Apple Updates Enterprise Tools for Large iOS Device Deployments [iOS Blog]

Apple has updated the software used by large companies and educational institutions to deploy thousands of iPads and iPhones to employees and students. The changes to Apple’s Device Enrollment Program, its Volume Purchase Program, and the Apple ID for Students services are detailed in a report at TechCrunch and in an overview document [PDF] posted to Apple’s IT Deployment site.

Among other changes, Apple now allows IT administrators to set up devices without physically plugging each one into a computer to install a profile, potentially saving significant amounts of time when setting up thousands of devices. Also, profiles can be locked to devices, preventing employees or students from removing any restrictions simply by revoking an IT department profile — something that derailed the Los Angeles Unified School District’s rollout of iPads to thousands of students.

I’ve had conversations with IT pros and people who roll out large iPad installs in the past and they’ve mentioned that one of the things that has continued to cause Windows devices to hold some appeal is their better remote installation and configuration support. To that end, Apple has made some updates to improve that situation.

Both the enterprise and education programs now have support for Mobile Device Management hands free configuration. This ‘zero touch’ setup has been a long-requested feature for many pros, as it eliminates the need to cable up every deployed device and install a profile via Apple’s Configurator utility.

Apple has expanded the Volume Purchase Program to more countries and now allows VPP purchases to be made via purchase order, important to large companies. Finally, Apple has also set up a new type of COPPA-compliant Apple ID for students under the age of 13.

Apple executives routinely tout adoption numbers of iOS devices by large companies in its quarterly earnings calls, and these updates should help assuage concerns in IT departments about rolling out large iOS device deployments. Much more information about deploying iOS devices is available on Apple’s website.

Touch ID and A7 Secure Enclave Detailed in Updated Apple Security Document

Apple today posted an updated security document [PDF] on its iPhone in Business site, offering details on the inner workings of both Touch ID and the “Secure Enclave” built into Apple’s A7 processor (via TechCrunch).

Since its 2013 release, Touch ID has faced scrutiny over privacy concerns from both users and government officials, and while Apple has previously offered few details on how Secure Enclave works, it has assured users that the system stores only fingerprint data rather than images.

According to the updated security document, Secure Enclave is a coprocessor within the A7 chip that uses a secure boot process to ensure that its separate software is both verified and signed by Apple. All Secure Enclaves can function independently even if a kernel is compromised and each one contains a unique ID inaccessible to other parts of the system and unknown to Apple, preventing the company or any other third parties from accessing data contained within.

Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, tangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space.

Additionally, data that is saved to the file system by the Secure Enclave is encrypted with a key tangled with the UID and an anti-replay counter.

Fingerprint data collected from Touch ID is stored within the Secure Enclave, which is used to determine a match and then enable a purchase. While the A7 processor collects data from the Touch ID sensor, it is unable to read it because it is encrypted and authenticated with a session key built into Touch ID and the Secure Enclave.

It’s encrypted and authenticated with a session key that is negotiated using the device’s shared key that is built into the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrap- ping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption.

Along with details on the function and security of the Secure Enclave, the document contains details on Touch ID, most of which have been previously published by Apple in other documents and literature on the feature. It also offers some specifics on the security of fingerprint capturing and a reminder that fingerprint data is accessible only to the Secure Enclave and never sent to Apple or backed up to iTunes or iCloud.

The document’s section on Touch ID and the Secure Enclave ends with a detailed description of how both Secure Enclave and Touch ID work together to unlock an iPhone 5s, which is well worth a read for users interested in how the technology functions.

Apple’s updated security document has been added as part of a larger redesign of the IT section of its iPhone in Business site, which now features a cleaner design with navigation icons at the top of the page.