Certificate-Based Protocol for IoT Device Compliance Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile device management (MDM) services struggle to enforce compliance with specifications on IoT devices, especially when applications are not installed by the MDM service, leading to security vulnerabilities and incompatibility issues.
Innovation Solution
Implementing a certificate-based protocol to enforce compliance, where a device management service uses a client certificate to validate device configurations and revoke or disable certificates if the device is no longer compliant.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MDM service takes action on applications it installed on the device, then it can disable non-compliant applications, but it cannot disable applications installed from other sources such as app stores
Solution Approach 1:
The patent introduces a certificate-based authentication mechanism as an intermediary layer between applications and company resources. Instead of directly managing applications, the MDM service manages device certificates. When an application (whether company-installed or from app store) attempts to access company resources, it must present a valid device certificate. The MDM service can revoke this certificate when compliance violations occur, thereby blocking all applications on the device from accessing company resources through certificate-based authentication.
2Reliability
If MDM service quarantines a device when non-compliant, then it can prevent future connections, but authenticated sessions established while compliant remain valid
Solution Approach 1:
The patent implements continuous compliance monitoring with real-time feedback to the authentication system. When the MDM service detects a compliance violation, it immediately revokes the device certificate and notifies the company's authentication infrastructure (such as an identity provider or certificate authority). This feedback mechanism ensures that upon quarantine, the revoked certificate is rejected by authentication servers, automatically invalidating all sessions and preventing any new connections, thus maintaining security while the device remains non-compliant.
3Loss of time
If employee uses personal device for business tasks, then setup time is reduced, but security control and compliance enforcement become more difficult
Solution Approach 1:
The patent segments security management into two independent layers: device management and application/resource access control. The MDM service manages device-level certificates without needing to control individual applications. Employees can freely install any application on their personal devices, but each application must use the device certificate for authentication when accessing company resources. This segmentation allows personal devices to be used immediately (reducing setup time) while maintaining security control through certificate-based authentication and MDM-enforced compliance requirements.
Data Source
AI summary
A device management service may enforce compliance of remote devices with device specifications by disabling or enabling use of client certificates by applications installed on the devices. The device management service receives configuration data from an agent installed on the remote device. If the device management service determines that the device is no longer compliant with specifications for the device, then the device management service may prevent subsequent use of client certificate(s) by applications on the device to establish certificate-based connections. For example, the device management service may disable or revoke a client certificate or may instruct the device to disable or remove the client certificate. If the device becomes compliant at a subsequent time, then the device management service may enable the client certificate or cause a new client certificate to be sent to the device.