Mobile device security policy based on authorized scopes

Apparatus to enforce an enterprise security policy when a request for access to a service is initiated at a mobile device, comprising:

• a processor;
• computer memory holding computer program instructions that when executed by the processor perform a method, the method comprising:
• responsive to a user authentication that grants an authorization to the mobile device to access the service, providing a notification to the mobile device that a security policy associated with the mobile device has changed to require at least one additional security constraint;
• responsive to receiving a notification from the mobile device that the additional security constraint has been met, providing an authorization token to the mobile device;
• responsive to receipt of the authorization token, determining whether the authorization token is valid;
• and
• responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service.

A computer program product in a non-transitory computer readable storage medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method to enforce an enterprise security policy when a request for access to a service is initiated at a mobile device, the method comprising:

• responsive to a user authentication that grants an authorization to the mobile device to access the service, providing a notification to the mobile device that a security policy associated with the mobile device has changed to require at least one additional security constraint;
• responsive to receiving a notification from the mobile device that the additional security constraint has been met, providing an authorization token to the mobile device;
• responsive to receipt of the authorization token, determining whether the authorization token is valid;
• and
• responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service.

A mobile device, comprising:

• a hardware processor;
• computer memory;
• a mobile application adapted to request a service to a secure back-end application, the mobile application prompting a user to perform an authentication to grant an authorization to the mobile device to access the service;
• and
• a security policy enforcement agent executed by the hardware processor and responsive to a successful authentication for receiving a notification that a security policy associated with the mobile device has changed to require at least one additional security constraint, the security policy enforcement agent enforcing the changed security policy to enable the mobile application to obtain access to the service.