# US 10,375,052 B2 · Device verification of an installation of an email client > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,052 B2 - Document ID: US10375052B2 - Status: Granted - Kind: B2 - Application number: 15/451,586 - Filed: 2017-03-07 - Published: 2018-09-13 - Granted: 2019-08-06 - Earliest claimed: 2017-03-07 - Assignees: AirWatch LLC - Applicants: AirWatch LLC - Inventors: Adarsh Kesari; Martin Kniffin - Web page: https://patentgrep.com/patent/US10375052B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 51/42: Mailbox-related aspects, e.g. synchronisation of mailboxes - H04L 63/0272: {Virtual private networks} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04W 12/069: using certificates or pre-shared keys - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04W 12/71: Hardware identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are various examples for single-sign on by way of managed mobile devices. For example, an identity provider service can receive a request for an identity assertion from an email client executed in a client device. The identity provider service can then detect a platform associated with the client device. The device and the user's identity can be authenticated so that an IT administrator can specify that only authorized devices can access email using the email client. ## Claims ### Claim 1 A non-transitory computer-readable medium embodying a program executable in at least one computing device, the program, when executed by the at least one computing device, being configured to cause the at least one computing device to at least: receive a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user; detect an operating system associated with the mobile device based upon the request for the identity assertion; in response to determining that the operating system is iOS and the mobile device is unauthenticated, send a Kerberos challenge to the mobile device; extract a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service; determine that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked; determine that the mobile device is authorized to access the email service of the user based upon the device identifier by querying the device management service with the device identifier; and in response to determining that the device-specific credential is unexpired and unrevoked and that the mobile device is authorized to access the email service, send the identity assertion to the email client. ### Claim 2 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the certificate is installed on the mobile device by the device management service upon enrollment of the mobile device with the device management service as a managed device. ### Claim 3 (depends on 2) The non-transitory computer-readable medium of claim 2, wherein the certificate is installed as a portion of a single sign-on profile installed by the device management service on the mobile device. ### Claim 4 (depends on 2) The non-transitory computer-readable medium of claim 2, wherein the certificate is installed with a virtual private network (VPN) client installed by the device management service on the mobile device. ### Claim 5 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the program causes the at least one computing device to determine that the mobile device is authorized to access the email service by determining that the mobile device complies with at least one compliance rule or that the mobile device is enrolled as a managed device with the device management service. ### Claim 6 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the redirection received in the email client comprises a Security Assertion Markup Language (SAML) redirect sent from the email service to the email client. ### Claim 7 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the device-specific credential further comprises an authentication token provided to the client device upon enrollment of the client device with the device management service. ### Claim 8 A system, comprising: at least one computing device; and an identity provider service executable by the at least one computing device, the identity provider service configured to cause the at least one computing device to at least: receive a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user; detect an operating system associated with the mobile device based upon the request for the identity assertion; in response to determining that the operating system is iOS and the mobile device is unauthenticated, send a Kerberos challenge to the mobile device; extract a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service; determine that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked; determine that the mobile device is authorized to access the email service based upon the device identifier by querying the device management service with the device identifier; and in response to determining that the user is authorized to access the email service and that the mobile device is authorized to access the email service, send the identity assertion to the email client. ### Claim 9 (depends on 8) The system of claim 8, wherein the certificate is installed on the mobile device by the device management service upon enrollment of the mobile device with the device management service as a managed device. ### Claim 10 (depends on 9) The system of claim 9, wherein the certificate is installed as a portion of a single sign-on profile installed by the device management service on the mobile device. ### Claim 11 (depends on 9) The system of claim 9, wherein the certificate is installed with a virtual private network (VPN) client installed by the device management service on the mobile device. ### Claim 12 (depends on 8) The system of claim 8, wherein the identity provider determines that the mobile device is authorized to access the email service by determining that the mobile device complies with at least one compliance rule or that the mobile device is enrolled as a managed device with the device management service. ### Claim 13 (depends on 8) The system of claim 8, wherein the redirection received in the email client comprises a Security Assertion Markup Language (SAML) redirect sent from the email service to the email client. ### Claim 14 (depends on 8) The system of claim 8, wherein the device-specific credential further comprises an authentication token provided to the client device upon enrollment of the client device with the device management service. ### Claim 15 A method, comprising: receiving a request for an identity assertion from an email client executed in a mobile device, the request being generated in response to a redirection received in the email client from an authentication server associated with an email service of a user; detecting an operating system associated with the mobile device based upon the request for the identity assertion; in response to determining that the operating system is iOS and the mobile device is unauthenticated, sending a Kerberos challenge to the mobile device; extracting a device-specific credential from a response to the Kerberos challenge, the device-specific credential comprising a device identifier embedded within a certificate used to encrypt the response, the device-specific credential being associated with a previous user authentication of the user, wherein the certificate is provided to the client device upon enrollment of the client device with a device management service; determining that the user is authorized to access the email service based upon the response by determining that the device-specific credential is unexpired and unrevoked; determining that the mobile device is authorized to access the email service of the user based upon the device identifier by querying the device management service with the device identifier; and in response to determining that the user is authorized to access the email service and that the mobile device is authorized to access the email service, sending the identity assertion to the email client. ### Claim 16 (depends on 15) The method of claim 15, wherein the certificate is installed on the mobile device by the device management service upon enrollment of the mobile device with the device management service as a managed device. ### Claim 17 (depends on 16) The method of claim 16, wherein the certificate is installed as a portion of a single sign-on profile installed by the device management service on the mobile device. ### Claim 18 (depends on 16) The method of claim 16, wherein the certificate is installed with a virtual private network (VPN) client installed by the device management service on the mobile device. ### Claim 19 (depends on 15) The method of claim 15, wherein the redirection received in the email client comprises a Security Assertion Markup Language (SAML) redirect sent from the email service to the email client. ### Claim 20 (depends on 15) The method of claim 15, wherein the device-specific credential further comprises an authentication token provided to the client device upon enrollment of the client device with the device management service.