Authenticating mobile applications using policy files
Examples of techniques for authenticating mobile applications are described herein. A method includes receiving, at a first server, a key pair and a policy file associated with a mobile service on a second server, the policy file includes a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication. The method includes distributing the key pair and the policy file to a security device. The method also includes receiving, at the first server, an authentication request from a mobile application. The method further includes creating an authenticity challenge as specified in the policy file and sending the authenticity challenge with a response to the mobile application.
1. A method, comprising:
receiving, via a processor in a first server, a key pair and a policy file associated with a mobile service from a second server, the policy file comprising a list of:
a plurality of security objects to be authenticated,
a plurality of computing devices to authenticate the security objects, and
an order of authentication;
distributing, via the processor, the key pair and the policy file;
receiving, via the processor in the first server, an authentication request from a mobile application;
creating, via the processor, an authenticity challenge as specified in the policy file and sending the authenticity challenge with a response to the mobile application; and
performing an authentication sequence based on the order of authentication from the policy file, the authentication sequence comprising the authenticity challenge including a request for application data of the mobile application, a device authentication challenge including a request for device identification of the mobile application, and a user authentication challenge to authenticate a user of the mobile application.
2. The method of claim 1 , further comprising receiving a valid authenticity challenge response from the mobile application.
3. The method of claim 2 , further comprising sending the device authentication challenge with a second response to the mobile application.
4. The method of claim 3 , further comprising receiving a grant token request from the mobile application and sending a grant token to the mobile application.
5. The method of claim 4 , further comprising receiving the grant token from the mobile application at the first server.
6. The method of claim 5 , further comprising creating an access token at the first server and sending the access token to the mobile application.
7. The method of claim 1 , wherein the key pair and the policy file are received from mobile application metadata.