Perimeter
11/14/2012
11:01 AM
Gunnar Peterson
Gunnar Peterson
Commentary
Connect Directly
RSS
E-Mail
50%
50%

When Cloud Met Mobile

Identity must link the disparate worlds of mobile and cloud

A few years ago, when the cloud really started to gain traction, it did not seem possible any other technology could exceed its hype or promise. Well, at least until the iPhone came along. Subsequent to the great cloud migration, mobile deployments took technology hype and promise to new heights.

Unlike other technology revolutions that subsume each other, the cloud and mobile are unfolding on parallel and related tracks. The smartphone wave came along after the cloud, but the cloud never really stopped growing. When you click a button on your iPhone, it's talking to a server in the cloud.

The cloud is a deployment model, really -- an IT middleware model, but it lacked a killer app. What's the cloud client? Browsers? Meh. We have those already. But along comes mobile with its need for distribution, high scale, and an always-on server, and suddenly middleware, the wonkiest of the wonky left in the corner talking to itself at cocktail parties, is answering calls like, 'Hey, beautiful -- where you been all my life? We need server platforms that scale for mobile user base.'"

These two distinct computing revolutions emerged independently, but now they are evolving together. But for two technologies that work together and support each other in practice, it's hard to imagine two technologies with less in common architecturally than the cloud and mobile. Cloud deployments are about standards, high throughput, constant connectivity, huge bandwidth, and request/response conversational models.

Chris Hoff sums up the three cloud layers as:

  • Infostructure: Content & Context, Apps, Metadata, Services
  • Metastructure: Glue & Guts, IPAM, IAM, BGP, DNS, SSL, PKI
  • Infrastructure: Sprockets & Moving Parts, Compute, Network, Storage

In most architectures, browser and service clients communicate to cloud providers via standard based protocols. But the cloud and mobile could scarcely be more different: Gargantuan throughput and bandwidth in the cloud is reduced counting bars on a mobile device. The always-available cloud services are accessed from occasionally connected mobile devices that interact with tunnels, elevators, airplanes, and other purveyors of poor signal. As a result, the cloud de rigeur request/response conversational patterns become asynchronous with caches (containing potentially sensitive data) kept on the mobile side.

The colliding of the cloud and mobile worlds drives design requirements and constraints for the identity layer that links them. The developer must design for the lowest-common denominator, and identity tokens must be small and efficient to deal with reduced bandwidth and throughput of mobile. In practice, this means sending identity tokens by reference instead of by value. Session tokens must identify clients across longer-lived sessions, offer protections to locally cached data on the mobile device, and access control at a more granular level than what Mobile Device Management (MDM) offers. Access control must enforce boundaries at the application and data level, not just the device. To do this on mobile, identity protocols and server-side controls come back into focus.

The identity exchange patterns and protocols that link the cloud and mobile revolutions are still evolving. Reconciling the use cases, architecture, and threat models means joining two disparate models. This can occur via API gateways, security token services, and other denizens of the mobile midtier. The required services will include the ability to perform token translation, issuing and validating mobile and cloud-specific identity tokens, and mapping and scoping those tokens for each deployment environment.

Most identity standards work has been driven out of the cloud way of thinking, but it's more likely that mobile is the catalyst going forward. At minimum, more integration and granularity in access control is required today in mobile.

This means the next wave of identity design requirements emerge not out of the cloud infrastructure, but rather out of the mobile device "thingafrastructure" that consumes the cloud services.

Gunnar Peterson is a Managing Principal at Arctec Group Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4734
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVE-2014-4960
Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

CVE-2014-5016
Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

CVE-2014-5017
Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

CVE-2014-5018
Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.