Secure device service enrollment

A method for enrolling a mobile device for services, the method comprising:

• receiving, by a server, a first enrollment message digest for a first service, wherein the first enrollment message digest is generated by a verification agent in response to the verification agent determining that the mobile device is in a trusted state for a first application based on a first device integrity of the mobile device determined over a first set of components of the mobile device, the verification agent being part of an application package downloaded to the mobile device, the application package including both the verification agent and the first application used by the mobile device to access the first service;
• deriving, by the sever from the first enrollment message digest, a cryptographic measurement of the first application downloaded onto the mobile device, a digital fingerprint of the mobile device, and user identifying information of a user of the mobile device, wherein the digital fingerprint is a concatenation of an attestation value corresponding to a security policy enforced by the mobile device and two or more attestation values selected from a first attestation value corresponding to a hardware component of the mobile device, a second attestation value corresponding to a firmware component of the mobile device, or a third attestation value corresponding to an operating system of the mobile device;
• using, by the sever, the cryptographic measurement to determine whether the first application is unaltered;
• using, by the sever, the digital fingerprint to determine whether the mobile device is in a trusted state;
• in response to determining that the first application is unaltered and that the mobile device is in a trusted state, enrolling, by the sever, the mobile device for the first service, wherein the first service is received by the mobile device after enrollment for the first service;
• receiving, by the server, a second enrollment message digest for a second service that is accessed by a second application, wherein the second enrollment message digest is generated by the verification agent in response to the verification agent determining that the mobile device is in a trusted state for the second application based on a second device integrity of the mobile device determined over a second set of components of the mobile device that includes at least one component that is different than the first set of components, wherein the second set of components for the second device integrity is determined based on a manifest of the second application indicating the second application has a different security sensitivity requirement than the first application;
• and
• enrolling, by the sever, the mobile device for the second service based on the second enrollment message digest, wherein the second service is received by the mobile device after enrollment for the second service.

A mobile device comprising:

• a processor;
• and
• a computer readable storage medium storing code, which when executed by the processor, causes the mobile device to:
• generate, by a verification agent downloaded onto the mobile device, a cryptographic measurement of a first application downloaded onto the mobile device, the verification agent and the first application being part of an application package downloaded onto the mobile device;
• generate, by the verification agent downloaded onto the mobile device, a first digital fingerprint of the mobile device based on a first set of components of the mobile device;
• generate, by the verification agent downloaded onto the mobile device, a first enrollment message digest based on the cryptographic measurement of the first application, the first digital fingerprint of the mobile device, and user identifying information of a user of the mobile device, wherein the first digital fingerprint is a concatenation of an attestation value corresponding to a security policy enforced by the mobile device and two or more attestation values selected from a first attestation value corresponding to a hardware component of the mobile device, a second attestation value corresponding to a firmware component of the mobile device, or a third attestation value corresponding to an operating system of the mobile device;
• send the first enrollment message digest to a server associated with a service provider to enroll the mobile device for access to a first service associated with the first application provided by the service provider, wherein the first service is received by the mobile device after enrollment for the first service;
• generate, by the verification agent downloaded onto the mobile device, a second enrollment message digest for a second service that is accessed by a second application, the second enrollment message digest including a second digital fingerprint of the mobile device based on a second set of components of the mobile device having at least one component that is different than the first set of components, wherein the second set of components for the second digital fingerprint is determined based on a manifest of the second application indicating the second application has a different security sensitivity requirement than the first application;
• and
• send the second enrollment message digest to the server to enroll the mobile device for access to the second service associated with the second application, wherein the second service is received by the mobile device after enrollment for the second service.