regarding how a device should be configured. The enterprise configuration request may be a zero-touch configuration request that causes the device to automatically request device configuration information to access the enterprise without requiring a user to provide input to the device to obtain the configuration information or provide instructions to obtain the configuration information.

[0040] When making an enterprise configuration request to the first environment, the device may also provide additional information about the device. The additional information may include information that allows the first environment to verify the identity of the device at 302. Therefore, the additional information may include a device identifier (e.g., an asset number, a serial number, an identification number, a model number, a device type, a manufacturer, etc.), cryptographic information (e.g., a private key, a public key, a certificate, etc.), etc. The first environment may access a database or other data storage device that includes a set of device identifiers. The device identifier of the data storage device may correspond to a device that is authorized to access the first environment. Therefore, a match between the device identifier provided by the device and the device identifier included in the data storage device may provide an indication that the device is authorized to access the first environment.

[0041] If the device includes a secure enclave with a private key, when the device accesses the first environment, the first environment can verify the identity of the device using a public key held by the first environment against the private key of the device. At a high level, this typically means that when the device accesses the first environment, the first environment provides the device with a message that has been encrypted using the public key of the first environment. The device receives the message and decrypts the message using the device's private key, where the private key is paired with the public key. After decrypting the message, the decrypted message is compared to the expected message, and a match between the decrypted message and the expected message indicates that the authentication of the device with respect to the first environment is successful. Therefore, the device can be confident that it is communicating with the expected environment, and the environment can verify the identity of the device.

[0042] If the device does not have a private key, but instead has software that includes a signed certificate, when the device receives information returned from the first environment, the first environment will sign the information. Information can be signed regardless of the device authentication technology used. In other words, the first environment can sign all communications from the first environment, regardless of whether the signature is used to verify the identity of the device. The signature is encrypted using the private key of the first environment. The device has a corresponding public key. The device can use the public key to verify that the signature included on the message or information received from the first environment matches the signature of the signed certificate included in the software, allowing the device to verify the identity of the first environment and ensure that the message from the environment is the message sent from the expected environment.

[0043] Device authentication allows the first environment to ensure that the device communicating with the first environment is authorized to receive instructions from the first environment. This provides a level of security with respect to the device. Additionally, because the device identity has been verified, the first environment can ensure that it is providing such instructions to the device that should receive such instructions. Therefore, this provides a level of security to ensure that messages from the first environment are only provided to authorized devices.

[0044] At 303, the first environment server can identify whether the device is assigned to the second environment system. It should be noted that this identification can occur before device authentication, simultaneously with device authentication, and / or after device authentication. Identifying that the device is assigned to the second environment includes determining whether the device is marked in some way as belonging to or assigned to another environment. One technique for assigning a device to the second environment is that the device can be a device that has been sold to a specific entity or organization. These types of devices can be pre-registered with the organization so that the organization, entity, or other enterprise only needs to accept the device or adopt the device into the enterprise. Pre-registration can be performed on the device itself, which means that when the device communicates with the first environment, the device provides an identification that it has been pre-registered with a specific enterprise.

[0045] Pre-registration or tagging may also occur in a data store, which may be the same as discussed with respect to device authentication, where a device identifier is associated with a tag, state, or other identifier that indicates the device is associated with an enterprise. Thus, when a first environment verifies the identity of a device or otherwise accesses a data store corresponding to a device identifier, the first environment may learn of the device's assignment or state when the device is assigned to a second environment. For example, a device may have a ready-to-adopt state, a pending state for an enterprise, etc.

[0046] The manufacturer or device initiator may also assign the device to the second environment. For example, an entity or organization may request or purchase a certain number of devices. The manufacturer may assign a batch of devices to the entity at the time of manufacture. The assignment may be based on a device identifier and may be stored in a data storage device. Thus, when the device accesses or communicates with the first environment, the first environment and the device are aware of the assignment status.

[0047] To identify the correct second environment, the system can identify the entity to which the device is assigned, and then identify the second environment corresponding to the entity. In other words, the system can identify that the device is assigned to an environment other than the first environment, and to identify the correct second environment, the system can identify the entity, and the second environment can be established as an environment hosted by the entity or otherwise specified by the entity.

[0048] If the first environment determines at 303 that the device has not been assigned to the second environment, then at 305 the first environment can provide the device with enterprise registration information to satisfy the enterprise configuration request received at 301. In other words, the first environment provides configuration instructions to the device so that the device will continue to communicate with the first environment unless or until the device is assigned to a new environment. Thus, if the device has not been assigned to the second environment, the device will be configured through traditional zero-touch configuration techniques.

