Determining a device posture using a device posture token
Disclosed are various approaches for generating a device posture token corresponding to a client device. The device posture token can be used by a verification computing device to determine whether the client device complies with the security policies of a particular facility.
1. A system for generating a device posture token, comprising:
at least one computing device comprising a processor and a memory; and
a device token generator executable by the at least one computing device, the device token generator causing the at least one computing device to at least:
obtain a request for a device posture token associated with a client device;
determine a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generate the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypt the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device;
cause the encrypted device posture token to be accessible to the client device.
2. The system of claim 1 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.
3. The system of claim 1 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.
4. The system of claim 1 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.
5. The system of claim 1 , wherein the device posture token is encrypted with a private key associated with the device token generator.
6. The system of claim 5 , wherein a trust relationship is established between a verification computing device and the at least one computing device by causing a public key corresponding to the private key to be accessible to the verification computing device.
7. The system of claim 6 , wherein a verification computing device is configured to decrypt the device posture token using the public key corresponding to the private key.
8. A method for generating a device posture token, comprising:
obtaining a request for a device posture token associated with a client device;
determining a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generating the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypting the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device; and
causing the encrypted device posture token to be accessible to the client device.
9. The method of claim 8 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.
10. The method of claim 8 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.
11. The method of claim 8 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.
12. The method of claim 8 , wherein the device posture token is encrypted with a private key associated with a device token generator configured to generate the device posture token.
13. The method of claim 12 , wherein a trust relationship is established with a verification computing device by causing a public key corresponding to the private key to be accessible to the verification computing device.
14. The method of claim 13 , wherein a verification computing device is configured to decrypt the device posture token using the public key corresponding to the private key.
15. A non-transitory computer-readable medium comprising machine-readable instructions for generating a device posture token, wherein when executed by a processor of at least one computing device, the machine-readable instructions cause the at least one computing device to at least:
obtain a request for a device posture token associated with a client device;
determine a device compliance status associated with the client device, the device compliance status indicating compliance with a plurality of compliance rules enforced by a management service executed remotely from the client device with which the client device is enrolled as a managed device, wherein the client device is enrolled as a managed device with the management service and a management component is installed on the client device with administrative privileges on the client device;
generate the device posture token, wherein the device compliance status is embedded within the device posture token;
encrypt the device posture token using a public key corresponding to the management service, wherein a private key corresponding to the public key is withheld from the client device; and
cause the encrypted device posture token to be accessible to the client device.
16. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises an alphanumeric value embedded in a quick-response code displayed by the client device.
17. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises a representation of the device compliance status of the client device, the representation of the device compliance status identifying whether the client device complies with a plurality of compliance rules associated with the client device.
18. The non-transitory computer-readable medium of claim 15 , wherein the device posture token comprises an identity of applications installed on the client device or an indication of whether a hardware feature or software feature has been enabled or disabled on the client device.
19. The non-transitory computer-readable medium of claim 15 , wherein the device posture token is encrypted with a private key associated with the management service.
20. The non-transitory computer-readable medium of claim 19 , wherein a verification computing device is configured to decrypt the device posture token using a public key corresponding to the private key.