Back to results
US 10,375,052 B2Granted
Device verification of an installation of an email client
AssigneeAirWatch LLC
InventorsAdarsh Kesari, Martin Kniffin
Life of this patent
Estimating the term…
Abstract
Disclosed are various examples for single-sign on by way of managed mobile devices. For example, an identity provider service can receive a request for an identity assertion from an email client executed in a client device. The identity provider service can then detect a platform associated with the client device. The device and the user's identity can be authenticated so that an IT administrator can specify that only authorized devices can access email using the email client.
Claims20
A non-transitory computer-readable medium embodying a program executable in at least one computing device, the program, when executed by the at least one computing device, being configured to cause the at least one computing device to at least:
- receive a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user;
- detect an operating system associated with the mobile device based upon the request for the identity assertion;
- in response to determining that the operating system is iOS and the mobile device is unauthenticated, send a Kerberos challenge to the mobile device;
- extract a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service;
- determine that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked;
- determine that the mobile device is authorized to access the email service of the user based upon the device identifier by querying the device management service with the device identifier;
- and
- in response to determining that the device-specific credential is unexpired and unrevoked and that the mobile device is authorized to access the email service, send the identity assertion to the email client.
5 more elements
A system, comprising:
- at least one computing device;
- and
- an identity provider service executable by the at least one computing device, the identity provider service configured to cause the at least one computing device to at least:
- receive a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user;
- detect an operating system associated with the mobile device based upon the request for the identity assertion;
- in response to determining that the operating system is iOS and the mobile device is unauthenticated, send a Kerberos challenge to the mobile device;
- extract a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service;
- determine that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked;
- determine that the mobile device is authorized to access the email service based upon the device identifier by querying the device management service with the device identifier;
- and
- in response to determining that the user is authorized to access the email service and that the mobile device is authorized to access the email service, send the identity assertion to the email client.
8 more elements
A method, comprising:
- receiving a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user;
- detecting an operating system associated with the mobile device based upon the request for the identity assertion;
- in response to determining that the operating system is iOS and the mobile device is unauthenticated, sending a Kerberos challenge to the mobile device;
- extracting a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service;
- determining that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked;
- determining that the mobile device is authorized to access the email service of the user based upon the device identifier by querying the device management service with the device identifier;
- and
- in response to determining that the user is authorized to access the email service and that the mobile device is authorized to access the email service, sending the identity assertion to the email client.
5 more elements
Dependencies are inferred from the claim text.