Mobile device security policy based on authorized scopes

Apparatus to enforce an enterprise security policy when a request for access to a service of the enterprise is initiated at a mobile device having a security policy enforcement agent and at least one personal application, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor perform a set of operations, the operations comprising:
• responsive to authentication of a user that delegates from the user to the mobile device an authorization to access the service according to a scope of operations defined by the user of the mobile device and by which the user is permitted to delegate to the mobile device that authorization, providing a notification to the mobile device security policy enforcement agent that a security policy associated with the mobile device has changed as a result of the delegation, the changed security policy requiring at least one additional security constraint as determined by the enterprise security policy and being based in part on the user-defined scope of operations;
• responsive to receiving a notification from the mobile device security policy enforcement agent that the additional security constraint that is based in part on the user-defined scope of operations has been met at the mobile device, providing an authorization token to the mobile device;
• responsive to a subsequent receipt of the authorization token from the mobile device together with a request that encapsulates information identifying what security policy is in use for this access, determining whether the authorization token is valid and whether the changed security policy is in force at the mobile device;
• and
• responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service.

A computer program product in a non-transitory computer readable storage medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a set of operations to enforce an enterprise security policy when a request for access to a service of the enterprise is initiated at a mobile device having a security policy enforcement agent and at least one personal application, the set of operations comprising:

• responsive to authentication of a user that delegates from the user to the mobile device an authorization to access the service according to a scope of operations defined by the user of the mobile device and by which the user is permitted to delegate to the mobile device that authorization, providing a notification to the mobile device security policy enforcement agent that a security policy associated with the mobile device has changed as a result of the delegation, the changed security policy requiring at least one additional security constraint as determined by the enterprise security policy and being based in part on the user-defined scope of operations;
• responsive to receiving a notification from the mobile device security policy enforcement agent that the additional security constraint that is based in part on the user-defined scope of operations has been met at the mobile device, providing an authorization token to the mobile device;
• responsive to a subsequent receipt of the authorization token from the mobile device together with a request that encapsulates information identifying what security policy is in use for this access, determining whether the authorization token is valid and whether the changed security policy is in force at the mobile device;
• and
• responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service.

A mobile device, comprising:

• a hardware processor;
• computer memory;
• a personal application;
• a mobile application executed by the hardware processor and operative to request a service of an enterprise from a secure back-end application, wherein according to a scope of operations defined by a user of the mobile device the user is permitted to delegate to the mobile device an authorization to access the service directly, the mobile application responsive to receipt of data from the user to request an authentication to delegate from the user to a security policy enforcement agent of the mobile device the authorization to access the secure back-end application according to the scope of operations defined by the user of the mobile device;
• and
• the security policy enforcement agent executed by the hardware processor and responsive to the user authentication for receiving a notification that a risk profile associated with the mobile device has changed as a result of the delegation and that a new security policy for the mobile device requires validation of at least one additional security constraint at the mobile device, the security policy enforcement agent enforcing the new security policy to enable the mobile application to obtain access to the secure back-end application according to the user-defined scope of operations by (i) determining that the at least one additional security constraint has been met at the mobile device, (ii) providing an indication to an authorization server that the at least one additional security constraint has been met;
• (iii) responsive to providing the indication, receiving from the authorization server an authorization token that is scoped to the authorization to include access to the secure back-end application;
• and (iv) subsequently providing the authorization token for verification together with a request that encapsulates information identifying what security policy is in use to attempt to obtain the service from the secure back-end application.