Device verification without device agents
Zero Trust security hinges on knowing whether a device is safe to grant access to corporate resources. Traditionally, that has meant installing software on a user's machine to check for OS patches, jailbreak status, malware, and other health indicators. Cloudflare is now extending its Access service to support a standards-based approach that removes that requirement for Apple devices.
Announced in conjunction with WWDC 2022, Private Access Tokens are an open standard co-authored by Cloudflare and device manufacturers. Cloudflare Access will now support verifying these tokens, letting security teams confirm a user's Apple device is in a healthy state before reaching a sensitive application, with no additional client software involved.
Why device health checks are typically painful
Most existing device health solutions rely on endpoint software. That approach brings with it compatibility headaches, version sprawl, and user support overhead. Many organizations turn to Mobile Device Management (MDM) tools to keep that software updated, but MDM itself requires dedicated staff to operate.
The model also fails for contractors, vendors, and employees using personal devices, where installing corporate agents isn't feasible. In those cases, teams have to fall back on VDI or VPN setups just to get external users securely into internal applications.
How Private Access Tokens work
Private Access Tokens are built on the Privacy Pass Protocol, which Cloudflare developed with major device makers. The mechanism allows a device to attest to its own integrity through anonymous, unforgeable tokens. It requires four parties to cooperate:
- Origin: The website, application, or API that receives client requests. Cloudflare handles this on behalf of its customers, managing the token request and validation process.
- Client: The visitor's tool, typically a web browser or mobile app. In practice, this is often mobile Safari.
- Attester: The entity the client proves its claims to—for example, Apple confirming a device has a valid IMEI—before a token is granted.
- Issuer: The only party that mints tokens, called by the Attester via an API. For Cloudflare Access, Cloudflare itself acts as the Issuer.
The attestation from the device vendor serves as validation that a device is in a sufficiently healthy state to access sensitive applications.
Attestation driven by the OS vendor
The critical difference from agent-based tools is that no software is installed on the user's device. Attestation is performed directly by the operating system's vendor—here, Apple. Security teams using Cloudflare Access can verify a user is coming from a healthy Apple device before granting access to corporate applications. Checks made during attestation include:
- Is the device on the latest OS version?
- Is the device jailbroken?
- Is the window attempting to log in, in focus?
- And much more.
Cloudflare is collaborating with other device manufacturers to broaden device support and to expand the range of attested attributes over time, strengthening the verification available through Access.
Private Attestation Support in Cloudflare Access moves into a closed beta in the coming months, initially covering iOS devices with broader support to follow. The rollout requires only a change to an existing Access policy—no software installation. Interested teams can join the beta waitlist via Cloudflare’s sign-up page.
