Perimeter
11/14/2012
11:01 AM
Gunnar Peterson
Gunnar Peterson
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

When Cloud Met Mobile

Identity must link the disparate worlds of mobile and cloud

A few years ago, when the cloud really started to gain traction, it did not seem possible any other technology could exceed its hype or promise. Well, at least until the iPhone came along. Subsequent to the great cloud migration, mobile deployments took technology hype and promise to new heights.

Unlike other technology revolutions that subsume each other, the cloud and mobile are unfolding on parallel and related tracks. The smartphone wave came along after the cloud, but the cloud never really stopped growing. When you click a button on your iPhone, it's talking to a server in the cloud.

The cloud is a deployment model, really -- an IT middleware model, but it lacked a killer app. What's the cloud client? Browsers? Meh. We have those already. But along comes mobile with its need for distribution, high scale, and an always-on server, and suddenly middleware, the wonkiest of the wonky left in the corner talking to itself at cocktail parties, is answering calls like, 'Hey, beautiful -- where you been all my life? We need server platforms that scale for mobile user base.'"

These two distinct computing revolutions emerged independently, but now they are evolving together. But for two technologies that work together and support each other in practice, it's hard to imagine two technologies with less in common architecturally than the cloud and mobile. Cloud deployments are about standards, high throughput, constant connectivity, huge bandwidth, and request/response conversational models.

Chris Hoff sums up the three cloud layers as:

  • Infostructure: Content & Context, Apps, Metadata, Services
  • Metastructure: Glue & Guts, IPAM, IAM, BGP, DNS, SSL, PKI
  • Infrastructure: Sprockets & Moving Parts, Compute, Network, Storage

In most architectures, browser and service clients communicate to cloud providers via standard based protocols. But the cloud and mobile could scarcely be more different: Gargantuan throughput and bandwidth in the cloud is reduced counting bars on a mobile device. The always-available cloud services are accessed from occasionally connected mobile devices that interact with tunnels, elevators, airplanes, and other purveyors of poor signal. As a result, the cloud de rigeur request/response conversational patterns become asynchronous with caches (containing potentially sensitive data) kept on the mobile side.

The colliding of the cloud and mobile worlds drives design requirements and constraints for the identity layer that links them. The developer must design for the lowest-common denominator, and identity tokens must be small and efficient to deal with reduced bandwidth and throughput of mobile. In practice, this means sending identity tokens by reference instead of by value. Session tokens must identify clients across longer-lived sessions, offer protections to locally cached data on the mobile device, and access control at a more granular level than what Mobile Device Management (MDM) offers. Access control must enforce boundaries at the application and data level, not just the device. To do this on mobile, identity protocols and server-side controls come back into focus.

The identity exchange patterns and protocols that link the cloud and mobile revolutions are still evolving. Reconciling the use cases, architecture, and threat models means joining two disparate models. This can occur via API gateways, security token services, and other denizens of the mobile midtier. The required services will include the ability to perform token translation, issuing and validating mobile and cloud-specific identity tokens, and mapping and scoping those tokens for each deployment environment.

Most identity standards work has been driven out of the cloud way of thinking, but it's more likely that mobile is the catalyst going forward. At minimum, more integration and granularity in access control is required today in mobile.

This means the next wave of identity design requirements emerge not out of the cloud infrastructure, but rather out of the mobile device "thingafrastructure" that consumes the cloud services.

Gunnar Peterson is a Managing Principal at Arctec Group Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web