[0049] On the other hand, if the first environment determines at 303 that the device has been assigned to the second environment, then at 304 the first environment provides instructions to the device to access the second environment. Such instructions to provide access to the second environment are also referred to as switching or referring the device to the second environment. The instructions provide instructions on how the device can access the second environment. For example, the instructions may indicate an endpoint or other access point that can be used to access the second environment. The endpoint may be an endpoint that has been previously provided by the second environment and is indicated to the first environment to allow the first environment to provide appropriate instructions to the device that needs to switch to the second environment.

[0050] However, because endpoints may change, be attacked, or be taken over, etc., the switching technology may include additional information to ensure that the device accesses the intended second environment. Therefore, providing instructions may also include providing encrypted information to the device to allow the device to verify the second environment. The encrypted information may include a certificate, a public key, a private key, a hash, or other cryptographic elements. The provided encrypted information is keyed to the second environment, which means that the provided encrypted information is paired with the encrypted information of the second environment, correctly decrypts the information provided by the second environment, etc. Therefore, when the device accesses the second environment, the device can use the encrypted information to verify that the accessed environment is actually the second environment or the expected environment.

[0051] As an example, once the first environment verifies the identity of the device, the first environment can provide the device with a certificate that matches or pairs with a public key held by the second environment. When the device accesses the second environment, the device can request the public key from the second environment. Alternatively, when the device accesses the second environment, the second environment can provide the public key to the device. The device can then determine whether the key provided by the second environment is paired with the encrypted information contained in the certificate. This matching and comparison can be performed by encrypting or decrypting the message using the certificate and / or public key, and then determining whether the message is the expected message via matching the message or by reading the message and identifying specific information contained in the message. After determining that the encrypted information provided by the second environment is the expected information, the device can be sure that the environment being accessed is the second environment.

[0052] As another example, the second environment can create a certificate and provide a public key to the first environment. The second environment then holds the certificate and, therefore, the private key. When the device accesses the first environment, once the identity of the device is verified by the first environment, the first environment provides the public key to the device. The device then accesses the second environment using the information provided by the first environment. The device and the second environment communicate to verify the public key held by the device against the certificate held by the second environment. Upon a successful match, the device is confident that the second environment is the correct environment, and the second environment can be confident that the first environment sent the device to the second environment.

[0053] Another technique for verifying that a first environment sends a device to a second environment is based on a signature of the first environment. When the first environment provides instructions to the device for accessing the second environment, the first environment can sign the instructions with a signature corresponding to the first environment. Not only can the device verify that the signature matches a signature known to originate from the first environment, but the second environment can also use the signature to verify that the instructions were provided to the device from the first environment. When the device accesses the second environment, the second environment can verify the signature on the instruction with a signature known to originate from the first environment. A match indicates that the instruction was indeed provided by the first environment.

[0054] In addition to verifying that the first environment transferred or sent the device to the second environment, the second environment can also verify that the device is expected at the second environment. The first environment can provide a list of devices to be transferred to the second environment. The list can include identification information that the second environment can use to verify that the device is the expected device. In addition, just as the first environment can verify the identity of the device, the second environment can perform the same verification. In this case, the first environment can provide the public key corresponding to the device to the second environment. The second environment can then use the public key to verify the identity of the device in the same manner as the first environment.

[0055] The referral to the second environment can occur in response to different triggers. In one scenario, the device can be registered to a particular entity or environment. When the device is initialized, the device can access the first environment, and when the first environment sees that the device is assigned to the second environment, the first environment provides transfer instructions to the device. Once the device accesses the second environment, the second environment can determine whether to accept the device and provide the device with configuration instructions for accessing the second environment.

[0056] In another scenario, a device may access a first environment, and the first environment may see that the device has a state indicating that it will be assigned to a second environment. However, rather than immediately transferring the device to the second environment, the first environment may wait to receive instructions from the second environment indicating that the second environment is ready for the device. Upon receiving these instructions, the first environment may then provide instructions to the device for transferring the device to the second environment.

[0057] Once transferred to the second environment, the second environment can choose to accept the device into the second environment, or the second environment can be set to automatically accept the device that passes the security measures. Once the transfer is made, the second environment provides enterprise configuration instructions to the device so that the device can be configured to communicate with the second environment. Therefore, once transferred to the second environment, the device can be configured using zero-touch configuration technology. In other words, once the device is transferred and accepted by the second environment, the device can be configured as in traditional configuration techniques.

