macOS MDM File Manager Agent for Configuration Enforcement

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current Mobile Device Management (MDM) systems for macOS struggle to manage files outside their scope, requiring complex scripts and frequent checks, which can lead to security vulnerabilities and increased costs due to the need for third-party solutions like Jamf and Kandji.

Innovation Solution

An MDM platform that uses a file manager agent to instantaneously enforce configuration profiles on macOS devices by tracking file system changes via FSEvents API, eliminating the need for scripts and reducing the time gap between changes and reconfiguration, allowing for immediate and secure setting of file attributes like owner, group, permissions, and content.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If scripts are used to manage files outside MDM scope, then configuration control is achieved, but system complexity and security vulnerability increase

Engineering Contradiction:

Improveconfiguration controlVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces a file manager agent as an intermediary component that runs continuously in the background on macOS devices. This agent monitors file system changes and automatically enforces configuration settings, eliminating the need for complex external scripts while maintaining configuration control. The agent acts as a dedicated mediator between the file system and MDM policies.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The file manager agent operates autonomously to detect file changes and self-correct configurations without external intervention. It continuously monitors the file system, compares actual states against desired configurations, and automatically remediates deviations, enabling the system to manage itself without requiring complex external scripting.

Inventive Principle:

Principle #25Self-service

2Reliability

If scripts run on a schedule to check file configurations, then configuration enforcement is achieved, but security vulnerabilities and time gaps are introduced

Engineering Contradiction:

Improveconfiguration enforcementVSAvoidtime gap

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The file manager agent runs continuously in the background rather than executing periodically on a schedule. It maintains constant surveillance of file system changes through FSEvents API, ensuring uninterrupted monitoring and immediate detection of configuration deviations, thereby eliminating time gaps where vulnerabilities could exist.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The agent implements continuous feedback loops by monitoring file system events in real-time, comparing current configurations against desired states, and immediately triggering remediation actions when deviations are detected. This real-time feedback mechanism eliminates the delays inherent in scheduled script execution.

Inventive Principle:

Principle #23Feedback

3Adaptability or versatility

If third-party agents run frequent checks, then configuration control is maintained, but computing power is consumed and system becomes too chatty

Engineering Contradiction:

Improveconfiguration controlVSAvoidcomputing power consumption

Core Design Contradiction:

Adaptability or versatilityVSUse of energy by moving object

Solution Approach 1:

Instead of continuous polling, the file manager agent leverages macOS FSEvents API to receive asynchronous notifications only when file system changes occur. This event-driven approach allows the agent to remain dormant during stable states and activate only when necessary, dramatically reducing computing power consumption while maintaining configuration control.

Inventive Principle:

Principle #19Periodic action

4Reliability

If complex scripts are used to manage files outside MDM scope, then configuration enforcement is achieved, but programming errors and cost increase

Engineering Contradiction:

Improveconfiguration enforcementVSAvoidprogramming complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces expensive, complex third-party scripting solutions with a lightweight, native file manager agent built using macOS APIs. This approach eliminates the need for sophisticated programming while achieving the same configuration enforcement goals, reducing both programming complexity and associated costs.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS11785469B1Secure MDM system for macOS, secure MDM platform, secure macOS mobile device and related method

Publication Date: 2023.10.10 GENDLER SOFTWARE LLC

AI summary

An MDM management system to manage files outside the scope of MDM for macOS, the management system. The system has an MDM platform for managing a plurality of mobile devices each with a macOS operating system, the MDM manager allowing for creation of configuration profiles for an array of files outside of the scope of MDM for macOS and the configuration profiles having defined content settings. The MDM manager manages a plurality of managed mobile devices having a file manager agent to receive the array of configuration profiles from the MDM manager, the mobile devices each having a module to detect a change in the file outside the scope of MDM for macOS and when the change occurs to check a content change against the defined content settings, and if the change deviates from one of the defined content settings, returning the file to the defined content settings of the configuration profile.