Secondary device enrollment validation
In certain aspects, methods include, responsive to receiving verification that credentials associated with an organization device (OD) is authenticated, requesting the OD to create a token comprising a private and public key. The method includes receiving, subsequent to the OD initiating creation of the token, the public key from the OD. The method includes associating the public key with an UPN of the OD, and includes requesting the organization credentials from a secondary device (SD), responsive to detecting a request therefrom. The method includes requesting, responsive to authentication of the organization credentials, a challenge response from the SD. The method includes receiving the challenge response from the SD, which signed the challenge response with the private key that was transferred via the OD. The method includes determining, with the public key, whether the challenge response is valid, and includes validating enrollment of the SD when the challenge response is validated.
1. A computer-implemented method for enrollment validation of a secondary device, the computer-implemented method comprising:
responsive to receiving a verification that organization credentials associated with an organization owned device is authenticated, requesting the organization owned device to create a security token, wherein the security token comprises a private key and a public key;
receiving, subsequent to the organization owned device initiating creation of the security token, the public key from the organization owned device;
associating the public key with a User Principle Name associated with a user of the organization owned device;
responsive to detecting an enrollment request from the secondary device, requesting the organization credentials from the secondary device;
requesting, in response to the organization credentials from the secondary device being authenticated, a challenge response from the secondary device;
receiving the challenge response from the secondary device, wherein the challenge response is cryptographically signed by the secondary device with the private key, wherein the private key was transferred to the secondary device via the organization owned device;
determining, with the public key, whether the challenge response is valid; and
validating, based on determining the challenge response is valid, enrollment of the secondary device.
2. The computer-implemented method of claim 1 , wherein the private key is securely stored on the organization owned device.
3. The computer-implemented method of claim 1 , wherein the private key is transferred to the secondary device via syncing with the organization owned device and a cloud-based key management service.
4. The computer-implemented method of claim 1 , wherein the private key is transferred to the secondary device, via the organization owned device by one of QR code scanning, wireless transferring, near-field communication, and radio-frequency identification, wherein transfer of the private key occurs when the secondary device is in direct physical proximity to the organization owned device.
5. The computer-implemented method claim 1 , wherein associating the public key with the User Principle Name associated with the organization owned device comprises:
generating an authoritative certificate based on the public key; and
storing the authoritative certificate.
6. The computer-implemented method of claim 1 , wherein the verification that the organization credentials associated with the organization owned device is authenticated is performed via multi-factor authentication.
7. The computer-implemented method of claim 1 , wherein requesting, in response to the organization credentials from the secondary device being authenticated, the challenge response from the secondary device comprises:
receiving an authentication verification that the organization credentials associated with the organization owned device entered on the secondary device is authenticated.
8. The computer-implemented method of claim 7 , wherein the authentication verification that the organization credentials associated with an organization owned device entered on the secondary device is authenticated is performed via multi-factor authentication.
9. A system comprising:
a memory comprising instructions; and
a processor configured to execute the instructions which, when executed, cause the processor to:
responsive to receiving a verification that organization credentials associated with an organization owned device is authenticated, request the organization owned device to create a security token, wherein the security token comprises a private key and a public key;
receive, subsequent to the organization owned device initiating creation of the security token, the public key from the organization owned device;
associate the public key with a User Principle Name associated with a user of the organization owned device;
responsive to detecting an enrollment request from the secondary device, request the organization credentials from the secondary device;
request, in response to the organization credentials from the secondary device being authenticated, a challenge response from the secondary device;
receive the challenge response from the secondary device, wherein the challenge response is cryptographically signed by the secondary device with the private key, wherein the private key was transferred to the secondary device via the organization owned device;
determine, with the public key, whether the challenge response is valid; and
validate, based on determining the challenge response is valid, enrollment of the secondary device.
10. The system of claim 9 , wherein the private key is securely stored on the organization owned device.
11. The system of claim 9 , wherein the private key is transferred to the secondary device via syncing with the organization owned device and a cloud-based key management service.
12. The system of claim 9 , wherein the private key is transferred to the secondary device, via the organization owned device by one of QR code scanning, wireless transferring, near-field communication, and radio-frequency identification, wherein transfer of the private key occurs when the secondary device is in direct physical proximity to the organization owned device.
13. The system of claim 9 , wherein the processor is further configured to execute the instructions which, when executed, cause the processor to:
generate an authoritative certificate based on the public key; and
store the authoritative certificate.
14. The system of claim 13 , wherein the verification that the organization credentials associated with the organization owned device is authenticated is performed via multi-factor authentication.
15. The system of claim 9 , wherein the processor is further configured to execute the instructions which, when executed, cause the processor to:
receive an authentication verification that the organization credentials associated with the organization owned device entered on the secondary device is authenticated.
16. The system of claim 15 , wherein the authentication verification that the organization credentials associated with an organization owned device entered on the secondary device is authenticated is performed via multi-factor authentication.
17. A non-transitory machine-readable storage medium comprising machine-readable instructions for causing a processor to execute a method, the method comprising:
responsive to receiving a verification that organization credentials associated with an organization owned device is authenticated, requesting the organization owned device to create a security token, wherein the security token comprises a private key and a public key;
receiving, subsequent to the organization owned device initiating creation of the security token, the public key from the organization owned device;
associating the public key with a User Principle Name associated with a user of the organization owned device;
responsive to detecting an enrollment request from the secondary device, requesting the organization credentials from the secondary device;
requesting, in response to the organization credentials from the secondary device being authenticated, a challenge response from the secondary device;
receiving the challenge response from the secondary device, wherein the challenge response is cryptographically signed by the secondary device with the private key, wherein the private key was transferred to the secondary device via the organization owned device;
determining, with the public key, whether the challenge response is valid; and
validating, based on determining the challenge response is valid, enrollment of the secondary device.
18. The non-transitory machine-readable storage medium of claim 17 , wherein the private key is securely stored on the organization owned device.
19. The non-transitory machine-readable storage medium of claim 17 , wherein the private key is transferred to the secondary device via syncing with the organization owned device and a cloud-based key management service.
20. The non-transitory machine-readable storage medium of claim 17 , wherein the private key is transferred to the secondary device, via the organization owned device by one of QR code scanning, wireless transferring, near-field communication, and radio-frequency identification, wherein transfer of the private key occurs when the secondary device is in direct physical proximity to the organization owned device.