
• Enroll device
–Installs profile linking device to MDM
• MDM server pushes message
–“Hey, call me”
• Device connects to server
–“You rang?”
• Server provides command
• Device sends response
MDM Server
Wake Up Device
Receive
Commands
1
2
3
Apple
Push Notification
Server
• Device connects to Apple using SSL
• Two-way certificate validation
• Apple provides unique token to device
–Apps forward token to service providers
• Device leaves connection open
• Notifications flow from Apple to device
First, the device has to enroll with MDM (essentially, installing a
configuration profile that links the device to the MDM server).
Once that’s complete, the flow of control is like this:
* The server queues up a command for the device
* It then sends a notification to the device via the Apple Push
Notification Service (APNS)
* The device receives the notification, and contacts the server
* Once connected to the server, it downloads (and acts upon) the
queued command
Before we get to the meat of the MDM commands, let’s look more
closely at APNS.
The APNS connection is the only long-term connection established for
MDM, and serves as the conduit for all kinds of notification traffic to the
device.
When creating the APNS connection, the device first checks Apple’s
SSL certificate. The Apple server also checks that the device itself has a
valid certificate (which was provided to the device, by Apple, when the
device was activated). So getting into the middle of this exchange
should actually be pretty difficult.
Once the connection is established, applications request, through the
connection, unique Device Tokens, which they then forward to their
service provider.
Comentarios a estos manuales