Forward and backward NIAP migration of certificate stores

1. A computer-implemented method of ensuring compliance of a plurality of certificate stores on a mobile device with a first information technology (IT) policy, the method comprising:

detecting a certificate store migration triggering event;

in response to detecting the certificate store migration triggering event, initiating a bulk migration process to migrate each of the plurality of certificate stores to a respective version that is compliant with the first IT policy, the bulk migration process proceeding according to a predetermined order of certificate stores;

receiving, from a client application resident on the mobile device, a request to access a first certificate store that has yet to be migrated; and

executing an out-of-order migration of the first certificate store.

2. The method of claim 1 , wherein detecting the certificate store migration triggering event comprises detecting that all of the plurality of certificate stores are concurrently accessible.

3. The method of claim 2 , wherein the plurality of certificate stores are located in multiple different encryption domains within a work perimeter of the mobile device and wherein detecting that all of the plurality of certificate stores are concurrently accessible comprises detecting that the work perimeter is unlocked.

4. The method of claim 1 , further comprising, for each of the plurality of certificate stores, encrypting the certificate store after its migration.

5. The method of claim 1 , wherein executing an out-of-order migration of the first certificate store comprises advancing the migration of the first certificate store over migration of other certificate stores that have yet to be migrated in the bulk migration process.

6. The method of claim 1 , wherein migrating a certificate store comprises applying an idempotent operation on the certificate store.

7. The method of claim 6 , wherein the operation comprises computation of a hash value of the certificate store.

8. The method of claim 1 , further comprising, upon initiating the bulk migration process, storing a status of the bulk migration process in a persistent storage on the mobile device.

9. The method of claim 8 , wherein storing a status of the bulk migration process in a persistent storage comprises generating, via a persistent publish and subscribe service, an object file corresponding to the bulk migration process, the object file having a first attribute associated with the status of the bulk migration process.

10. The method of claim 9 , further comprising, upon detecting completion of the bulk migration process, publishing a change to the object file by updating the first attribute.

11. A mobile device comprising,

a memory containing a plurality of certificate stores;

a processor coupled to the memory, wherein the processor is configured to:

detect a certificate store migration triggering event;

in response to detecting the certificate store migration triggering event, initiate a bulk migration process to migrate each of the plurality of certificate stores to a respective version that is compliant with a first IT policy, the bulk migration process proceeding according to a predetermined order of certificate stores;

receive, from a client application resident on the mobile device, a request to access a first certificate store that has yet to be migrated; and

execute an out-of-order migration of the first certificate store.

12. The mobile device of claim 11 , wherein detecting the certificate store migration triggering event comprises detecting that all of the plurality of certificate stores are simultaneously accessible.

13. The mobile device of claim 12 , wherein the plurality of certificate stores are located in multiple different encryption domains within a work perimeter of the mobile device and wherein detecting that all of the plurality of certificate stores are simultaneously accessible comprises detecting that the work perimeter is unlocked.

14. The mobile device of claim 11 , wherein the processor is further configured to, for each of the plurality of certificate stores, encrypt the certificate store after its migration.

15. The mobile device of claim 11 , wherein executing an out-of-order migration of the first certificate store comprises advancing the migration of the first certificate store over migration of other certificate stores that have yet to be migrated in the bulk migration process.

16. The mobile device of claim 11 , wherein migrating a certificate store comprises applying an idempotent operation on the certificate store.

17. The mobile device of claim 16 , wherein the operation comprises computation of a hash value of the certificate store.

18. The mobile device of claim 11 , wherein the processor is further configured to, upon initiating the bulk migration process, store a status of the bulk migration process in a persistent storage on the mobile device.

19. The mobile device of claim 18 , wherein storing a status of the bulk migration process in a persistent storage comprises generating, via a persistent publish and subscribe service, an object file corresponding to the bulk migration process, the object file having a first attribute associated with the status of the bulk migration process.

20. The mobile device of claim 19 , wherein the processor is further configured to, upon detecting completion of the bulk migration process, publish a change to the object file by updating the first attribute.