Cloud Security: The Federated Identity Factor

By Patrick Harding and Gunnar Peterson

November 9, 2010

The Web has experienced remarkable innovation during the last two decades. Web application pioneers have given the world the ability to share more data in more dynamic fashion with greater and greater levels of structure and reliability, yet the digital security mechanisms that protect the data being served have remained remarkably static.  We have finally reached the point where traditional web security can no longer protect our interests, as our corporate data now moves and rests between a web of physical and network locations, many of which are only indirectly controlled and protected by the primary data owner.

How have web applications evolved to de-emphasize security, and why has greater security become critical today?  The answer comes by exploring common practices and comparing them to the best practices that are becoming the heir to throne of web application security: Federated Identity. 

A Brief History of Web Applications

Commercial use of the World Wide Web began in the early 1990’s with the debut of the browser. The browser made the Web accessible to the masses, and businesses began aggressively populating the Web with a wealth of static HyperText Markup Language (HTML) content.  

Recognizing the untapped potential of a worldwide data network, software vendors began to innovate.  By the mid-1990’s, dynamic functionality became available via scripting languages like the Common Gateway Interface (CGI) and Perl. ”Front-end” Web applications accessed data stored on “back-end” servers and mainframes. The security practice of “armoring” servers and connections began here, by building firewalls to protect servers and networks, and creating SSL (Secure Sockets Layer) to protect connections on the wire.

The Web continued to grow in sophistication: Active Server Pages (ASP) and JavaServer Pages (JSP) allowed applications to become substantially more sophisticated.  Purpose-built, transaction-oriented Web application servers emerged next, like Enterprise JavaBeans (EJB) and the Distributed Component Object Model (DCOM), making it easier to integrate data from multiple sources.  The need to structure data became strong and protocols like Simple Object Access Protocol (SOAP) and the eXtensible Markup Language (XML) emerged in 1999. 

From 2001 to present, services evolved as a delivery model that de-emphasized the physical proximity of servers to clients, and instead emphasized loosely coupled interfaces.  Services-Oriented Architecture (SOA) and the Representational State Transfer (REST) architectures both allow interaction between servers, businesses and domains, and combined with advances in latency and performance that accompanied the Web 2.0 movement, the foundation was laid.

These innovations have all helped enable the “cloud.” The concept of a cloud has long been used to depict the Internet, but this cloud is different.  It embodies the ability of an organization to outsource both virtual and physical needs.  Applications that once ran entirely on internal servers are now provided via Software-as-a-Service (SaaS).  Platforms and Infrastructure are now also available as PaaS and IaaS offerings, respectively. 

During all of these advances, one aspect of the Web has remained relatively static:  the layers of security provided by firewalls, and the Secure Socket Layer (SSL).  To be sure, there have been advances in Web security.  Firewalls have become far more sophisticated with Deep Packet Inspection and intrusion detection/prevention capabilities, and SSL has evolved into Transport Layer Security (TLS) with support for the Advanced Encryption Standard.  But are these modest advances sufficient to secure today’s cloud? 

Year
Web Application Software
Web Security Provisions
1995
CGI/Perl
Firewall & SSL
1997
JSP/ASP
Firewall & SSL
1998
EJB/DCOM
Firewall & SSL
1999
SOAP/XML
Firewall & SSL
2001
SOA/REST
Firewall & SSL
2003
Web 2.0
Firewall & SSL
2009
Cloud
???

This table summarizes the tremendous innovation that has taken place in Web application software over the years while relatively little innovation occurred in Web security. 

The Web’s “security status quo” is well understood by those advancing the state-of-the-art in Web applications.  For example, SOAP was designed to be a firewall-friendly protocol.  But as Bruce Schneier, the internationally renowned security technologist, observed, “Calling SOAP a firewall-friendly protocol is like having a skull-friendly bullet.” 

Schneier’s tongue-in-cheek comment highlights a serious problem. While firewalls, NAT and SSL/TLS are necessary for securing the Web, they are no longer sufficient for securing cloud-based applications.  This lack of innovation forces SaaS and other service providers to rely on the so-called “strong password” for security.  “Strong” password may be great in theory, but they can create serious problems in practice. 

The Problem with Passwords

For the sake of discussion here, a “strong” password is defined as one consisting of a combination of numbers and letters (with some capitalized) that does not spell any word or contain any discernable sequence.  How many strong passwords  is a mere mortal expected to memorize, given that writing down or otherwise recording passwords defeats the idea of a shared secret?

The average enterprise employee used 12 UserID/password pairs for accessing the many applications required to perform his or her job (Osterman Research 2009).  It is unreasonable to expect anyone to create, regularly change (also a prudent security practice) and memorize a dozen passwords, but is considered today to be a common practice.  Users are forced to take short-cuts, such as using the same UserID and password for all applications, or writing down their many strong passwords on Post-It notes or, even worse, in a file on their desktop or smartphone. 