[0058] Although the present disclosure is written from the perspective of the first environment system, it is worth noting that other devices within the communication system take corresponding steps. For example, from the perspective of the device, the device will present an enterprise configuration request to the first environment system. The device may also present any other necessary information, such as private keys, device identification information, etc. Once the first environment device verifies the identity of the device and determines that it is assigned to the second environment system, the device receives instructions from the first environment system to identify the location to be accessed and the information required to access the location.

[0059] The device then accesses the identified location and presents the necessary information. Alternatively, the device may access the identified location and receive information from the second environment system. The device may then use the received information to verify the identity of the second environment system. Once the second environment system authorizes the device to access the second environment system based on the communication between the second environment system and the device, the device may access the second environment system, receive the enterprise configuration information from the second environment system, and, due to the enterprise configuration information received from the second environment system, continue to access the second environment system instead of the first environment system and communicate with the second environment system instead of the first environment system.

[0060] From the perspective of the second environment system, the second environment system receives a request from the device to access the second environment system. The second environment system will request encrypted information from the device or receive encrypted information from the device. The encrypted information provided by the device was previously received from the first environment system. The encrypted information obtained by the second environment system indicates that the first environment system has verified the identity of the device and sent the device to the second environment system. The second environment system communicates with the device, and when the communication is completed and the device is verified to be authorized to access the second environment system, the second environment system will provide the device with enterprise configuration information so that the device will be configured to communicate with the second environment system. The second environment system can also perform an additional step of verifying the identity of the device to ensure that the device is what the second environment system expects.

[0061] Thus, the described systems and methods provide techniques for allowing a device to switch from a first environment to a second environment. The device may be pre-configured during manufacturing or by programming to access the first environment to set up a zero-touch configuration for the device. However, an entity may want the device to be configured to access the second environment instead of the first environment and communicate with the second environment instead of the first environment. When the device accesses the first environment, the first environment may perform some initial steps to authenticate the device and then provide the device with instructions to access the second environment for configuration instructions, wherein the configuration instructions will cause the device to no longer communicate with the first environment, but instead communicate with the second environment.

[0062] Upon accessing the second environment, the device will be able to verify that the second environment is the correct environment, and the second environment can authenticate the device. Once the second environment allows access to the device, the second environment can provide configuration instructions to the device. Thus, the described systems and methods provide a secure method for switching a device from a first environment to a second environment that allows the device to be configured without an entity associated with the second environment having to contact the device, thereby providing zero-touch configuration for the device while allowing the entity to select a desired environment with which the device will communicate.

[0063] As will be appreciated by those skilled in the art, various aspects may be implemented as systems, methods or device program products. Thus, various aspects may take the form of a complete hardware implementation or an implementation including software, which may generally be referred to herein as a "circuit," "module," or "system." Additionally, various aspects may take the form of a device program product implemented in one or more device-readable media having a device-readable program code implemented therewith.

[0064] It should be noted that the various functions described herein can be implemented using instructions executed by a processor stored on a device-readable storage medium such as a non-signal storage device. The storage device can be, for example, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any suitable combination of the foregoing. More specific examples of storage media will include the following: a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a storage device is not a signal and should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted by a wire. In addition, the term "non-transient" includes all media except signal media.

[0065] The program code embodied on the storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, radio frequency, etc., or any suitable combination of the foregoing.

[0066] The program code for performing the operation can be written in any combination of one or more programming languages. The program code can be executed entirely on a single device, partially on a single device, executed as an independent software package, partially on a single device and partially on another device, or completely on another device. In some cases, the device can be connected by any type of connection or network including a local area network (LAN) or a wide area network (WAN), or can be connected by other devices (e.g., by using the Internet of an Internet service provider), by a wireless connection such as near field communication, or by a hard-wired connection such as a USB connection.

[0067] Example embodiments are described herein with reference to the accompanying drawings, which illustrate example methods, devices, and program products according to various example embodiments. It will be understood that actions and functions may be implemented at least in part by program instructions. These program instructions may be provided to a processor of a device, a dedicated information processing device, or other programmable data processing device of a manufacturing machine, so that instructions executed by the processor of the device implement specified functions / actions.

[0068] It is worth noting that although specific blocks are used in the drawings and specific ordering of blocks has been shown, these are non-limiting examples. In some contexts, two or more blocks can be combined, a block can be divided into two or more blocks, or some blocks can be appropriately reordered or reorganized, because the examples explicitly shown are only for descriptive purposes and should not be interpreted as limiting.

