IP Library Granted Patent US 10,587,485
Granted Patent B2
US 10,587,485 · App. 16/413,126 · Granted Mar 10, 2020

Federated mobile device management

Inventors: Daniel Quintas (Atlanta, GA); Anthony Kueh (Palo Alto, CA)
Assignee: AIRWATCH LLC
H04L43/04H04L41/046H04L41/28H04L63/0823H04L63/20
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,587,485
App. No.
16/413,126
Granted
Mar 10, 2020
Kind
B2
Abstract

In one example of federated mobile device management, a first management server federates with a second management server based on an exchange of one or more identity authentication certificates between them. After the first and second management servers have federated or affiliated, they can exchange mobile device management data, including compliance policies, rules, resources, etc., with each other. Based on a request from a client device for affiliated mobile device management, the first management server can request and receive device management data from the second management device. The first management server can evaluate the device management data received from the second management device for conformity with a baseline management policy. If it conforms, the first management server can use the device management data from the second management server, at least in part, to manage the client device.

Claims (59)

1. A non-transitory computer-readable medium embodying program code for affiliated device management executable in at least one computing device, the program code, when executed by the at least one computing device, being configured to cause the at least one computing device to at least:

identify a request for a client device to be managed by a second management service;

authenticate the second management service for federated device management of the client device with a first management service;

receive device management data from the second management service; and

evaluate the device management data from the second management service for conformity with a baseline management policy of the first management service.

2. The non-transitory computer-readable medium according to claim 1 , wherein the program code is further configured to cause the at least one computing device to at least:

in an instance in which the device management data from the second management service is in conformity with the baseline management policy, assimilate at least a portion of the device management data from the second management service into federated management data for management of the client device by the first management service.

3. The non-transitory computer-readable medium according to claim 2 , wherein the program code is further configured to cause the at least one computing device to at least:

after at least the portion of the device management data from the second management service is assimilated into the federated management data, notify the client device to check in for a device management update.

4. The non-transitory computer-readable medium according to claim 3 , wherein:

the federated management data comprises a combination of the device management data from the second management service and device management data from the first management service; and

the device management update includes the federated management data.

5. The non-transitory computer-readable medium according to claim 1 , wherein the program code is further configured to cause the at least one computing device to at least:

in an instance in which the device management data from the second management service is not in conformity with the baseline management policy, notify the second management service that the device management data is not in conformity.

6. The non-transitory computer-readable medium according to claim 1 , wherein the program code is further configured to cause the at least one computing device to at least:

redirect the client device to the second management service for authentication with the second management service in response to the request for the client device to be managed by the second management service.

7. The non-transitory computer-readable medium according to claim 1 , wherein the program code is further configured to cause the at least one computing device to at least:

cause the client device to be managed by the first management service based at least in part on the device management data from the second management service;

monitor the client device for non-compliance with at least one policy of the device management data from the second management service; and

notify the second management service of the non-compliance.

8. The non-transitory computer-readable medium according to claim 1 , wherein the program code is further configured to cause the at least one computing device to at least:

identify a change in affiliation associated with at least one of the client device or the second management service; and

notify the client device to check in for a device management update based on the change in affiliation.

9. A method for affiliated device management, comprising:

identifying, by a first management computing device implementing a first management service, a request for a client device to be managed by a second management service;

authenticating, by the first management computing device, the second management service for federated device management of the client device with the first management service;

receiving, by the first management computing device, device management data from the second management service; and

evaluating, by the first management computing device, the device management data from the second management service for conformity with a baseline management policy of the first management service.

10. The method according to claim 9 , further comprising:

in an instance in which the device management data from the second management service is in conformity with the baseline management policy, assimilating, by the first management computing device, at least a portion of the device management data from the second management service into federated management data for management of the client device by the first management service.

11. The method according to claim 10 , wherein the federated management data comprises a combination of the device management data from the second management service and device management data from the first management service.

12. The method according to claim 11 , further comprising:

after the assimilating, notifying, by the first management computing device, the client device to check in for a device management update, wherein:

the device management update includes the federated management data.

13. The method according to claim 9 , further comprising:

in an instance in which the device management data from the second management service is not in conformity with the baseline management policy, notifying, by the first management computing device, the second management service that the device management data from the second management service is not in conformity.

14. The method according to claim 9 , further comprising:

redirecting, by the first management computing device, the client device to the second management service for authentication in response to receiving the request from the client device to be managed by a second management service.

15. The method according to claim 9 , further comprising:

causing, by the first management computing device, the client device to be managed by the first management service based at least in part on the device management data from the second management service;

monitoring, by the first management computing device, the client device for non-compliance with at least one policy of the device management data from the second management service; and

notifying, by the first management computing device, the second management service of the non-compliance.

16. The method according to claim 9 , further comprising:

identifying, by the first management computing device, a change in affiliation associated with at least one of the client device or the second management service; and

notifying, by the first management computing device, the client device to check in for a device management update based on the change in affiliation.

17. A system for affiliated device management, comprising:

at least one memory device to store computer-readable instructions thereon; and

a first management computing device implementing a first management service and configured, through execution of the computer-readable instructions, to at least:

receive a request from a client device for affiliated device management with a second management service;

federate with the second management service based on an exchange of at least one identity certificate of a second management computing device implementing the second management service;

receive device management data from the second management service; and

evaluate the device management data from the second management service for conformity with a baseline management policy of the first management service.

18. The system according to claim 17 , wherein the first management computing device is further configured to at least:

in an instance in which the device management data from the second management service is in conformity with the baseline management policy, assimilate at least a portion of the device management data from the second management service into federated management data for management of the client device by the first management service; and

notify the client device to check in for the federated management data.

19. The system according to claim 18 , wherein the federated management data comprises a combination of the device management data from the second management service and device management data from the first management service.

20. The system according to claim 18 , wherein the first management computing device is further configured to at least:

monitor the client device for non-compliance with at least one policy of the device management data from the second management service; and

notify the second management service of the non-compliance.

Assignments (2)
PATENT ASSIGNMENT Recorded Aug 5, 2024
From: AIRWATCH LLC
To: OMNISSA, LLC
Reel/Frame 068327/0670 →
SECURITY INTEREST Recorded Jul 3, 2024
From: OMNISSA, LLC
To: UBS AG, STAMFORD BRANCH
Reel/Frame 068118/0004 →
Continuity (2)
Continuation 15296295 · Oct 18, 2016
Related Publication 20190268246A1 · Aug 29, 2019