System and method for distribution of security policies for mobile devices

A method of distributing an enterprise security policy to a mobile computing device comprising:

• providing an organization with a server having an administrative interface;
• coupling the server to an LDAP directory containing information about a plurality of members of the organization;
• transmitting from the server to the LDAP directory a request for data about a member of the organization that is authorized to use a mobile computing device associated with the organization;
• receiving data at the server from the LDAP directory, the data comprising enterprise security policy data for the member;
• generating via the administrative interface a mobile security policy to govern the authorized member's operation of the mobile computing device associated with the organization, wherein the mobile security policy is based on the enterprise security policy data for the authorized member received from the LDAP directory;
• encrypting the mobile security policy with a policy encryption public key associated with the member to create an encrypted mobile security policy;
• receiving at a gatekeeper device the encrypted mobile security policy from the server;
• receiving at the gatekeeper device a request to synchronize from the mobile computing device associated with the organization;
• verifying the mobile computing device as being associated with the organization and as being authorized to synchronize with the gatekeeper device;
• after the verifying step, transmitting the encrypted mobile security policy from the gatekeeper device to the mobile computing device;
• decrypting the encrypted mobile security policy on the mobile computing device using a policy encryption private key associated with the member, thereby recovering the mobile security policy;
• on the mobile computing device, authenticating that a user of the mobile computing device is the authorized member;
• enforcing the mobile security policy on the mobile computing device, the enforcing step comprising:
• permitting the user to access data on the mobile computing device if the mobile security policy permits the user to access that data;
• permitting the user to access a feature on the mobile computing device if the mobile security policy permits the user to access that feature;
• and
• denying the user access to data and features on the mobile computing device that the mobile security policy does not permit the user to access;
• creating a record in a security log in response to a request on the mobile computing device to perform an action that the user is not permitted to perform under the mobile security policy.

A method of distributing an update to an enterprise security policy to a mobile computing device, the method comprising:

• providing an organization with a group of users;
• providing a first security profile for the group stored on a server;
• providing a user that is a member of the group with a first individual security profile derived from the first security profile for the group;
• providing a mobile computing device associated with the organization and also associated with the user, the mobile computing device comprising the first individual security profile;
• modifying the first security profile for the group using an administrative interface on the server, thereby creating a second security profile for the group;
• generating a second individual security profile derived from the second security profile for the group, wherein the second individual security profile is customized for the user and wherein the generating step occurs automatically on the server after the modifying step;
• encrypting the second individual security profile with a policy encryption public key associated with the user;
• transmitting the encrypted second individual security profile to the mobile computing device at the next request from the mobile computing device to synchronize;
• decrypting the encrypted second individual security profile on the mobile computing device with a policy encryption private key associated with the user and replacing the first individual security profile on the mobile computing device with the second individual security profile;
• enforcing the second individual security profile on the mobile computing device.