Leveraging and extending mobile operating system MDM protocol
In various embodiments, a device may include a communications interface configured to receive, from the device management server, an indication to perform an action that requires access to a privileged user space. The device may include a processor configured to use a bridge service to perform the action, where the bridge service runs in a security context that enables the service to operate in the privileged user space. In various embodiments, a server may include a communications interface and a processor. The processor may be configured to receive an indication to perform a management action not within a native device management functionality. The processor may be further configured to invoke a bridge service running on the managed device to perform the action by sending a request via the communications interface, where the bridge service runs in a security context that enables the service to operate in the privileged user space.
1. A physical device comprising:
a communications interface configured to receive, from a device management server, an indication to perform an action that requires access to a privileged user space of the physical device; and
a processor configured to:
use a native device management service, wherein the native device management service is configured to perform only predefined functions without access to the privileged user space; and
use a mobile device management (MDM) bridge service to perform the action, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
2. The device of claim 1 , wherein the MDM bridge service runs in a background on the device.
3. The device of claim 1 , wherein the MDM bridge service is configured to respond to commands from the device management server.
4. The device of claim 1 , wherein:
the MDM bridge service is configured to periodically check with the device management server for outstanding actions to perform; and
a status of an execution of outstanding actions is reported asynchronously to the device management server.
5. The device of claim 4 , wherein the MDM bridge service is configured to:
detect a session between a native device management service and the device management server; and
initiate a session of the MDM bridge service in response to the detected session between the native device management service and the device management server.
6. The device of claim 1 , wherein the processor is further configured to:
send a request to register the device;
receive, in response to the request, an installer for the MDM bridge service; and
automatically install the MDM bridge service.
7. The device of claim 6 , wherein the installer is one of an MSI installer and a Win 32 installer.
8. The device of claim 1 , wherein the processor is further configured to perform functions selected by a user of the device.
9. The device of claim 1 , wherein the MDM bridge service is configured to control a file system of the device.
10. The device of claim 1 , wherein the MDM bridge service is configured to control a registry of the device.
11. The device of claim 1 , wherein the MDM bridge service is configured to execute a script on the device.
12. The device of claim 1 , wherein the MDM bridge service is configured to control at least one of a configuration specification and a policy specification.
13. The device of claim 1 , wherein the MDM bridge service is configured to install an application including associating the application with an uninstall script configured to automatically remove the application and all associated data when the application is uninstalled.
14. The device of claim 1 , wherein the MDM bridge service is configured to provide a predefined number of encryption keys.
15. The device of claim 1 , wherein communications between the MDM bridge service and the device management server are authenticated.
16. The device of claim 1 , wherein the MDM bridge service is headless.
17. The device of claim 1 , wherein the privileged user space includes at least one of: a registry, a file system, and scripts.
18. A method comprising:
receiving, from a device management server, an indication to perform an action that requires access to a privileged user space of a physical device;
using a native device management service, wherein the native device management service is configured to perform only predefined functions without access to the privileged user space; and
using a mobile device management (MDM) bridge service to perform the action, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
19. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, from a device management server, an indication to perform an action that requires access to a privileged user space of a physical device;
using a native device management service, wherein the native device management service is configured to perform only predefined functions without access to the privileged user space; and
using a mobile device management (MDM) bridge service to perform the action, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
20. A server comprising:
a communications interface;
a processor coupled to the communications interface, the processor configured to:
receive, via an administrative user interface, an indication to perform with respect to a managed physical device, a management action not within a native device management functionality of the managed physical device; and
invoke a mobile device management (MDM) bridge service running on the managed device to perform the action by sending a request via the communications interface, wherein the MDM bridge service runs in a security context that enables the service to operate in a privileged user space.
21. The server of claim 20 , wherein:
the administrative user interface exposes a set of management actions, wherein some of the management actions are native and some of the management actions are not native.
22. The server of claim 20 , wherein the bridge service is invoked based on a determination that the MDM bridge service is to be used and the native device management functionality is used based on a determination that the MDM bridge service is not to be used.