Leveraging and extending mobile operating system MDM protocol
In various embodiments, a device may include a communications interface configured to receive, from the device management server, an indication to perform an action that requires access to a privileged user space. The device may include a processor configured to use a bridge service to perform the action, where the bridge service runs in a security context that enables the service to operate in the privileged user space. In various embodiments, a server may include a communications interface and a processor. The processor may be configured to receive an indication to perform a management action not within a native device management functionality. The processor may be further configured to invoke a bridge service running on the managed device to perform the action by sending a request via the communications interface, where the bridge service runs in a security context that enables the service to operate in the privileged user space.
1. A physical device comprising:
a communications interface configured to receive, from a device management server, an indication to perform an action that requires access to a privileged user space of the physical device; and
a processor configured to:
use a native device management service, wherein the native device management service is configured to perform only predefined functions; and
use a mobile device management (MDM) bridge service to perform the action, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
2. The device of claim 1 , wherein the MDM bridge service runs in a background on the device.
3. The device of claim 1 , wherein the MDM bridge service is configured to respond to commands from the device management server.
4. The device of claim 1 , wherein:
the MDM bridge service is configured to periodically check with the device management server for outstanding actions to perform; and
a status of an execution of outstanding actions is reported asynchronously to the device management server.
5. The device of claim 4 , wherein the MDM bridge service is configured to:
detect a session between a native device management service and the device management server; and
initiate a session of the MDM bridge service in response to the detected session between the native device management service and the device management server.
6. The device of claim 1 , wherein the processor is further configured to:
send a request to register the device;
receive, in response to the request, an installer for the MDM bridge service; and
automatically install the MDM bridge service.
7. The device of claim 6 , wherein the installer is one of an MSI installer and a Win 32 installer.
8. The device of claim 1 , wherein the processor is further configured to perform functions selected by a user of the device.
9. The device of claim 1 , wherein the MDM bridge service is configured to control a file system of the device.
10. The device of claim 1 , wherein the MDM bridge service is configured to control a registry of the device.
11. The device of claim 1 , wherein the MDM bridge service is configured to execute a script on the device.
12. The device of claim 1 , wherein the MDM bridge service is configured to control at least one of a configuration specification and a policy specification.
13. The device of claim 1 , wherein the MDM bridge service is configured to install an application including associating the application with an uninstall script configured to automatically remove the application and all associated data when the application is uninstalled.
14. The device of claim 1 , wherein the MDM bridge service is configured to provide a predefined number of encryption keys.
15. The device of claim 1 , wherein communications between the MDM bridge service and the device management server are authenticated.
16. The device of claim 1 , wherein the MDM bridge service is headless.
17. The device of claim 1 , wherein the privileged user space includes at least one of: a registry, a file system, and scripts.
18. A physical device comprising:
a communications interface configured to receive, from a device management server, an indication to perform an action that requires access to a privileged user space of the physical device; and
a processor configured to use a mobile device management (MDM) bridge service to perform the action including by invoking a native device management service to perform those functions associated with the action that are predefined and performing, by the bridge service those functions associated with the action that are not predefined, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
19. The device of claim 18 , wherein:
the MDM bridge service is configured to periodically check with the device management server for outstanding actions to perform; and
a status of an execution of outstanding actions is reported asynchronously to the device management server.
20. A method comprising:
receiving, from a device management server, an indication to perform an action that requires access to a privileged user space of a physical device;
using a native device management service, wherein the native device management service is configured to perform only predefined functions; and
using a mobile device management (MDM) bridge service to perform the action, wherein the MDM bridge service runs in a security context that enables the service to operate in the privileged user space.
21. The method of claim 20 , wherein:
the MDM bridge service is configured to periodically check with the device management server for outstanding actions to perform; and
a status of an execution of outstanding actions is reported asynchronously to the device management server.
22. The method of claim 20 , wherein the MDM bridge service is configured to:
detect a session between a native device management service and the device management server; and
initiate a session of the MDM bridge service in response to the detected session between the native device management service and the device management server.
23. The method of claim 20 , wherein the MDM bridge service is configured to install an application including associating the application with an uninstall script configured to automatically remove the application and all associated data when the application is uninstalled.