Secure management of devices
This document relates to a process for supporting the management of a variety of types of deployed devices. Administrators utilizing enterprise services can provide generic configuration data using configuration templates, which can be provided to a management server. The management server can then precompute device-specific configuration settings and resolve any conflicts that may arise based on the configuration templates. The configuration templates can also include placeholders for secret values, and once a managed device checks in to the management server, the secret values can be retrieved from an applicable enterprise service and provided to the managed device at the time of applying the configuration template.
1. A management server comprising:
a processor; and
a computer-readable storage media storing instructions that, when executed by the processor, cause the management server to configure a particular managed device by:
receiving a configuration template associated with the particular managed device, the configuration template including configuration data for a plurality of managed devices and placeholders for additional secret configuration data;
receiving a check-in request from the particular managed device;
based at least on the check-in request, determining a particular enterprise service associated with the particular managed device, the particular enterprise service being accessible to the management server over a computer network;
requesting the additional secret configuration data over the computer network from the particular enterprise service associated with the particular managed device; and
applying the configuration template, including the configuration data in the configuration template and the additional secret configuration data received from the particular enterprise service, to the particular managed device.
2. The management server of claim 1 , wherein the instructions, when executed by the processor, cause the management server to configure the particular managed device by:
receiving, from the particular enterprise service, the additional secret configuration data.
3. The management server of claim 2 , wherein the additional secret configuration data received from the particular enterprise service is encrypted.
4. The management server of claim 3 , wherein the additional secret configuration data is decrypted by the particular managed device and cannot be decrypted by the management server.
5. The management server of claim 1 , wherein the instructions, when executed by the processor, cause the management server to configure the particular managed device by:
precomputing configuration settings according to the configuration template for the particular managed device prior to receiving the check-in request.
6. The management server of claim 5 , wherein the configuration template defines the configuration data for the plurality of managed devices generically without regard to device implementation and the additional secret configuration data is device-specific for the particular managed device.
7. The management server of claim 6 , wherein the precomputed configuration settings include device-specific configuration settings for the particular managed device.
8. The management server of claim 1 , wherein the check-in request indicates a current state of the particular managed device.
9. The management server of claim 8 , wherein the instructions, when executed by the processor, cause the management server to configure the particular managed device by:
computing changes between the current state of the particular managed device and a state defined by the configuration template.
10. The management server of claim 9 , wherein the instructions, when executed by the processor, cause the management server to configure the particular managed device by:
periodically comparing the current state of the particular managed device to the state defined by the configuration template.
11. The management server of claim 1 , wherein the instructions, when executed by the processor, cause the management server to configure another managed device by:
receiving another check-in request from another managed device; and
applying, to the another managed device, the same configuration data applied to the particular managed device and different additional secret configuration data received from the particular enterprise service.
12. A method comprising:
receiving a check-in request relating to a device;
discovering an enterprise service associated with the device;
selecting a device template associated with the enterprise service that is to be applied to the device, the device template containing a placeholder for a secret value that is specific to the device;
retrieving the secret value from the enterprise service; and
applying configuration data associated with the device template to the device, the configuration data including the secret value that is specific to the device as well as other data that is applicable to other devices associated with the enterprise service.
13. The method of claim 12 , wherein the secret value is encrypted.
14. The method of claim 13 , performed by another device that cannot decrypt the secret value.
15. The method of claim 12 , wherein the check-in request includes a device state of the device.
16. The method of claim 15 , further comprising:
periodically comparing the device state to the device template; and
updating the device to match the device template when the device state is different from the device template.
17. The method of claim 16 , further comprising:
instructing the device to compare the device state periodically to the device template when the device is not connected to a network.
18. The method of claim 16 , wherein the device state is periodically compared to the device template irrespective of a user that is logged into the device.
19. A system comprising:
a platform management server comprising a processor and a memory storing computer-readable instructions that, when executed by the processor, cause the platform management server to:
receive a check-in request from a device;
determine, based at least on data in the check-in request, an enterprise service, from among a plurality of enterprise services, which is configured to manage configuration of the device;
receive, from the enterprise service, a configuration template containing configuration data applicable to multiple devices managed by the enterprise service and at least one placeholder or a secret value that is specific to the device; and
apply, to the device, the configuration data that is applicable to the multiple devices managed by the enterprise service and the secret value that is specific to the device.
20. The system of claim 19 , wherein the computer-readable instructions, when executed by the processor, cause the platform management server to:
precompute, from the configuration data, device-specific configuration settings that correspond to the device and apply the device-specific configuration settings to the device.