Secure over-the-air provisioning solution for handheld and desktop devices and services

A method, comprising:

• establishing, by a services provisioning system, an over-the-air connection to a device;
• performing device posture validation to obtain a unique identification (ID) of the device at the provisioning system;
• participating in device user authentication in response to a confirmed unique ID by a backend access control system;
• in response to authentication, checking a registration system for approval of services for the device;
• pushing a root certificate to the device in response to the device being approved for services;
• receiving a certificate enrollment request from the device at the provisioning system;
• and
• returning a valid certificate to the device in response to a certificate authority signing the certificate request, wherein the valid certificate is installed on the device.

An apparatus comprising:

• one or more network interfaces to communicate in a computer network;
• a processor coupled to the network interfaces and adapted to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• establish an over-the-air connection with a device;
• perform device posture validation to obtain a unique identification (ID) of the device at the provisioning system;
• participate in device user authentication in response to a confirmed unique ID by a backend access control system;
• check a registration system for approval of services for the device in response to authentication;
• push a root certificate to the device in response to the device being approved for services;
• receive a certificate enrollment request from the device at the provisioning system;
• and
• return a valid certificate to the device in response to a certificate authority signing the certificate request, wherein the valid certificate is installed on the device.

A tangible, non-transitory, computer-readable medium having software encoded thereon, the software when executed by a processor operable to:

• establish an over-the-air connection with a device;
• perform device posture validation to obtain a unique identification (ID) of the device at the provisioning system;
• participate in device user authentication in response to a confirmed unique ID by a backend access control system;
• check a registration system for approval of services for the device in response to authentication;
• push a root certificate to the device in response to the device being approved for services;
• receive a certificate enrollment request from the device at the provisioning system;
• and
• return a valid certificate to the device in response to a certificate authority signing the certificate request, wherein the valid certificate is installed on the device.