Server, computer memory, and method to support security policy maintenance and distribution

1. A method of selectively providing a mobile computing device with access to a software application on a server, the method comprising:

generating at the server a mobile security policy for a user from data received from a LDAP directory communicably coupled to the server;

transmitting the mobile security policy and key materials from the server to a gatekeeper device;

receiving at the gatekeeper device a request to access the software application from the mobile computing device;

determining at the gatekeeper device whether to grant access to the software application by checking whether the mobile computing device has an installed security program;

automatically initiating by the gatekeeper device installation of the security program onto the mobile computer device if the mobile computer device does not have the installed security program;

authenticating at the gatekeeper device the user;

transmitting the mobile security policy from the gatekeeper device to the mobile device; and

enforcing on the mobile device a rule encoded in the mobile security policy.

2. The method of claim 1 , wherein the step of determining further includes checking at the server whether the mobile computing device is within a set of devices allowed to access the software application.

3. The method of claim 2 , further comprising determining that the mobile computer device has an installed security program and is within the set of devices allowed access to the software application and providing the mobile computing device with access to the software application.

4. The method of claim 1 , wherein the security program is a shield software module.

5. The method of claim 1 , wherein the key materials are encrypted with a root key at the server, and automatically initiating installation of the security program comprises:

requesting by the gatekeeper a one-time password from the server;

receiving from the server the one-time password at the mobile computing device; and

using at the mobile device the one-time password to decrypt the root key.

6. The method of claim 5 , further comprising completing the installation of the security program at the mobile computing device and receiving a user personal identification number and a new password from the mobile computing device.

7. The method of claim 6 , further comprising receiving a user phrase from the mobile computing device.

8. The method of claim 7 , further comprising encrypting the root key using each of the new password, the personal identification number, and the user phrase at the mobile computing device.