Dynamic group membership for devices

1. At least one non-transitory computer readable storage medium configured to store instructions that, when executed by at least one processor included in a first device, cause the first device to carry out steps that include:

managing different groups of devices, wherein each group of devices is associated with a respective set of properties required to be possessed by each device that is a member of the group of devices;

actively monitoring properties associated with the first device to determine whether the first device is eligible for membership in one of the groups;

in response to detecting, based on a first update to the properties associated with the first device, that the first device is eligible for membership in a first group of which the first device is not currently a member:

sending, to at least one other device that is a member of the first group, an application for membership in the first group, wherein the application is signed with at least a private key of the first device, and

receiving a notification, from a particular device of other devices that are members of the first group, that the first device is accepted as a member of the first group, wherein the notification comprises a message, signed by the particular device, that lists the members of the group including the first device; and

in response to determining, based on a second update to the properties associated with the first device, that the first device is no longer eligible for membership in the first group:

sending, to at least one other device that is a member of the first group, a notification of a removal of the first device from the first group.

2. The at least one non-transitory computer readable storage medium of claim 1 , wherein membership in the first group requires knowledge of a particular private key, and sending the application comprises:

signing a public key of the first device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the first device;

signing the identity of the first device with the private key of the first device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

3. The at least one non-transitory computer readable storage medium of claim 1 , wherein the steps further include:

removing, from the first device, any files that are privileged within the scope of the first group.

4. The at least one non-transitory computer readable storage medium of claim 1 , wherein the properties associated with the first device include one or more of:

an operating system of the first device,

a remote wipe capability of the first device,

a password strength of a master password assigned on the first device,

an inclusion of a biometric hardware sensor within the device, or

an inclusion of a secure processor within the first device.

5. The at least one non-transitory computer readable storage medium of claim 1 , wherein a particular one of the groups requires devices to have a particular operating system to join the group.

6. The at least one non-transitory computer readable storage medium of claim 1 , wherein a particular one of the groups requires that a user verify a new device on any device that is established as a member of the group.

7. The at least one non-transitory computer readable storage medium of claim 1 , wherein a particular one of the groups requires devices to be protected with a passcode of at least a specified length in order to join the group.

8. The at least one non-transitory computer readable storage medium of claim 1 , wherein the steps further include:

receiving, from a second device, a second application for membership in a second group of which the first device is a member;

verifying that the second device meets requirements for membership in the second group; and

in response to determining that the second device meets the requirements, sending a second notification to the other devices that are members of the second group specifying that the second device is a member of the second group.

9. The at least one non-transitory computer readable storage medium of claim 8 , wherein verifying that the second device meets the requirements for membership in the second group comprises:

verifying that the application is signed by a particular private key that is required for membership in the second group.

10. The at least one non-transitory computer readable storage medium of claim 8 , wherein verifying that the second device meets the requirements for membership in the second group comprises:

prompting a user to allow the second device into the second group.

11. The at least one non-transitory computer readable storage medium of claim 1 , wherein the application for membership is sent to all devices that are members of the first group.

12. The at least one non-transitory computer readable storage medium of claim 1 , wherein the application for membership is sent to only a subset of the devices that are members of the first group.

13. A first device, comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the first device to carry out steps that include:

managing different groups of devices, wherein each group of devices is associated with a respective set of properties required to be possessed by each device that is a member of the group of devices;

actively monitoring properties associated with the first device to determine whether the first device is eligible for membership in one of the groups;

in response to detecting, based on a first update to the properties associated with the first device, that the first device is eligible for membership in a first group of which the first device is not currently a member:

sending, to at least one other device that is a member of the first group, an application for membership in the first group, wherein the application is signed with at least a private key of the first device, and

receiving a notification, from a particular device of other devices that are members of the first group, that the first device is accepted as a member of the first group, wherein the notification comprises a message, signed by the particular device, that lists the members of the group including the first device; and

in response to determining, based on a second update to the properties associated with the first device, that the first device is no longer eligible for membership in the first group:

sending, to at least one other device that is a member of the first group, a notification of a removal of the first device from the first group.

14. The first device of claim 13 , wherein membership in the first group requires knowledge of a particular private key, and sending the application comprises:

signing a public key of the first device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the first device;

signing the identity of the first device with the private key of the first device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

15. The first device of claim 13 , wherein the steps further include:

removing, from the first device, any files that are privileged within the scope of the first group.

16. The first device of claim 13 , wherein the steps further include:

receiving, from a second device, a second application for membership in a second group of which the first device is a member;

verifying that the second device meets requirements for membership in the second group; and

in response to determining that the second device meets the requirements, sending a second notification to the other devices that are members of the second group specifying that the second device is a member of the second group.

17. The first device of claim 13 , wherein the properties associated with the first device include one or more of:

an operating system of the first device,

a remote wipe capability of the first device,

a password strength of a master password assigned on the first device,

an inclusion of a biometric hardware sensor within the device, or

an inclusion of a secure processor within the first device.

18. A method performed at a first device, the method comprising:

managing different groups of devices, wherein each group of devices is associated with a respective set of properties required to be possessed by each device that is a member of the group of devices;

actively monitoring properties associated with the first device to determine whether the first device is eligible for membership in one of the groups;

in response to detecting, based on a first update to the properties associated with the first device, that the first device is eligible for membership in a first group of which the first device is not currently a member:

sending, to at least one other device that is a member of the first group, an application for membership in the first group, wherein the application is signed with at least a private key of the first device, and

receiving a notification, from a particular device of other devices that are members of the first group, that the first device is accepted as a member of the first group, wherein the notification comprises a message, signed by the particular device, that lists the members of the group including the first device; and

in response to determining, based on a second update to the properties associated with the first device, that the first device is no longer eligible for membership in the first group:

sending, to at least one other device that is a member of the first group, a notification of a removal of the first device from the first group.

19. The method of claim 18 , wherein membership in the first group requires knowledge of a particular private key, and sending the application comprises:

signing a public key of the first device and an application time with the particular private key required for membership in the first group to create a first signature;

packaging the first signature with an identity of the first device;

signing the identity of the first device with the private key of the first device to create a second signature; and

sending the second signature to the other devices that are members of the first group.

20. The method of claim 18 , wherein the properties associated with the first device include one or more of:

an operating system of the first device,

a remote wipe capability of the first device,

a password strength of a master password assigned on the first device,

an inclusion of a biometric hardware sensor within the device, or

an inclusion of a secure processor within the first device.