MDM Registration via Authentication Profile Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mobile device management (MDM) registration processes are vulnerable to security breaches as they involve sending sensitive credentials over untrusted communication links, which can be intercepted by unauthorized parties.
Innovation Solution
A device registration method that uses authentication profiles, such as Kerberos profiles, to facilitate registration without sending sensitive information over untrusted channels, utilizing a proxy server and authentication service to provide tokens for access to MDM services, ensuring secure communication and authentication without exposing passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional MDM registration processes send credentials over communication channels, then device registration can be completed, but security vulnerability increases due to potential interception by unauthorized parties
Solution Approach 1:
The patent introduces a proxy server as an intermediary component between the device and the MDM service. The proxy server receives authentication requests from devices and forwards them to the MDM service, acting as a mediator that prevents direct exposure of credentials over untrusted communication channels. This intermediary layer enhances security by controlling and monitoring the authentication flow without requiring devices to directly communicate with potentially vulnerable MDM service endpoints.
2Reliability
If authentication profiles are used without sending sensitive information, then security is improved, but registration complexity increases due to additional authentication service components
Solution Approach 1:
The patent segments the authentication process into distinct components: an authentication service that manages credential verification, a proxy server that handles request routing, and client devices that initiate authentication. This segmentation allows each component to have a specific security function, reducing the overall system complexity by distributing responsibilities rather than concentrating all authentication logic in a single complex module.
Solution Approach 2:
The authentication service acts as an intermediary that handles sensitive credential verification without requiring devices to directly communicate with the MDM service over untrusted channels. This mediator approach simplifies the device-side implementation while maintaining security, as devices only need to interact with the authentication service using standardized protocols rather than implementing complex security measures themselves.
3Ease of operation
If credentials are transmitted during registration, then device access to MDM services is enabled, but risk of security breach increases
Solution Approach 1:
The patent implements preliminary authentication through the authentication service before devices access MDM services. The authentication service pre-verifies device credentials and establishes trusted relationships in advance, creating security tokens or certificates that devices can use for subsequent access. This preliminary action eliminates the need for repeated credential transmission during MDM service access, reducing security breach risks while maintaining ease of operation.
Data Source
AI summary
Techniques of the present disclosure register a device to a mobile device management (MDM) network to enable access of the MDM network. In some embodiments, a registration service receives a request to register a device as a device managed by an enterprise associated with the registration service. In response, the registration service sends a response redirecting the device to authenticate via an authentication service, where the device is configured via an authentication profile to authenticate via the authentication service. The device sends a token issued by the authentication service of the enterprise. The registration service provides access to the registration service based the received token, including by allowing the registration service to be used to register the device as a device managed at least in part by the enterprise. The present techniques improve security of communications by registering a device without requiring input of sensitive authentication information.