Accessing corporate resources through an enrolled user device
Systems and methods are described for accessing resources of a Unified Endpoint Management (“UEM”) system through an enrolled device. In an example, an unenrolled device can be paired with an enrolled device. The unenrolled device can connect to the enrolled device on a local network. The enrolled device can verify the unenrolled device using a key provided during pairing. The unenrolled device can send requests for UEM resources to the enrolled device, which the enrolled device can send to a UEM server. The UEM server can send the requested UEM resources to the enrolled device, and the enrolled device can send the UEM resources to the enrolled device over the local network.
1. A method for accessing system resources from an unenrolled user device, comprising:
pairing a first user device with a second user device, wherein
the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system,
the second user device includes a managed web browser that is managed by the device management system,
the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and
the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device;
receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device;
receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key;
determining, by the first user device, that the resource request came from the second user device based on the random key;
sending, by the first user device, the resource request to a server associated with the device management system;
receiving, at the first user device, the requested resource from the server; and
sending, by the first user device, the requested resource to the managed web browser of the second user device.
2. The method of claim 1 , wherein the pairing further includes:
providing, by the first user device, a local network address of the first user device;
receiving, at the first user device, a connection request from the second user device;
displaying, on the first user device, a first randomly generated number; and
receiving user input indicating that the first randomly generated number matches a second number displayed on the second user device.
3. The method of claim 1 , wherein, prior to the resource request being received at the first user device, the method further comprises:
detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and
providing, by the first user device, a local network address of the first user device to the second user device.
4. The method of claim 1 , further comprising:
receiving, at the first user device, a first public encryption key from the second user device;
sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key;
decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and
sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key.
5. The method of claim 1 , wherein the second user device is an Internet of Things device.
6. The method of claim 1 , wherein the device management system is a Unified Endpoint Management system.
7. A non-transitory, computer-readable medium containing instructions that are executed by a hardware-based processor to perform stages for accessing system resources from an unenrolled user device, the stages comprising:
pairing a first user device with a second user device, wherein
the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system,
the second user device includes a managed web browser that is managed by the device management system,
the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and
the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device;
receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device;
receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key;
determining, by the first user device, that the resource request came from the second user device based on the random key;
sending, by the first user device, the resource request to a server associated with the device management system;
receiving, at the first user device, the requested resource from the server; and
sending, by the first user device, the requested resource to the managed web browser of the second user device.
8. The non-transitory, computer-readable medium of claim 7 , wherein the pairing further includes:
providing, by the first user device, a local network address of the first user device;
receiving, at the first user device, a connection request from the second user device;
displaying, on the first user device, a first randomly generated number; and
receiving user input indicating that the first randomly generated number matches a second randomly generated number displayed on the second user device.
9. The non-transitory, computer-readable medium of claim 7 , wherein, prior to the resource request being received at the first user device, the stages further comprise:
detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and
providing, by the first user device, a local network address of the first user device to the second user device.
10. The non-transitory, computer-readable medium of claim 7 , the stages further comprising:
receiving, at the first user device, a first public encryption key from the second user device;
sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key;
decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and
sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key.
11. The non-transitory, computer-readable medium of claim 7 , wherein the second user device is an Internet of Things device.
12. The non-transitory, computer-readable medium of claim 7 , wherein the device management system is a Unified Endpoint Management system.
13. A system for accessing system resources from an unenrolled user device, comprising:
a memory storage including a non-transitory, computer-readable medium comprising instructions; and
a computing device including a hardware-based processor that executes the instructions to carry out stages comprising:
pairing a first user device with a second user device, wherein
the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system,
the second user device includes a managed web browser that is managed by the device management system,
the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and
the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device;
receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device;
receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key;
determining, by the first user device, that the resource request came from the second user device based on the random key;
sending, by the first user device, the resource request to a server associated with the device management system;
receiving, at the first user device, the requested resource from the server; and
sending, by the first user device, the requested resource to the managed web browser of the second user device.
14. The system of claim 13 , wherein the pairing further includes:
providing, by the first user device, a local network address of the first user device;
receiving, at the first user device, a connection request from the second user device;
displaying, on the first user device, a first randomly generated number; and
receiving user input indicating that the first randomly generated number matches a second number displayed on the second user device.
15. The system of claim 13 , wherein, prior to the resource request being received at the first user device, the stages further comprise:
detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and
providing, by the first user device, a local network address of the first user device to the second user device.
16. The system of claim 13 , the stages further comprising:
receiving, at the first user device, a first public encryption key from the second user device;
sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key;
decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and
sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key.
17. The system of claim 13 , wherein the second user device is an Internet of Things device.