Multiple-persona on mobile devices
View Patent ↗Disclosed is a system and method of allowing multiple customer support organizations to establish virtual mobile management sessions with a mobile device using a multi-persona client on the mobile device that does not have to reconfigured for each of the multiple customer support organizations.
1. A method for remote management, the method comprising:
enabling a multi-persona client on a mobile device;
receiving an enrollment request from a vendor server;
confirming that the enrollment request is not from a home server;
transmitting an update policy request to the home server to incorporate any changes made on a multi-persona policy;
receiving an updated policy and home server signature;
requesting a vendor server certificate from the vendor server;
verifying the vendor server certificate with a multi-persona certificate chain, wherein the multi-persona certificate chain includes at least a root certificate and intermediate certificate;
transmitting an enrollment response to the vendor server upon successful verification to complete enrollment;
establishing a unique security association with the vendor server; and
maintaining multiple unique security associations with multiple vendors.
2. The method of claim 1 , wherein the multi-persona certificate chain includes a home persona certificate.
3. The method of claim 1 , further comprising:
receiving from the home server a policy to enable the multi-persona client on the mobile device.
4. The method of claim 3 , wherein the policy includes at least a multi-persona profile, audit profile, client behavior profile, security policies, bootstrap behavior, access control policy, and service control policy.
5. The method of claim 1 , wherein the multi-persona client is preloaded by a vendor for support to be provided by at least the vendor and other vendors.
6. The method of claim 1 , wherein the multi-persona client is post-loaded by a vendor for support to be provided by at least the vendor and other vendors.
7. The method of claim 1 , further comprising:
confirming the vendor certificate against a certificate revocation list.
8. The method of claim 7 , wherein the multi-persona client applies pre-negotiated policies and profiles for a given vendor during a remote management session.
9. The method of claim 1 , wherein the multiple vendors will each be identified by a Public Key Organization Identifier (PKOID).
10. The method of claim 9 , wherein enterprise vendors will be identified by a combination of the PKOID and a Public Key Organization Index (PKOI).
11. The method of claim 1 ,
wherein a Public Key Organization Identifier (PKOID) of intermediate certificates is sent to the vendor server, and further comprising:
verifying a published vendor certificate with the multi-persona certificate chain; and
saving the published vendor certificate upon successful verification.
12. The method of claim 1 , further comprising:
verifying the vendor server certificate against a certificate revocation list.
13. The method of claim 1 , further comprising:
establishing a remote management session with one vendor from the vendor server or multiple vendors;
verifying that the one vendor is not the home server;
sending an update multi-persona policy request to the home server;
receiving an updated policy and a home server signature;
verifying certificates from the one vendor with a certificate revocation list; and
connecting the remote management session with the one vendor upon successful verification.
14. The method of claim 1 , further comprising:
receiving an enrollment request from a home server;
matching a server address of the enrollment request with a pre-configured home profile address on a condition that a home profile is pre-configured on the mobile device;
transmitting a server certificate request with a Public Key Organization Identifier (PKOID) of intermediate certificates;
verifying server certificate with a pre-configured home certificate;
verifying the server certificate with the multi-persona certificate chain;
verifying the server certificate against a certificate revocation list; and
transmitting an enrollment response to the home server upon successful verification to complete home server enrollment.
15. The method of claim 1 , further comprising:
transmitting a vendor server certificate request with a Public Key Organization Identifier (PKOID) of intermediate certificates on a condition that home profile configuration is absent; and
verifying the vendor server certificate against a certificate revocation list.
16. A mobile device, comprising:
a multi-persona client;
a multi-persona certificate chain, wherein the multi-persona certificate chain includes at least a root certificate and intermediate certificate; and
unique security associations with multiple vendors established and maintained using the multi-persona certificate chain to verify the multiple vendor certificates, wherein:
the mobile device is configured to establish a remote management session with a vendor server from the multiple vendors;
the multi-persona client is configured to verify that the vendor server is not a home server;
the multi-persona client is configured to send an update multi-persona policy request to the home server;
the multi-persona client is configured to receive an updated policy and a home server signature;
the multi-persona client is configured to verify certificates from the vendor server with a certificate revocation list; and
the mobile device is configured to connect the remote management session with the vendor server upon successful verification.
17. The mobile device of claim 16 , wherein the multi-persona certificate chain includes a home persona certificate.
18. The mobile device of claim 16 , further comprising:
a policy to enable the multi-persona client on the mobile device.
19. The mobile device of claim 16 , wherein the policy includes at least a multi-persona profile, audit profile, client behavior profile, security policies, bootstrap behavior, access control policy, and service control policy.
