Airwatch LLC

Vmware, Inc.

Omnissa, LLC

Stephen Louis Turner

Scott Harlow Kelley

Simon Brooks

Adarsh Subhash Chandra Jain

Eugene Liderman

Daniel E Zeck

Jonathon Deriso

Sagar Date

Dipanshu Gupta

Tejas Mehrotra

Amogh Datar

William Thomas Hooper

Daniel Ochoa

Aspects of secure inter-application data communications are described. In one example, a first application executing on a computing device obtains an identity certificate. The identity certificate can include a unique identifier of the computing device and a public key of the first application. To obtain the public keys of other applications executing on the computing device, the first application can query a management computing environment using the identity certificate. Once the computing device is authenticated by the management computing environment, the management computing environment can store the public key of the first application and return any public keys of other applications executing on the computing device. Once the public keys have been exchanged between the applications, the applications can encrypt and sign data packages for secure data communications between each other.

Unmanaged secure inter-application data communications

Disclosed are various embodiments for replacing hard-coded certificate pinning with blockchain based certificate pinning. A signing device can obtain a public key from an endpoint device, produce a signature for the public key, and store the public key on a distributed data store, such as a blockchain. A client device can obtain and validate the public keys from the distributed data store and use the public keys to establish a secure connection between the client device and the endpoint device.

Blockchain based certificate pinning

Disclosed are various approaches for secure inter-application communication with unmanaged applications using certificate enrollment. A certificate signing request can be received from an unmanaged application via an inter-application communication method supported by an operating system of a computing device, and an identity of the unmanaged application can be verified. The certificate signing request can be provided to a certifying authority, and a certificate can be received from the certifying authority. The certificate can be provided to the unmanaged application.

Secure inter-application communication with unmanaged applications using certificate enrollment

The disclosure relates to detecting vulnerabilities in managed client devices. A system determines whether a vulnerability scan of a computing device is required to be performed. The system installs a vulnerability detection component in the computing device in response to determining that the vulnerability scan is required to be performed. The system requests the vulnerability detection component to perform the vulnerability scan of the computing device. The system transmits a result of the vulnerability scan to a remote management service for the computing device.

Detecting vulnerabilities in managed client devices

Disclosed are various examples that relate to adjusting a stringency of offline policy restrictions based on a situational context of a computing device. In one example, a system can receive an offline restriction policy for an application. The system can identify a request to execute an application during the offline period of time. A situational context of the computing device can be determined. A first application restriction can be enforced for the application on the computing device based on the identification of the computing device being in the offline period of time and the situational context. A change in the situational context of the computing device can be identified during the offline period of time based on a detection of a second condition. A second application restriction can be enforced for the application on the computing device during the offline period of time.

Adaptive offline policy enforcement based on coniext

Disclosed are various examples for Internet of Things (IoT) device discovery and deployment. In some embodiments, a device identifier is received from an IoT device. The IoT device is determined, based on the device identifier, to be associated with a device account with a management service. An enrollment of the IoT device is performed. A capabilities declaration is received from the IoT device. IoT device instructions are determined based on the capabilities declaration. IoT device instructions are transmitted to the IoT device, causing it to perform a capability specified in the capabilities declaration.

Internet of things device discovery and deployment

Disclosed are various examples for distributed profile and key management. In one example, a client device can include an agent application and a PIV-D application. The agent application can receive a partially populated device profile generated by a management service to configure a setting on the client device. The PIV-D application can generate a derived credential and provide the derived credential to the agent application. The agent application can modify the partially populated device profile to include the credential to create a fully populated device profile and configure the client device in accordance with the fully populated device profile.

Distributed profile and key management

Various examples relate to the configuration of enterprise workspaces that can be provided in computing devices. In some examples, a computing device is enrolled with a management service that controls operation of at least a portion of the computing device. A management component creates a user account with a distributor of the operating system based on an email address. The management component requests an authentication service to authenticate a user. The user account is associated with an enterprise workspace of the computing device.

Associating user accounts with enterprise workspaces

Disclosed are various examples that relate to adjusting a stringency of offline policy restrictions based on a situational context of a computing device. In one example, a system can receive an offline restriction policy for an application. The offline restriction policy comprises one or more rules that are associated with one or more actions. The system can cause the one or more actions to be performed during an offline period of time in an instance in which one of the rules is satisfied. The offline period of time representing time periods when the system does not have a network connection with a management system. The system can cause a first authentication action to be performed in an instance in which a first condition of the system satisfies a first rule. The system can also cause a second authentication action to be performed in an instance in which a second condition of the system satisfies a second rule.

Adaptive offline policy enforcement based on context

Disclosed are various examples for distributed profile and key management. In one example, a management service can generate a partially populated device profile and provide the partially populated device profile to a client application executable on a client device. The client application can generate a credential and insert the credential into the partially populated device profile to generate a fully populated device profile. The credential can be shared with at least one other client application on the client device. The management service can use the fully populated device profile to generate multiple profiles that rely on a single credential, such as a single X.509 security certificate.

Disclosed are various examples for provisioning a client device through near-field communication (NFC). An administrator device can provide configuration parameters to a client device in a factory-reset condition through an NFC bump. A second NFC bump can be performed that provides enrollment parameters to the client device, after which the client device can complete enrollment with an enterprise mobility management (EMM) service.

Provisioning devices using near-field communication

Various examples relate to the configuration of enterprise workspaces that can be provided in computing devices. In some examples, a computing device is enrolled with a management service that controls operating of at least a portion of the computing device. A management component creates a user account with a distributor of the operating system based on an email address and a password. The user account is associated with an enterprise workspace of the computing device.

Growing community of inventors

Atlanta, GA, United States of America

Stephen Louis Turner