Universal device identifiers and signal exchange collaboration
In certain aspects of the disclosure, a computer-implemented method includes enrolling, at a mobile device management service, at least one managed device. The method includes receiving a client certificate on the at least one managed device. The method includes integrating, via a trusted ecosystem vendor app on the at least one managed device, a universal device identifier SDK. The method includes retrieving, by the universal device identifier SDK based on a request from the trusted ecosystem vendor app, a pre-salted device identifier address associated with the at least one managed device. The method includes transmitting, by the at least one managed device via the trusted ecosystem vendor, the pre-salted device identifier address to a security vendor service for generating a universal device identifier address. The method includes receiving, from the security vendor service by the at least one managed device via the trusted ecosystem vendor, the universal device identifier address.
1 . A computer-implemented method for generating universal device identifiers, the method comprising:
enrolling, at a mobile device management service, at least one managed device;
receiving a client certificate on the at least one managed device;
integrating, via a trusted ecosystem vendor app on the at least one managed device, a universal device identifier SDK (software development kit);
retrieving, by a universal device identifier endpoint SDK based on a request from the trusted ecosystem vendor app, a pre-salted device identifier address associated with the at least one managed device;
transmitting, by the at least one managed device via the trusted ecosystem vendor, the pre-salted device identifier address to a security vendor service for generating a universal device identifier address; and
receiving, from the security vendor service by the at least one managed device via the trusted ecosystem vendor, the universal device identifier address.
2 . The computer-implemented method of claim 1 , wherein receiving the client certificate comprises:
generating a private key for the client certificate on the at least one managed device.
3 . The computer-implemented method of claim 2 , wherein the private key is non-exportable.
4 . The computer-implemented method claim 2 , wherein the private key is generated via a hardware-backed keystore.
5 . The computer-implemented method of claim 4 , wherein retrieving the pre-salted device identifier address comprises:
validating a trust chain of the client certificate;
generating a nonce to challenge the hardware-backed keystore;
transmitting the nonce to the hardware-backed keystore referencing the client certificate;
receiving, based on the private key, a signed nonce challenge response and corresponding public key;
validating the nonce challenge response using the corresponding public key that was returned;
attesting integrity of the private key; and
returning the pre-salted device identifier.
6 . The computer-implemented method of claim 2 , wherein generating the universal device identifier address comprises:
generating a value by hashing the pre-salted device identifier with an administrator defined salt.
7 . The computer-implemented method of claim 6 , wherein generating the value comprises:
generating, via a SECP256K1 key generation algorithm, a universal device identifier keypair.
8 . The computer-implemented method of claim 1 , wherein the universal device identifier address comprises 42 characters in length and is represented as a hex address.
9 . The computer-implemented method of claim 1 , wherein the universal device identifier address is associated with the at least one managed device in a database associated with the security vendor service as a final correlating device identifier.
10 . A system comprising:
one or more memories comprising instructions; and
one or more processors configured to execute the instructions, which, when executed, cause the one or more processors to:
enroll, at a mobile device management service, at least one managed device;
receive a client certificate on the at least one managed device;
integrate, via a trusted ecosystem vendor app on the at least one managed device, a universal device identifier SDK;
retrieve, by a universal device identifier endpoint SDK based on a request from the trusted ecosystem vendor app, a pre-salted device identifier address associated with the at least one managed device;
transmit, by the at least one managed device via the trusted ecosystem vendor, the pre-salted device identifier address to a security vendor service for generating a universal device identifier address; and
receive, from the security vendor service by the at least one managed device via the trusted ecosystem vendor, the universal device identifier address.
11 . The system of claim 10 , wherein the instructions to receive the client certificate further comprise instructions to cause the one or more processors to:
generate a private key for the client certificate on the at least one managed device.
12 . The system of claim 11 , wherein the private key is non-exportable.
13 . The system of claim 11 , wherein the private key is generated via a hardware-backed keystore.
14 . The system of claim 13 , wherein the instructions to retrieve the pre-salted device identifier address comprise instructions to cause the one or more processors to:
validating a trust chain of the client certificate;
generating a nonce to challenge the hardware-backed keystore;
transmitting the nonce to the hardware-backed keystore referencing the client certificate;
receiving, based on the private key, a signed nonce challenge response and corresponding public key;
validating the nonce challenge response using the corresponding public key that was returned;
attesting integrity of the private key; and
returning the pre-salted device identifier.
15 . The system of claim 11 , wherein the instructions to generate the universal device identifier address comprise further instructions to cause the one or more processors to:
generate a value by hashing the pre-salted device identifier with an administrator defined salt.
16 . The system of claim 15 , wherein the instructions to generate the value comprise further instructions to cause the one or more processors to:
generate a value by hashing the pre-salted device identifier with an administrator defined salt.
17 . The system of claim 10 , wherein the universal device identifier address comprises 42 characters in length and is represented as a hex address.
18 . The system of claim 10 , wherein the universal device identifier address is associated with the at least one managed device in a database associated with the security vendor service as a final correlating device identifier.
19 . A non-transitory machine-readable storage medium comprising machine-readable instructions for causing one or more processors to execute a method, the method comprising:
enrolling, at a mobile device management service, at least one managed device;
receiving a client certificate on the at least one managed device;
integrating, via a trusted ecosystem vendor app on the at least one managed device, a universal device identifier SDK;
retrieving, by a universal device identifier endpoint SDK based on a request from the trusted ecosystem vendor app, a pre-salted device identifier address associated with the at least one managed device;
transmitting, by the at least one managed device via the trusted ecosystem vendor, the pre-salted device identifier address to a security vendor service for generating a universal device identifier address; and
receiving, from the security vendor service by the at least one managed device via the trusted ecosystem vendor, the universal device identifier address.