# US 2014/0157351 A1 · Mobile device security policy based on authorized scopes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157351 A1 - Document ID: US20140157351A1 - Status: Published application - Kind: A1 - Application number: 13/693,479 - Filed: 2012-12-04 - Published: 2014-06-05 - Earliest claimed: 2012-12-04 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Simon Gilbert Canning; David Paul Moore; Shane Bradley Weeden; Stephen Viselli - Web page: https://patentgrep.com/patent/US20140157351A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A technique to enforce mobile device security policy is based on a “risk profile” of the individual device, where the risk profile is fine-grained and based on the types of applications installed on the device, the services they are accessing, and the operation(s) the user granted the device authorization to perform. Thus, the approach takes into account not only the actual applications installed on the device (and those actively in use), but also the services those applications are accessing, and the scope of operations the user has granted the device authorization to perform. By combining this information to create the risk profile, a suitable security policy, including one that does not unnecessarily degrade device usability, may then be applied. ## Claims ### Claim 1 A method to enforce an enterprise security policy when a request for access to a service is initiated at a mobile device, comprising: responsive to a user authentication that grants an authorization to the mobile device to access the service, providing a notification to the mobile device that a security policy associated with the mobile device has changed to require at least one additional security constraint; responsive to receiving a notification from the mobile device that the additional security constraint has been met, providing an authorization token to the mobile device; responsive to receipt of the authorization token, determining whether the authorization token is valid; and responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the determination that the changed security policy is in force at the mobile device further includes: verifying whether the user has complied with the security policy as changed to reflect the additional security constraint for this service access. ### Claim 3 (depends on 1) The method as described in claim 1 wherein the determination that the changed security policy is in force at the mobile device further includes: contacting a security policy agent associated with the mobile device to query whether the security policy associated with the authorization and that is bound to the authorization token has been enforced for this particular access to the service; and receiving an affirmative response to the query. ### Claim 4 (depends on 1) The method as described in claim 1 further including denying access to the service if the changed security policy is not in force at the mobile device. ### Claim 5 (depends on 4) The method as described in claim 4 further including revoking the authorization token. ### Claim 6 (depends on 1) The method as described in claim 1 further including maintaining a mapping that associates a service and its authorization scope to a security policy requirement level that defines one or more security policy requirements for the mobile device. ### Claim 7 (depends on 6) The method as described in claim 6 further including providing the mobile device with the one or more security policy requirements. ### Claim 8 Apparatus to enforce an enterprise security policy when a request for access to a service is initiated at a mobile device, comprising: a processor; computer memory holding computer program instructions that when executed by the processor perform a method, the method comprising: responsive to a user authentication that grants an authorization to the mobile device to access the service, providing a notification to the mobile device that a security policy associated with the mobile device has changed to require at least one additional security constraint; responsive to receiving a notification from the mobile device that the additional security constraint has been met, providing an authorization token to the mobile device; responsive to receipt of the authorization token, determining whether the authorization token is valid; and responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service. ### Claim 9 (depends on 8) The apparatus as described in claim 8 wherein the determination by the method that the changed security policy is in force at the mobile device further includes: verifying whether the user has complied with the security policy as changed to reflect the additional security constraint for this service access. ### Claim 10 (depends on 8) The apparatus as described in claim 8 wherein the determination by the method that the changed security policy is in force at the mobile device further includes: contacting a security policy agent associated with the mobile device to query whether the security policy associated with the authorization and that is bound to the authorization token has been enforced for this particular access to the service; and receiving an affirmative response to the query. ### Claim 11 (depends on 8) The apparatus as described in claim 8 wherein the method further includes denying access to the service if the changed security policy is not in force at the mobile device. ### Claim 12 (depends on 11) The apparatus as described in claim 11 wherein the method further includes revoking the authorization token. ### Claim 13 (depends on 8) The apparatus as described in claim 8 wherein the method further includes maintaining a mapping that associates a service and its authorization scope to a security policy requirement level that defines one or more security policy requirements for the mobile device. ### Claim 14 (depends on 13) The apparatus as described in claim 13 wherein the method further includes providing the mobile device with the one or more security policy requirements. ### Claim 15 A computer program product in a non-transitory computer readable storage medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method to enforce an enterprise security policy when a request for access to a service is initiated at a mobile device, the method comprising: responsive to a user authentication that grants an authorization to the mobile device to access the service, providing a notification to the mobile device that a security policy associated with the mobile device has changed to require at least one additional security constraint; responsive to receiving a notification from the mobile device that the additional security constraint has been met, providing an authorization token to the mobile device; responsive to receipt of the authorization token, determining whether the authorization token is valid; and responsive to a determination that the authorization token is valid and that the changed security policy is in force at the mobile device, permitting access to the service. ### Claim 16 (depends on 15) The computer program product as described in claim 15 wherein the determination by the method that the changed security policy is in force at the mobile device further includes: verifying whether the user has complied with the security policy as changed to reflect the additional security constraint for this service access. ### Claim 17 (depends on 15) The computer program product as described in claim 15 wherein the determination by the method that the changed security policy is in force at the mobile device further includes: contacting a security policy agent associated with the mobile device to query whether the security policy associated with the authorization and that is bound to the authorization token has been enforced for this particular access to the service; and receiving an affirmative response to the query. ### Claim 18 (depends on 15) The computer program product as described in claim 15 wherein the method further includes denying access to the service if the changed security policy is not in force at the mobile device. ### Claim 19 (depends on 18) The computer program product as described in claim 18 wherein the method further includes revoking the authorization token. ### Claim 20 (depends on 15) The computer program product as described in claim 15 wherein the method further includes maintaining a mapping that associates a service and its authorization scope to a security policy requirement level that defines one or more security policy requirements for the mobile device. ### Claim 21 (depends on 21) The computer program product as described in claim 21 wherein the method further includes providing the mobile device with the one or more security policy requirements. ### Claim 22 A mobile device, comprising: a hardware processor; computer memory; a mobile application adapted to request a service to a secure back-end application, the mobile application prompting a user to perform an authentication to grant an authorization to the mobile device to access the service; and a security policy enforcement agent executed by the hardware processor and responsive to a successful authentication for receiving a notification that a security policy associated with the mobile device has changed to require at least one additional security constraint, the security policy enforcement agent enforcing the changed security policy to enable the mobile application to obtain access to the service. ### Claim 23 (depends on 22) The mobile device as described in claim 22 wherein the security policy enforcement agent enforces the changed security policy by providing determining whether the at least one additional security constraint has been met and, if so, receiving an authorization token that is bound to the authorization. ### Claim 24 (depends on 23) The mobile device as described in claim 23 wherein the mobile application forwards the authorization token for verification.