Remote cluster enrollment
A cluster enrollment system remote to a device cluster performs a cluster enrollment process according to a cluster enrollment policy to determine whether a target device is authenticated to join the device cluster.
1 . A non-transitory computer readable medium having software instructions stored thereon, the software instructions executable by a hardware computer processor to cause the hardware computer processor to:
receive a request from a device for enrollment with a device cluster communicating on a network, wherein the request includes a device identifier;
authenticate the device based on the device identifier;
determine a cluster enrollment policy comprising an authentication threshold score, wherein the authentication threshold score indicates a minimum required enrollment score for enrollment of the device with the device cluster;
determine, based on application of the cluster enrollment policy, that an enrollment score of the device exceeds the authentication threshold score;
based on the determination that the enrollment score exceeds the authentication threshold score, assign a token to the device, wherein the token is usable to authenticate communications of the device with other devices in the device cluster; and
establish a secure communication channel between a computing system and the device.
2 . The non-transitory computer readable medium of claim 1 , wherein the cluster enrollment policy indicates an external data source storing acceptable attribute of the device.
3 . The non-transitory computer readable medium of claim 2 , wherein the software instructions cause the hardware computer processor to:
communicate with the external data source to determine the acceptable attribute of the device; and
determine whether the device has the acceptable attribute.
4 . The non-transitory computer readable medium of claim 2 , wherein the external data source is associated with a manufacturer of the device.
5 . The non-transitory computer readable medium of claim 4 , wherein the acceptable attribute indicates an entity that purchased the device.
6 . The non-transitory computer readable medium of claim 4 , wherein the acceptable attribute indicates a serial number of the device and an identifier of the device cluster.
7 . The non-transitory computer readable medium of claim 1 , wherein the cluster enrollment policy includes an environmental policy including an environmental criteria of the device.
8 . The non-transitory computer readable medium of claim 1 , wherein the cluster enrollment policy includes a platform policy indicating an acceptable platform attribute.
9 . The non-transitory computer readable medium of claim 1 , wherein the cluster enrollment policy is associated with the device cluster.
10 . The non-transitory computer readable medium of claim 1 , wherein a computing system of the device is remote to the device cluster.
11 . A non-transitory computer readable medium having software instructions stored thereon, the software instructions executable by a hardware computer processor to cause the hardware computer processor to:
receive a request from a device for enrollment with a device cluster communicating on a network;
authenticate the device based on the device identifier;
determine a cluster enrollment policy comprising an authentication threshold score and a locality criteria, wherein the authentication threshold score indicates a minimum required enrollment score for enrollment of the device with the device cluster;
determine an enrollment score for the device, wherein the enrollment score is based at least in part on the locality criteria indicating an acceptable geographic location of the device;
determine, based on application of the cluster enrollment policy, that the enrollment score of the device exceeds the authentication threshold score;
based on the determination that the enrollment score exceeds the authentication threshold score, assign a token to the device, wherein the token is usable to authenticate communications of the device with other devices in the device cluster; and
establish a secure communication channel between a computing system and the device.
12 . The non-transitory computer readable medium of claim 11 , wherein the locality criteria indicates an acceptable location of the device.
13 . The non-transitory computer readable medium of claim 11 , wherein a physical location of the device is determined based on an IP address of the device.
14 . The non-transitory computer readable medium of claim 11 , wherein a physical location indicates a second device expected to be in proximity with the device.
15 . The non-transitory computer readable medium of claim 11 , wherein a physical location indicates a radio frequency fingerprint.
16 . The non-transitory computer readable medium of claim 11 , wherein the locality criteria indicates an ambient noise fingerprint.
17 . A non-transitory computer readable medium having software instructions stored thereon, the software instructions executable by a hardware computer processor to cause the hardware computer processor to:
receive a request from a device for enrollment with a device cluster communicating on a network;
authenticate the device based on the device identifier;
determine a cluster enrollment policy comprising an authentication threshold score and a platform criterion, wherein the authentication threshold score indicates a minimum required enrollment score for enrollment of the device with the device cluster;
determine an enrollment score for the device, wherein the enrollment score is based at least in part on the platform criterion indicating an acceptable device characteristic of the device;
determine, based on application of the cluster enrollment policy, that the enrollment score of the device exceeds the authentication threshold score;
based on the determination that the enrollment score exceeds the authentication threshold score, assign a token to the device, wherein the token is usable to authenticate communications of the device with other devices in the device cluster; and
establish a secure communication channel between a computing system and the device.
18 . The non-transitory computer readable medium of claim 17 , wherein the software instructions cause the hardware computer processor to:
request platform characteristics from the device; and
compare the platform criterion with the platform characteristics.
19 . The non-transitory computer readable medium of claim 17 , wherein the platform criterion indicates one or more of a hardware, software, or firmware.