Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

11/14/2012
11:01 AM
Gunnar Peterson
Gunnar Peterson
Commentary
50%
50%

When Cloud Met Mobile

Identity must link the disparate worlds of mobile and cloud

A few years ago, when the cloud really started to gain traction, it did not seem possible any other technology could exceed its hype or promise. Well, at least until the iPhone came along. Subsequent to the great cloud migration, mobile deployments took technology hype and promise to new heights.

Unlike other technology revolutions that subsume each other, the cloud and mobile are unfolding on parallel and related tracks. The smartphone wave came along after the cloud, but the cloud never really stopped growing. When you click a button on your iPhone, it's talking to a server in the cloud.

The cloud is a deployment model, really -- an IT middleware model, but it lacked a killer app. What's the cloud client? Browsers? Meh. We have those already. But along comes mobile with its need for distribution, high scale, and an always-on server, and suddenly middleware, the wonkiest of the wonky left in the corner talking to itself at cocktail parties, is answering calls like, 'Hey, beautiful -- where you been all my life? We need server platforms that scale for mobile user base.'"

These two distinct computing revolutions emerged independently, but now they are evolving together. But for two technologies that work together and support each other in practice, it's hard to imagine two technologies with less in common architecturally than the cloud and mobile. Cloud deployments are about standards, high throughput, constant connectivity, huge bandwidth, and request/response conversational models.

Chris Hoff sums up the three cloud layers as:

  • Infostructure: Content & Context, Apps, Metadata, Services
  • Metastructure: Glue & Guts, IPAM, IAM, BGP, DNS, SSL, PKI
  • Infrastructure: Sprockets & Moving Parts, Compute, Network, Storage

In most architectures, browser and service clients communicate to cloud providers via standard based protocols. But the cloud and mobile could scarcely be more different: Gargantuan throughput and bandwidth in the cloud is reduced counting bars on a mobile device. The always-available cloud services are accessed from occasionally connected mobile devices that interact with tunnels, elevators, airplanes, and other purveyors of poor signal. As a result, the cloud de rigeur request/response conversational patterns become asynchronous with caches (containing potentially sensitive data) kept on the mobile side.

The colliding of the cloud and mobile worlds drives design requirements and constraints for the identity layer that links them. The developer must design for the lowest-common denominator, and identity tokens must be small and efficient to deal with reduced bandwidth and throughput of mobile. In practice, this means sending identity tokens by reference instead of by value. Session tokens must identify clients across longer-lived sessions, offer protections to locally cached data on the mobile device, and access control at a more granular level than what Mobile Device Management (MDM) offers. Access control must enforce boundaries at the application and data level, not just the device. To do this on mobile, identity protocols and server-side controls come back into focus.

The identity exchange patterns and protocols that link the cloud and mobile revolutions are still evolving. Reconciling the use cases, architecture, and threat models means joining two disparate models. This can occur via API gateways, security token services, and other denizens of the mobile midtier. The required services will include the ability to perform token translation, issuing and validating mobile and cloud-specific identity tokens, and mapping and scoping those tokens for each deployment environment.

Most identity standards work has been driven out of the cloud way of thinking, but it's more likely that mobile is the catalyst going forward. At minimum, more integration and granularity in access control is required today in mobile.

This means the next wave of identity design requirements emerge not out of the cloud infrastructure, but rather out of the mobile device "thingafrastructure" that consumes the cloud services.

Gunnar Peterson is a Managing Principal at Arctec Group Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9678
PUBLISHED: 2019-09-18
Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for v...
CVE-2019-9679
PUBLISHED: 2019-09-18
Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time i...
CVE-2019-9680
PUBLISHED: 2019-09-18
Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious data packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-...
CVE-2019-9677
PUBLISHED: 2019-09-18
The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X fo...
CVE-2019-14458
PUBLISHED: 2019-09-18
VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.