[0069] As used herein, the singular "a" and "an" may be construed as including the plural "one or more" unless clearly indicated otherwise.

[0070] The present disclosure has been presented for purposes of illustration and description, but the disclosure is not intended to be exhaustive or limiting. Many modifications and variations will be apparent to those of ordinary skill in the art. The exemplary embodiments are selected and described in order to explain the principles and practical applications, and to enable others of ordinary skill in the art to understand the disclosure of various embodiments with various modifications suitable for the intended specific use.

[0071] Thus, although illustrative example embodiments have been described herein with reference to the accompanying drawings, it is to be understood that the description is not limiting and that various other changes and modifications may be made therein by those skilled in the art without departing from the scope or spirit of the present disclosure.

Claims

1. A method, comprising: receiving, at a first environment system, an enterprise configuration request from a device; verifying, at the first environment system, an identity of the device; identifying, at the first environment system, that the device is assigned to a second environment system; as well as Instructions are provided at the first environment system for the device to access the second environment system, wherein the providing includes providing encrypted information to the device to authenticate the second environment system.

2. The method according to claim 1, wherein: Providing encrypted information includes providing a public key presented by the device at the second environment system and used by the second environment system to authenticate the device.

3. The method according to claim 2, wherein: The public key includes a public key provided from the second environment system to the first environment system and corresponds to a private key held by the second environment system.

4. The method according to claim 1, wherein: Providing encrypted information includes providing an encrypted certificate presented by the device at the second environment system to verify encrypted information provided by the second environment system in response to the encrypted certificate.

5. The method according to claim 1, wherein: The identifying includes identifying that the device is assigned to an entity hosting the second environment system within a database accessible by the first environment system.

6. The method according to claim 1, wherein: The authentication includes authenticating the device using a public key of the first environment system against a private key stored within the device.

7. The method according to claim 1, wherein: Providing instructions includes providing, from the first environment system, signed metadata indicative of an endpoint of the second environment system; Wherein, the signed metadata is signed by the first environment system using a private key of the first environment system; The device verifies the signature of the signed metadata against a signature certificate stored on the device and generated using the private key of the first environment system.

8. The method according to claim 1, wherein: Providing instructions includes identifying an endpoint corresponding to the second environment system.

9. The method according to claim 1, wherein: Receiving an enterprise configuration request includes receiving a zero touch configuration request.

10. The method according to claim 1, wherein: The first environment system and the second environment system include a cloud service provider.

11. A system, comprising: processor; a memory device storing instructions that, when executed by the processor, cause the system to: receiving, at a first environment system, an enterprise configuration request from a device; verifying, at the first environment system, an identity of the device; identifying, at the first environment system, that the device is assigned to a second environment system; as well as Instructions are provided at the first environment system for the device to access the second environment system, wherein the providing includes providing encrypted information to the device to authenticate the second environment system.

12. The system according to claim 11, wherein: Providing encrypted information includes providing a public key presented by the device at the second environment system and used by the second environment system to authenticate the device.

13. The system according to claim 12, wherein: The public key includes a public key provided from the second environment system to the first environment system and corresponds to a private key held by the second environment system.

14. The system according to claim 11, wherein: Providing encrypted information includes providing an encrypted certificate presented by the device at the second environment system to verify encrypted information provided by the second environment system in response to the encrypted certificate.

15. The system according to claim 11, wherein: The identifying includes identifying that the device is assigned to an entity hosting the second environment system within a database accessible by the first environment system.

16. The system according to claim 11, wherein: The authentication includes authenticating the device using a public key of the first environment system against a private key stored within the device.

17. The system of claim 11, wherein: Providing instructions includes providing, from the first environment system, signed metadata indicative of an endpoint of the second environment system; Wherein, the signed metadata is signed by the first environment system using a private key of the first environment system; The device verifies the signature of the signed metadata against a signature certificate stored on the device and generated using the private key of the first environment system.

18. The system of claim 11, wherein: Providing instructions includes identifying an endpoint corresponding to the second environment system.

19. The system of claim 11, wherein: Receiving an enterprise configuration request includes receiving a zero touch configuration request.

20. A product, comprising: A computer readable storage device storing executable code that, when executed by a processor, causes the product to: receiving, at a first environment system, an enterprise configuration request from a device; verifying, at the first environment system, an identity of the device; identifying, at the first environment system, that the device is assigned to a second environment system; as well as Instructions are provided at the first environment system for the device to access the second environment system, wherein the providing includes providing encrypted information to the device to authenticate the second environment system.

Images