Secure device configuration profiles
A method for configuring a device includes receiving a first configuration profile comprising a first configuration and a first certificate and a second certificate, verifying the first configuration profile with the first certificate, receiving a user input indicating to accept the first configuration profile, configuring the device according to the first configuration, receiving a second configuration profile comprising a second configuration, verifying the second configuration profile with the second certificate and updating the device according to the second configuration, wherein the user is unaware of the updating.
1. A method for securely configuring a device, the method comprising:
at the device:
receiving a first configuration profile from one or more data processing systems, the first configuration profile comprising:
(i) a first configuration,
(ii) a first certificate to authenticate the first configuration profile, and
(iii) a second certificate to authenticate a second configuration profile;
verifying, based on the first certificate, that the first configuration profile is authentic;
receiving a user input that indicates an acceptance of the first configuration profile;
in response to the user input, configuring the device according to the first configuration; and
when the second configuration profile is received:
verifying, based on the second certificate, that the second configuration profile is authentic, and
automatically configuring the device according to a second configuration set forth by the second configuration profile, wherein the second configuration modifies at least one element of the first configuration.
2. The method of claim 1 , wherein the first configuration profile is created using a configuration setting selected from an enterprise website, and the device wirelessly communicates with the enterprise website.
3. The method of claim 1 , wherein receiving the first configuration profile from one or more data processing systems comprises transferring the first configuration profile through one of the following: a website, a media management application, a File Transfer Protocol (FTP site), a Short Message Service (SMS) message, or an e-mail message.
4. The method of claim 1 , wherein the first configuration comprises a user restriction.
5. The method of claim 1 , wherein the first configuration comprises Virtual Private Network (VPN) access information and WPA2 access information.
6. The method of claim 1 , wherein the first configuration comprises an identity that corresponds to a user of the device.
7. The method of claim 1 , wherein the first configuration comprises a root of trust certificate.
8. The method of claim 1 , wherein the first configuration comprises a provisioning profile.
9. The method of claim 8 , wherein the provisioning profile comprises an application verification and an application restriction.
10. The method of claim 1 , wherein the first certificate authenticates each of the first configuration profile and the second configuration profile.
11. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a device, cause the device to carry out steps that include:
receiving a first configuration profile from one or more data processing systems, the first configuration profile comprising:
(i) a first configuration,
(ii) a first certificate to authenticate the first configuration profile, and
(iii) a second certificate to authenticate a second configuration profile;
verifying, based on the first certificate, that the first configuration profile is authentic;
receiving a user input that indicates an acceptance of the first configuration profile;
in response to the user input, configuring the device according to the first configuration; and
when the second configuration profile is received:
verifying, based on the second certificate, that the second configuration profile is authentic, and
automatically configuring the device according to a second configuration set forth by the second configuration profile, wherein the second configuration profile modifies at least one element of the first configuration.
12. The non-transitory computer readable storage medium of claim 11 , wherein the first configuration profile is created using a configuration setting selected from an enterprise website, and the device wirelessly communicates with the enterprise website.
13. The non-transitory computer readable storage medium of claim 11 , wherein receiving the first configuration profile from one or more data processing systems comprises transferring the first configuration profile through one of the following: a website, a media management application, a File Transfer Protocol (FTP) site, a Short Message Service (SMS) message, or an e-mail message.
14. The non-transitory computer readable storage medium of claim 11 , wherein the first configuration comprises a user restriction.
15. The non-transitory computer readable storage medium of claim 11 , wherein the first configuration comprises Virtual Private Network (VPN) access information and WPA2 access information.
16. A system configured to securely configure a device, the system comprising:
one or more data processing systems; and
a device, comprising:
a processor; and
a memory configured to store instructions that, when executed by the processor, cause the device to carry out steps that include:
receiving a first configuration profile from the one or more data processing systems, the first configuration profile comprising:
(i) a first configuration,
(ii) a first certificate to authenticate the first configuration profile, and
(iii) a second certificate to authenticate a second configuration profile;
verifying, based on the first certificate, that the first configuration profile is authentic;
receiving a user input that indicates an acceptance of the first configuration profile;
in response to the user input, configuring the device according to the first configuration; and
when the second configuration profile is received:
verifying, based on the second certificate, that the second configuration profile is authentic, and
automatically configuring the device according to a second configuration set forth by the second configuration profile, wherein the second configuration modifies at least one element of the first configuration.
17. The system of claim 16 , wherein the first configuration profile is created using a configuration setting selected from an enterprise website, and the device wirelessly communicates with the enterprise website.
18. The system of claim 16 , wherein receiving the first configuration profile from one or more data processing systems comprises transferring the first configuration profile through one of the following: a website, a media management application, a File Transfer Protocol (FTP) site, a Short Message Service (SMS) message, or an e-mail message.
19. The system of claim 16 , wherein the first configuration comprises a user restriction.
20. The system of claim 16 , wherein the first configuration comprises Virtual Private Network (VPN) access information and WPA2 access information.