Direct Registration with the Easy Install Feature
About the Easy Install Feature
The Easy Install feature allows qeo users to create a Qeo Realm and register to it without directly having to access the SMS. The name of the created Realm is QeoHome and the username is directly taken from the device. For example, in case of an Android device with a Google account on it, the username will be the name of the Google account (typically the GMail address).
OpenID Account
In order to be able to use this procedure, you need to have an OpenID account. Typical OpenID providers are Google and Yahoo, but there are many others.
Process
The process is as follows:
- The device user starts any Qeo application on a non-registered device.
- On an android device, the system will check if the Qeo Service is installed. If not, the user is informed the Qeo Service is not found.
- The system requests which Open ID provider is to be used.
- The user selects an OpenID provider (e.g. Google, Yahoo).
- Using the OpenID account, the system transparently creates a Realm called QeoHome and adds the user and the device to it. OTC exchange is done under the hood.
Note that the user can add more users and devices to the QeoHome Realm.
Advanced Direct Registration (OTC login)
Authentication Process
For ease of understanding, this process uses ‘device’ while this actually identifies the device and the user. Refer to Qeo Identity for more information.
Registration and authentication of a device in the Qeo Realm occurs in the following steps:
- The Realm Administrator creates an administrator account and realm on the Security Management Server. A realm ID is generated.
- The Realm Administrator adds a user in the realm. A userID is generated.
- The Realm Administrator adds a device to a user. A deviceID and OTC is generated, and the Server URL is shown. The administrator will pass the OTC and URL to the User.
- When a User starts up the first Qeo application on his device, upon pressing the 'OTC login' action bar item, he is requested to enter the One Time Code and Server URL.
- The device issues a certificate request (CSR) with the public key that is generated together with the private key via SCEP.
- The device connects to the RA server using SCEP (Simple Certificate Enrollment Protocol) .
- The device authenticates itself with the OTC and verifies if the RA server is genuine. I.e. verifies if the RA certificate is signed by a trusted authority.
- The device sends the CSR to the RA server for signing.
- The RA verifies the CSR and uses the OTC to associate the CSR to the realm, user and new device.
- The OTC is made invalid so it cannot be used to register a second device..
- The "adapted" CSR is forwarded to the Certificate Authority (CA) for signing.
- The chain of certificates (master CA cert, realm CA cert and user certificate) are sent back to the device.
- The user's device is now ready to authenticate the other Qeo Realm identities and be authenticated by the other Qeo Realm identities. It can also authenticate with the SMS for policy file updates.
Diagram
Below is a diagram representing the process:
