System and method for transferring device identifying information
Disclosed are various examples for transferring device identifying information during authentication. An enrollment request is received from a management component executed by a client device. A management service generates a unique device identifier for the client device and embeds it within a certificate to generate a device-identifying certificate. The management service instructs a certificate authority service to generate a public key that includes the unique device identifier and a private key for the client device, and provides the device-identifying certificate and the private key to the client device.
1. A system comprising:
a data store comprising executable instructions; and
at least one computing device comprising at least one processor, wherein the instructions, when executed by the at least one processor, cause the at least one computing device to at least;
receive, by a device management service for a corporate entity, an enrollment request to enroll in the device management service from a device management component executed by a client device, wherein the device management service manages access to corporate resources of the corporate entity and enforces corporate policies including one or more compliance rules on employee devices;
generate, by the device management service, a unique device identifier for the client device;
transmit over a network, from the device management service to a certificate authority service separate from the device management service, a message including instructions to generate a client key for the client device, the message further including the unique device identifier for the client device;
receive, at the device management service and from the certificate authority service, a private key for the client device and a device-identifying certificate generated from a public key for the client device, wherein the device identifier is embedded in the certificate and the device-identifying certificate enables authentication of the client device to access the corporate resources managed by the device management service;
transmit, by the device management service, the device-identifying certificate and the private key to the client device, wherein the client device uses the device-identifying certificate to obtain a ticket from a key distribution server;
receive a request to verify that the client device complies with the one or more compliance rules, the request including the unique device identifier of the client device extracted from the ticket that the client device obtained from the key distribution server; and
transmit a response to the request, the response containing an indication of whether the client device complies with the one or more compliance rules.
2. The system of claim 1 , wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:
generate, by the device management service, a managed device entry for the client device, the managed device entry comprising the unique device identifier, a user identification, and an indicium of enrollment of the client device.
3. The system of claim 1 , wherein the request to verify that the client device complies with the one or more compliance rules is received by the device management service from an identity provider service.
4. The system of claim 3 , wherein the response is transmitted from the device management service to the identity provider service.
5. The system of claim 1 , wherein the device management component of the client device sends the ticket to an identity provider service and wherein the identity provider service extracts the unique device identifier of the client device from the ticket.
6. The system of claim 5 , wherein the identity provider service is configured to cache the unique device identifier and session data that includes a most recent status of whether the client device complies with the one or more compliance rules.
7. A non-transitory computer-readable medium embodying executable instructions, wherein the instructions, when executed by at least one processor, cause at least one computing device to at least:
receive, by a device management service for a corporate entity, an enrollment request to enroll in the device management service from a device management component executed by a client device, wherein the device management service manages access to corporate resources of the corporate entity and enforces corporate policies on employee devices;
generate, by the device management service, a unique device identifier for the client device;
transmit over a network, from the device management service to a certificate authority service separate from the device management service, a message including instructions to generate a client key for the client device, the message further including the unique device identifier for the client device;
receive, at the device management service and from the certificate authority service, a private key for the client device and a device-identifying certificate generated from a public key for the client device, wherein the device identifier is embedded in the certificate and the device-identifying certificate enables authentication of the client device to access the corporate resources managed by the device management service;
transmit, by the device management service, the device-identifying certificate and the private key to the client device, wherein the client device uses the device-identifying certificate to obtain a ticket from a key distribution server;
receive a request to verify that the client device complies with one or more compliance rules, the request including the unique device identifier of the client device extracted from the ticket obtained from the key distribution server; and
transmit a response to the request, the response containing an indication of whether the client device complies with the one or more compliance rules.
8. The non-transitory computer-readable medium of claim 7 , wherein the instructions, when executed by the at least one processor, further cause the at least one computing device to at least:
generate, by the device management service, a managed device entry for the client device, the managed device entry comprising the unique device identifier, a user identification, and an indicia of enrollment of the client device.
9. The non-transitory computer-readable medium of claim 7 , wherein the request to verify that the client device complies with the one or more compliance rules is received by the device management service from an identity provider service.
10. The non-transitory computer-readable medium of claim 9 , wherein the response is transmitted from the device management service to the identity provider service.
11. The non-transitory computer-readable medium of claim 7 , wherein the device management component of the client device sends the ticket to an identity provider service and wherein the identity provider service extracts the unique device identifier of the client device from the ticket.
12. The non-transitory computer-readable medium of claim 11 , wherein the identity provider service is configured to cache the unique device identifier and session data that includes a most recent status of whether the client device complies with the one or more compliance rules.
13. A method performed by instructions executed in at least one computing device, the method comprising:
receiving, by a device management service for a corporate entity, an enrollment request to enroll in the device management service from a device management component executed by a client device, wherein the device management service manages access to corporate resources of the corporate entity and enforces corporate policies on employee devices;
generating, by the device management service, a unique device identifier for the client device;
transmitting over a network, from the device management service to a certificate authority service separate from the device management service, a message including instructions to generate a client key for the client device, the message further including the unique device identifier for the client device;
receiving, at the device management service and from the certificate authority service, a private key for the client device and a device-identifying certificate generated from a public key for the client device, wherein the device identifier is embedded in the certificate and the device-identifying certificate enables authentication of the client device to access the corporate resources managed by the device management service;
transmitting, by the device management service, the device-identifying certificate and the private key to the client device, wherein the client device uses the device-identifying certificate to obtain a ticket from a key distribution server;
receiving a request to verify that the client device complies with one or more compliance rules, the request including the unique device identifier of the client device extracted from the ticket obtained from the key distribution server; and
transmitting a response to the request, the response containing an indication of whether the client device complies with the one or more compliance rules.
14. The method of claim 13 , further comprising:
generating, by the device management service, a managed device entry for the client device, the managed device entry comprising the unique device identifier, a user identification, and an indicia of enrollment of the client device.
15. The method of claim 13 , wherein the request to verify that the client device complies with the one or more compliance rules is received by the device management service from an identity provider service.
16. The method of claim 15 , wherein the response is transmitted from the device management service to the identity provider service.
17. The method of claim 13 , wherein the device management component of the client device sends the ticket to an identity provider service and wherein the identity provider service extracts the unique device identifier of the client device from the ticket.