Configuration profile validation on IOS using SSL and redirect
View Patent ↗An application management agent running on a wireless communications device restricts access to device functionality (e.g., applications and device features) unless the application management agent has determined that a particular configuration profile has been installed on the device (after which the application management agent permits access to device functionality, and an operating system of the device enforces policy settings specified in the configuration profile). The application management agent confirms the presence of the configuration profile by initiating an SSL handshake with a client certificate request for a client SSL certificate embedded in the configuration profile. Validation against the embedded client SSL certificate implicitly confirms the presence of the configuration profile and validates the content of the configuration profile.
1. A method to confirm that a configuration profile has been installed on a mobile device, comprising:
receiving, by an application installed on the mobile device and configured to permit or deny access to certain resources on the device, an https server certificate, a first copy of a client SSL certificate, and a first copy of a root certificate from a server that has previously transmitted a configuration profile to the mobile device;
requesting the operating system to launch a web browser using a loopback URL, wherein the loopback URL points to an https server run by the application, wherein the https server certificate is installed on the https server;
presenting, by the web browser, the client SSL certificate to the https server in response to a client certificate request received during an SSL handshake;
determining, by the application, that the first copy of the client SSL certificate matches a second copy of the client SSL certificate specified by the configuration profile;
receiving a confirmation from the application that the client SSL certificate is trusted if the configuration profile has been installed by the operation system, the SSL handshake was successfully completed, and the first copy of the client SSL certificate matches the second copy of the client SSL certificate; and
permitting, by the application, access to the certain resources on the device.
2. The method of claim 1 , wherein the certain resources on the device include a plurality of business-related applications that are configured to access data managed by an employer of an owner of the mobile device.
3. The method of claim 2 , wherein the configuration profile specifies security-related properties that include VPN settings that enable the business-related applications to securely communicate with servers managed by the employer.
4. The method of claim 1 , further comprising:
determining that the SSL handshake was not successfully completed;
requesting the operating system to redirect the web browser to a URL pointing at the server that had previously transmitted the configuration profile to the mobile device; and
downloading a signed copy of the configuration profile for installation, wherein the signed copy was signed by the root certificate.
5. The method of claim 4 , further comprising:
receiving a request for removal of the configuration profile through the application.
6. The method of claim 1 , wherein the configuration profile is encrypted and signed.
7. The method of claim 1 , further comprising:
provisioning the configuration profile to the device by over-the-air transmission, an email, a URL, or a direct physical connection.
8. A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method to confirm that a configuration profile has been installed on a mobile device, comprising:
receiving, by an application installed on the mobile device and configured to permit or deny access to certain resources on the device, an https server certificate, a first copy of a client SSL certificate, and a first copy of a root certificate from a server that has previously transmitted a configuration profile to the mobile device;
requesting the operating system to launch a web browser using a loopback URL, wherein the loopback URL points to an https server run by the application, wherein the https server certificate is installed on the https server;
presenting, by the web browser, the client SSL certificate to the https server in response to a client certificate request received during an SSL handshake;
determining, by the application, that the first copy of the client SSL certificate matches a second copy of the client SSL certificate specified by the configuration profile;
receiving a confirmation from the application that the client SSL certificate is trusted if the configuration profile has been installed by the operation system, the SSL handshake was successfully completed, and the first copy of the client SSL certificate matches the second copy of the client SSL certificate; and
permitting, by the application, access to the certain resources on the device.
9. The non-transitory computer readable medium of claim 8 , wherein the certain resources on the device include a plurality of business-related applications that are configured to access data managed by an employer of an owner of the mobile device.
10. The non-transitory computer readable medium of claim 9 , wherein the configuration profile specifies security-related properties that include VPN settings that enable the business-related applications to securely communicate with servers managed by the employer.
11. The non-transitory computer readable medium of claim 8 , further comprising:
determining that the SSL handshake was not successfully completed;
requesting the operating system to redirect the web browser to a URL pointing at the server that had previously transmitted the configuration profile to the mobile device; and
downloading a signed copy of the configuration profile for installation, wherein the signed copy was signed by the root certificate.
12. The non-transitory computer readable medium of claim 11 , further comprising:
receiving a request for removal of the configuration profile through the application.
13. The non-transitory computer readable medium of claim 8 , wherein the configuration profile is encrypted and signed.
14. The non-transitory computer readable medium of claim 8 , further comprising:
provisioning the configuration profile to the device by over-the-air transmission, an email, a URL, or a direct physical connection.
15. A mobile device, comprising:
a local storage; and
a processor configured to execute instructions stored in the local storage to:
receive, by an application installed on the mobile device and configured to permit or deny access to certain resources on the device, an https server certificate, a first copy of a client SSL certificate, and a first copy of a root certificate from a server that has previously transmitted
a configuration profile to the mobile device;
request the operating system to launch a web browser using a loop back URL, wherein the loopback URL points to an https server run by the application, wherein the https server certificate is installed on the https server;
present, by the web browser, the client SSL certificate to the https server in response to a client certificate request received during an SSL handshake;
determine, by the application, that the first copy of the client SSL certificate matches a second copy of the client SSL certificate specified by the configuration profile;
receive a confirmation from the application that the client SSL certificate is trusted if the configuration profile has been installed by the operation system, the SSL handshake was successfully completed, and the first copy of the client SSL certificate matches the second copy of the client SSL certificate; and
permit, by the application, access to the certain resources on the device.
16. The mobile device of claim 15 , wherein the certain resources on the device include a plurality of business-related applications that are configured to access data managed by an employer of an owner of the mobile device.
17. The mobile device of claim 16 , wherein the configuration profile specifies security related properties that include VPN settings that enable the business-related applications to securely communicate with servers managed by the employer.
18. The mobile device of claim 15 , wherein the processor is further configured to:
determine that the SSL handshake was not successfully completed;
request the operating system to redirect the web browser to a URL pointing at the server that had previously transmitted the configuration profile to the mobile device; and
download a signed copy of the configuration profile for installation, wherein the signed copy was signed by the root certificate.
19. The mobile device of claim 18 , wherein the processor is further configured to receive a request for removal of the configuration profile through the application.
20. The mobile device of claim 15 , wherein the configuration profile is encrypted and signed.