Dynamic group membership for devices
Some embodiments provide a method for a first device that identifies definitions of different groups of devices, each of which is defined by a set of properties required for a device to be a member. The method monitors properties of the first device to determine when the device is eligible for membership in a group. When the first device is eligible for membership in a first group of which the device is not a member, the method sends an application for membership in the first group signed with at least a private key of the device to at least one other device that is a member of the first group. When the first device becomes ineligible for membership in a second group of which the first device is a member, the method removes the device from the second group and notifies other devices that are members of the second group.
1. A method, comprising, by a first device:
detecting a change to at least one property of the first device, wherein the first device is included in a first verification sub-group;
identifying qualifications for being included in the first verification sub-group;
determining, based on the qualifications, that the change renders the first device ineligible to be included in the first verification sub-group;
issuing, to at least one other device included in the first verification sub-group, a request to remove the first device from the first verification sub-group;
identifying a first synchronization sub-group and a second synchronization sub-group in which the first device participates;
determining that:
the first device is ineligible to participate in the first synchronization sub-group after being removed from the first verification sub-group, and
the first device is remains eligible to participate in the second synchronization sub-group after being removed from the first verification sub-group; and
removing first data items associated with the first synchronization sub-group while maintaining second data items associated with the second synchronization sub-group.
2. The method of claim 1 , wherein the first verification sub-group requires installation of a certain operating system to be eligible to be included in the first verification sub-group.
3. The method of claim 1 , wherein the first device remains eligible to be included in a second verification sub-group.
4. The method of claim 1 , further comprising:
receiving, from at least one other device included in the first verification sub-group, an indication that the first device has been removed from the first verification sub-group.
5. The method of claim 1 , further comprising:
synchronizing the second data items with a second device that is included in a second verification sub-group in which the first device is still included.
6. The method of claim 1 , wherein the at least one property comprises a software aspect or a hardware aspect of the first device.
7. The method of claim 6 , wherein the at least one property comprises at least one of:
an operating system of the first device;
a remote wipe capability of the first device;
a password strength of a master password assigned on the first device;
an inclusion of a biometric hardware sensor within the first device; or
an inclusion of a secure processor within the first device.
8. A first device, comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the first device to carry out steps that include:
detecting a change to at least one property of the first device, wherein the first device is included in a first verification sub-group;
identifying qualifications for being included in the first verification sub-group;
determining, based on the qualifications, that the change renders the first device ineligible to be included in the first verification sub-group;
issuing, to at least one other device included in the first verification sub-group, a request to remove the first device from the first verification sub-group;
identifying a first synchronization sub-group and a second synchronization sub-group in which the first device participates;
determining that:
the first device is ineligible to participate in the first synchronization sub-group after being removed from the first verification sub-group, and
the first device is remains eligible to participate in the second synchronization sub-group after being removed from the first verification sub-group; and
removing first data items associated with the first synchronization sub-group while maintaining second data items associated with the second synchronization sub-group.
9. The first device of claim 8 , wherein the first verification sub-group requires installation of a certain operating system to be eligible to be included in the first verification sub-group.
10. The first device of claim 8 , wherein the first device remains eligible to be included in a second verification sub-group.
11. The first device of claim 8 , wherein the steps further include:
receiving, from at least one other device included in the first verification sub-group, an indication that the first device has been removed from the first verification sub-group.
12. The first device of claim 8 , wherein the steps further include:
synchronizing data items with a second device that is included in a second verification sub-group in which the first device is still included.
13. The first device of claim 8 , wherein the at least one property comprises a software aspect or a hardware aspect of the first device.
14. The first device of claim 13 , wherein the at least one property comprises at least one of:
an operating system of the first device;
a remote wipe capability of the first device;
a password strength of a master password assigned on the first device;
an inclusion of a biometric hardware sensor within the first device; or
an inclusion of a secure processor within the first device.
15. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a first device, cause the first device to carry out steps that include:
detecting a change to at least one property of the first device, wherein the first device is included in a first verification sub-group;
identifying qualifications for being included in the first verification sub-group;
determining, based on the qualifications, that the change renders the first device ineligible to be included in the first verification sub-group;
issuing, to at least one other device included in the first verification sub-group, a request to remove the first device from the first verification sub-group;
identifying a first synchronization sub-group and a second synchronization sub-group in which the first device participates;
determining that:
the first device is ineligible to participate in the first synchronization sub-group after being removed from the first verification sub-group, and
the first device is remains eligible to participate in the second synchronization sub-group after being removed from the first verification sub-group; and
removing first data items associated with the first synchronization sub-group while maintaining second data items associated with the second synchronization sub-group.
16. The non-transitory computer readable storage medium of claim 15 , wherein the first verification sub-group requires installation of a certain operating system to be eligible to be included in the first verification sub-group.
17. The non-transitory computer readable storage medium of claim 15 , wherein the first device remains eligible to be included in a second verification sub-group.
18. The non-transitory computer readable storage medium of claim 15 , wherein the steps further include:
receiving, from at least one other device included in the first verification sub-group, an indication that the first device has been removed from the first verification sub-group.
19. The non-transitory computer readable storage medium of claim 15 , wherein the steps further include:
synchronizing data items with a second device that is included in a second verification sub-group in which the first device is still included.
20. The non-transitory computer readable storage medium of claim 15 , wherein the at least one property comprises a software aspect or a hardware aspect of the first device, and wherein the at least one property comprises at least one of:
an operating system of the first device;
a remote wipe capability of the first device;
a password strength of a master password assigned on the first device;
an inclusion of a biometric hardware sensor within the first device; or
an inclusion of a secure processor within the first device.