Systems and methods for secure device management
In one embodiment, a method is performed by a computer system. The method includes receiving base attribute values of a registrant device. The method further includes determining similarities of the base attribute values to a reference string to yield base similarity values. The method also includes registering the registrant device for policy enforcement using the base similarity values. Furthermore, the method includes, responsive to a trigger, determining target attribute values of a target device. Also, the method includes determining similarities of the target attribute values to the reference string to yield target similarity values. Moreover, the method includes, responsive to the target similarity values satisfying a similarity threshold in relation to the base similarity values, configuring policy enforcement such that the target device is treated as the registrant device.
1. A computer implemented method, implemented using a computer system, the computer system comprising at least a memory and a hardware processor; the method comprising, by a computer system:
receiving base attribute values of a registrant device;
determining similarities of the base attribute values to a reference string;
generating base similarity values in relation to the reference string for the registrant device based, at least in part, on the determined similarities of the base attribute values, wherein the base similarity values are representative of the determined similarities of the base attribute values to the reference string;
registering the registrant device for policy enforcement using the base similarity values as a proxy for the base attributes of the registrant device;
responsive to a trigger, determining target attribute values of a target device;
determining similarities of the target attribute values to the reference string;
generating target similarity values in relation to the reference string for the target device based, at least in part, on the determined similarities of the target attribute values, wherein the target similarity values are representative of the determined similarities of the target attribute values to the reference string; and
responsive to the target similarity values satisfying a similarity threshold in relation to the base similarity values as the proxy for the base attributes of the registrant device, configuring policy enforcement such that the target device is treated as the registrant device.
2. The method of claim 1 , wherein the computer system identifies the registrant device in memory based, at least in part, on a composition of the base similarity values.
3. The method of claim 1 , wherein the registering comprises excluding storage of the base attribute values.
4. The method of claim 1 , comprising generating transformed values from raw device-attribute values of the registrant device, wherein the base attribute values comprise the transformed values.
5. The method of claim 4 , comprising storing the base attribute values.
6. The method of claim 4 , wherein the generating transformed values comprises applying a hash function to the raw device-attribute values.
7. The method of claim 1 , wherein the trigger comprises a user request to access a resource.
8. The method of claim 1 , wherein the registering comprises storing the base similarity values in relation to the registrant user device.
9. The method of claim 1 , wherein the reference string comprises a randomly generated string of alphanumeric characters.
10. The method of claim 1 , wherein the determining similarities of the base attribute values to the reference string comprises computing an edit distance.
11. The method of claim 1 , wherein the configuring comprises:
selecting an access policy applicable to the registrant device; and
applying the access policy to the target device.
12. The method of claim 1 , comprising:
determining a similarity difference summation with respect to the target similarity values and the base similarity values; and
wherein the similarity threshold comprises at least one criterion expressed in terms of the similarity difference summation.
13. An information handling system comprising at least a memory and a hardware processor, wherein the hardware processor is operable to implement a method comprising:
receiving base attribute values of a registrant device;
determining similarities of the base attribute values to a reference string;
generating base similarity values in relation to the reference string for the registrant device based, at least in part, on the determined similarities of the base attribute values, wherein the base similarity values are representative of the determined similarities of the base attribute values to the reference string;
registering the registrant device for policy enforcement using the base similarity values as a proxy for the base attributes of the registrant device;
responsive to a trigger, determining target attribute values of a target device;
determining similarities of the target attribute values to the reference string;
generating target similarity values in relation to the reference string for the target device based, at least in part, on the determined similarities of the target attribute values, wherein the target similarity values are representative of the determined similarities of the target attribute values to the reference string; and
responsive to the target similarity values satisfying a similarity threshold in relation to the base similarity values as the proxy for the base attributes of the registrant device, configuring policy enforcement such that the target device is treated as the registrant device.
14. The information handling system of claim 13 , wherein the computer system identifies the registrant device in memory based, at least in part, on a composition of the base similarity values.
15. The information handling system of claim 13 , wherein the registering comprises excluding storage of the base attribute values.
16. The information handling system of claim 13 , the method comprising generating transformed values from raw device-attribute values of the registrant device, wherein the base attribute values comprise the transformed values.
17. The information handling system of claim 16 , the method comprising storing the base attribute values.
18. The information handling system of claim 16 , wherein the generating transformed values comprises applying a hash function to the raw device-attribute values.
19. The information handling system of claim 13 , wherein the trigger comprises a user request to access a resource.
20. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:
receiving base attribute values of a registrant device;
determining similarities of the base attribute values to a reference string;
generating base similarity values in relation to the reference string for the registrant device based, at least in part, on the determined similarities of the base attribute values, wherein the base similarity values are representative of the determined similarities of the base attribute values to the reference string;
registering the registrant device for policy enforcement using the base similarity values as a proxy for the base attributes of the registrant device;
responsive to a trigger, determining target attribute values of a target device;
determining similarities of the target attribute values to the reference string;
generating target similarity values in relation to the reference string for the target device based, at least in part, on the determined similarities of the target attribute values, wherein the target similarity values are representative of the determined similarities of the target attribute values to the reference string; and
responsive to the target similarity values satisfying a similarity threshold in relation to the base similarity values as the proxy for the base attributes of the registrant device, configuring policy enforcement such that the target device is treated as the registrant device.