20. The mobile device of claim 16 , wherein the multi-persona client is preloaded by a vendor for support to be provided by at least the vendor and other vendors.
21. The mobile device of claim 16 , wherein the multi-persona client is post-loaded by a vendor for support to be provided by at least the vendor and other vendors.
22. The mobile device of claim 16 , wherein the multiple vendors are identified by a Public Key Organization Identifier (PKOID).
23. The mobile device of claim 22 , wherein enterprise vendors are identified by a combination of the PKOID and a Public Key Organization Index (PKOI).
24. The mobile device of claim 16 , wherein the multi-persona client applies pre-negotiated policies and profiles for a given vendor during a remote management session.
25. The mobile device of claim 16 , wherein:
the mobile device is configured to receive an enrollment request from the vendor server;
the mobile device is configured to request a vendor certificate, wherein a Public Key Organization Identifier (PKOID) of intermediate certificates is sent to the vendor server:
the multi-persona client is configured to verify a published vendor certificate with the multi-persona certificate chain; and
the multi-persona client is configured to save the published vendor certificate upon successful verification.
26. The mobile device of claim 16 , wherein:
the mobile device is configured to receive an enrollment request from the vendor server;
the multi-persona client is configured to confirm that the enrollment request is not from a home server;
the multi-persona client is configured to process an updated policy and home server signature;
the multi-persona client is configured to request a vendor server certificate from the vendor server;
the multi-persona client is configured to verify vendor server certificates with the multi-persona certificate chain; and
the multi-persona client is configured to send an enrollment response to the vendor server upon successful verification to complete enrollment and establish the unique security association with the vendor server.
27. The mobile device of claim 16 , further comprising:
the mobile device is configured to receive an enrollment request from a home server;
the multi-persona client is configured to match a server address of the enrollment request with a pre-configured home profile address on a condition that a home profile is pre-configured on the mobile device;
the mobile device is configured to transmit a server certificate request with a Public Key Organization Identifier (PKOID) of intermediate certificates;
the multi-persona client is configured to verify server certificate with a pre-configured home certificate;
the multi-persona client is configured to verify the server certificate with the multi-persona certificate chain;
the multi-persona client is configured to verify the server certificate against a certificate revocation list; and
the mobile device is configured to transmit an enrollment response to the home server upon successful verification to complete home server enrollment.
28. The mobile device of claim 16 , further comprising:
the mobile device is configured to receive an enrollment request from the vendor server;
the mobile device is configured to transmit a vendor server certificate request with a Public Key Organization Identifier (PKOID) of intermediate certificates on a condition that a home profile is absent;
the multi-persona client is configured to verify a vendor server certificate with the multi-persona certificate chain;
and
the mobile device is configured to transmit an enrollment response to the vendor server upon successful verification to complete enrollment and establish the unique security association with the vendor server.
29. The mobile device of claim 16 , further comprising:
at least one default home profile.
30. A method for remote management, the method comprising:
enabling a multi-persona client on a mobile device;
receiving an enrollment request from a home server;
matching a server address of the enrollment request with a pre-configured home profile address on a condition that a home profile is pre-configured on the mobile device;
transmitting a server certificate request with a Public Key Organization Identifier (PKOID) of intermediate certificates;
verifying server certificate with a pre-configured home certificate;
verifying the server certificate with a multi-persona certificate chain, herein the multi-persona certificate chain includes at least a root certificate and intermediate certificate;
verifying the server certificate against a certificate revocation list;
transmitting an enrollment response to the home server upon successful verification to complete home server enrollment;
establishing a unique security association with a vendor server using the multi-persona certificate chain to verify a vendor certificate; and
maintaining multiple unique security associations with multiple vendor servers.
31. A mobile device, comprising:
a multi-persona client;
a multi-persona certificate chain, wherein the multi-persona certificate chain includes at least a root certificate and intermediate certificate; and
unique security associations with multiple vendor servers established and maintained using the multi-persona certificate chain to verify the multiple vendor certificates, wherein:
the mobile device is configured to receive an enrollment request from a vendor server;
the multi-persona client is configured to confirm that the enrollment request is not from a home server;
the multi-persona client is configured to send an update policy request to the home server to incorporate any changes made on a multi-persona policy;
the multi-persona client is configured to process an updated policy and home server signature;
the multi-persona client is configured to request a vendor server certificate from the vendor server;
the multi-persona client is configured to verify vendor server certificates with the multi-persona certificate chain; and
the multi-persona client is configured to send an enrollment response to the vendor server upon successful verification to complete enrollment and establish the unique security association with the vendor server.