When Cloud Met Mobile

A few years ago, when the cloud really started to gain traction, it did not seem possible any other technology could exceed its hype or promise. Well, at least until the iPhone came along. Subsequent to the great cloud migration, mobile deployments took technology hype and promise to new heights.

Unlike other technology revolutions that subsume each other, the cloud and mobile are unfolding on parallel and related tracks. The smartphone wave came along after the cloud, but the cloud never really stopped growing. When you click a button on your iPhone, it's talking to a server in the cloud.

The cloud is a deployment model, really -- an IT middleware model, but it lacked a killer app. What's the cloud client? Browsers? Meh. We have those already. But along comes mobile with its need for distribution, high scale, and an always-on server, and suddenly middleware, the wonkiest of the wonky left in the corner talking to itself at cocktail parties, is answering calls like, 'Hey, beautiful -- where you been all my life? We need server platforms that scale for mobile user base.'"

These two distinct computing revolutions emerged independently, but now they are evolving together. But for two technologies that work together and support each other in practice, it's hard to imagine two technologies with less in common architecturally than the cloud and mobile. Cloud deployments are about standards, high throughput, constant connectivity, huge bandwidth, and request/response conversational models.

Chris Hoff sums up the three cloud layers as:

In most architectures, browser and service clients communicate to cloud providers via standard based protocols. But the cloud and mobile could scarcely be more different: Gargantuan throughput and bandwidth in the cloud is reduced counting bars on a mobile device. The always-available cloud services are accessed from occasionally connected mobile devices that interact with tunnels, elevators, airplanes, and other purveyors of poor signal. As a result, the cloud de rigeur request/response conversational patterns become asynchronous with caches (containing potentially sensitive data) kept on the mobile side.

The colliding of the cloud and mobile worlds drives design requirements and constraints for the identity layer that links them. The developer must design for the lowest-common denominator, and identity tokens must be small and efficient to deal with reduced bandwidth and throughput of mobile. In practice, this means sending identity tokens by reference instead of by value. Session tokens must identify clients across longer-lived sessions, offer protections to locally cached data on the mobile device, and access control at a more granular level than what Mobile Device Management (MDM) offers. Access control must enforce boundaries at the application and data level, not just the device. To do this on mobile, identity protocols and server-side controls come back into focus.

The identity exchange patterns and protocols that link the cloud and mobile revolutions are still evolving. Reconciling the use cases, architecture, and threat models means joining two disparate models. This can occur via API gateways, security token services, and other denizens of the mobile midtier. The required services will include the ability to perform token translation, issuing and validating mobile and cloud-specific identity tokens, and mapping and scoping those tokens for each deployment environment.

Most identity standards work has been driven out of the cloud way of thinking, but it's more likely that mobile is the catalyst going forward. At minimum, more integration and granularity in access control is required today in mobile.

This means the next wave of identity design requirements emerge not out of the cloud infrastructure, but rather out of the mobile device "thingafrastructure" that consumes the cloud services.

Gunnar Peterson is a Managing Principal at Arctec Group