Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

11/14/2012
11:01 AM
Gunnar Peterson
Gunnar Peterson
Commentary
50%
50%

When Cloud Met Mobile

Identity must link the disparate worlds of mobile and cloud

A few years ago, when the cloud really started to gain traction, it did not seem possible any other technology could exceed its hype or promise. Well, at least until the iPhone came along. Subsequent to the great cloud migration, mobile deployments took technology hype and promise to new heights.

Unlike other technology revolutions that subsume each other, the cloud and mobile are unfolding on parallel and related tracks. The smartphone wave came along after the cloud, but the cloud never really stopped growing. When you click a button on your iPhone, it's talking to a server in the cloud.

The cloud is a deployment model, really -- an IT middleware model, but it lacked a killer app. What's the cloud client? Browsers? Meh. We have those already. But along comes mobile with its need for distribution, high scale, and an always-on server, and suddenly middleware, the wonkiest of the wonky left in the corner talking to itself at cocktail parties, is answering calls like, 'Hey, beautiful -- where you been all my life? We need server platforms that scale for mobile user base.'"

These two distinct computing revolutions emerged independently, but now they are evolving together. But for two technologies that work together and support each other in practice, it's hard to imagine two technologies with less in common architecturally than the cloud and mobile. Cloud deployments are about standards, high throughput, constant connectivity, huge bandwidth, and request/response conversational models.

Chris Hoff sums up the three cloud layers as:

  • Infostructure: Content & Context, Apps, Metadata, Services
  • Metastructure: Glue & Guts, IPAM, IAM, BGP, DNS, SSL, PKI
  • Infrastructure: Sprockets & Moving Parts, Compute, Network, Storage

In most architectures, browser and service clients communicate to cloud providers via standard based protocols. But the cloud and mobile could scarcely be more different: Gargantuan throughput and bandwidth in the cloud is reduced counting bars on a mobile device. The always-available cloud services are accessed from occasionally connected mobile devices that interact with tunnels, elevators, airplanes, and other purveyors of poor signal. As a result, the cloud de rigeur request/response conversational patterns become asynchronous with caches (containing potentially sensitive data) kept on the mobile side.

The colliding of the cloud and mobile worlds drives design requirements and constraints for the identity layer that links them. The developer must design for the lowest-common denominator, and identity tokens must be small and efficient to deal with reduced bandwidth and throughput of mobile. In practice, this means sending identity tokens by reference instead of by value. Session tokens must identify clients across longer-lived sessions, offer protections to locally cached data on the mobile device, and access control at a more granular level than what Mobile Device Management (MDM) offers. Access control must enforce boundaries at the application and data level, not just the device. To do this on mobile, identity protocols and server-side controls come back into focus.

The identity exchange patterns and protocols that link the cloud and mobile revolutions are still evolving. Reconciling the use cases, architecture, and threat models means joining two disparate models. This can occur via API gateways, security token services, and other denizens of the mobile midtier. The required services will include the ability to perform token translation, issuing and validating mobile and cloud-specific identity tokens, and mapping and scoping those tokens for each deployment environment.

Most identity standards work has been driven out of the cloud way of thinking, but it's more likely that mobile is the catalyst going forward. At minimum, more integration and granularity in access control is required today in mobile.

This means the next wave of identity design requirements emerge not out of the cloud infrastructure, but rather out of the mobile device "thingafrastructure" that consumes the cloud services.

Gunnar Peterson is a Managing Principal at Arctec Group Gunnar Peterson (@oneraindrop) works on AppSec - Cloud, Mobile and Identity. He maintains a blog at http://1raindrop.typepad.com. View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16248
PUBLISHED: 2020-08-09
** DISPUTED ** Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability.
CVE-2020-15820
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
CVE-2020-15821
PUBLISHED: 2020-08-08
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
CVE-2020-15823
PUBLISHED: 2020-08-08
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
CVE-2020-15824
PUBLISHED: 2020-08-08
In JetBrains Kotlin before 1.4.0, there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by default.