Even if most users could memorize several strong passwords, there remains risk to the organization when passwords are used to access services externally (beyond the firewall) where they can be phished, intercepted or otherwise stolen.  The underlying problem with passwords is that they work well only in “small” spaces; that is, in environments that have other means to mitigate risk.  Consider as an analogy the bank vault.  Its combination is the equivalent of a strong password, and is capable of adequately protecting the vault’s contents if, and only if, there are other layers of security at the bank. 

Such other layers of security also exist within the enterprise in the form of locked doors, receptionists, ID badges, security guards, video surveillance, etc.  These layers of security explain why losing a laptop PC in a public place can be a real problem (and why vaults are never located outside of banks!). 

Ideally, these same layers of internal security could also be put to use securing access to external cloud-based applications.  Also ideally, users could then be asked to remember only one strong password (like the bank vault combination), or use just one method of multi-factor authentication.  And ideally, the IT department could administer user access controls for all internal and external applications centrally via a common directory (and no longer be burdened by constant calls to the Help Desk from users trying to recall so many different passwords). 

One innovation in Internet security makes this ideal a practical reality:  federated identity. 

Federated Identity Secures the Cloud

Parsing “federated identity” into its two constituent words reveals the power behind this approach to securing the cloud.  The identity is of an individual user, which is the basis for both authentication (the credentials for establishing the user is who he/she claims to be) and authorization (the applications permitted for use by specific users).  Federation involves a set of standards that allows identity-related information to be shared securely between parties, in this case:  the enterprise and cloud-based service providers. 

The major advantage of federated identity is that it enables the enterprise to maintain full and centralized control over access to all applications, whether internal or external. The IT department also controls how users authenticate, including whatever credentials may be required.  A related advantage is that, with all access control provisions fully centralized, “on-boarding” (adding new employees) and “off-boarding” (terminating employees) become at once more secure and substantially easier to perform. 

Identity-related information is shared between the enterprise and cloud-based providers through security tokens; not the physical kind, but as cryptographically encoded and digitally signed documents (e.g. XML-based SAML tokens) that contain data about a user.  Under this trust model, the good guys have good documents (security tokens) from a trusted source; the bad guys never do.  For this reason, both the enterprise and the service providers are protected. 

To ensure integrity while also affording sufficient flexibility, the security tokens are quite extensive.  For example, the Security Association Markup Language (SAML) standard includes the following elements in its security token:  Issuer (e.g. the enterprise); One-time Use Password; Validity Window (time period when valid); Subject (the user); Context (how the user authenticated); Claims (attributes about the user); and Integrity (digital signature with encryption for confidentiality).  The Claims section is like a “scribble pad” for specifying a wide variety of user attributes that can be used by the application for different purposes such as authorization, personalization or even provisioning a new account.  Indeed, some believe that identity-related Attributes are so significant for Cloud security, that they should become a fourth “A” in AAA systems. 

Two Basic Roles

In the cloud, there are always (at a minimum) two parties.  In fact, “two” serves as the theme for the remainder of this section that explains what federated identity is and how it works. 

The two basic roles are the Identity Provider (IdP) and the Relying Party (RP).  The Identity Provider is the authoritative source of the identity information contained in the security tokens; in this case:  the enterprise.  The Relying Parties (the service providers) establish relationships with one or more Identity Providers and  accept the security tokens containing the assertions needed to govern access control. 

The authoritative nature of and the structured relationship between the two parties is fundamental to federated identity.  Based on the trust established between the Relying Parties and the Identity Providers, the Relying Parties have full confidence in the security tokens issued.  This is not unlike the trust the public places in a driver’s license issued by the Department of Motor Vehicles.

The First and Last Mile

These two distinct IdP and RP roles have led some to refer to the first and last “miles” in federated identity.  The “First Mile” is where the process originates:  at the enterprise as the Identity Provider.  It is in this First Mile where the Authentication Service is integrated with the Security Token Service.  The “Last Mile” is at the receiving end:  at the Relying Party or service provider where the data contained in the security token is integrated with the target application infrastructure (particularly its access control provisions). 

Two Basic Operations

Federated identity has two basic operations:  Issuing and validating the security tokens.  Based on an input or request, the Identity Provider issues a security token.  For example, a UserID/password could generate a cookie, or a Kerberos Ticket could generate a SAML Token.  The Relying Party then validates the security token to ensure it is issued by a trusted authority, properly signed, still in effect (not expired), intended for the right audience, etc. 

Two Methods of Exchange

Security tokens can be exchanged in two different ways:  passive and active.  Passive exchanges are those initiated from a browser, which becomes the “passive” client.  Common mechanisms for passive exchanges include SAML (the protocol) via Browser POST, Redirect or Artifact Binding.  Active exchanges, as the name implies, require the client to play a more active role and can  initiate web service requests.  Normally this done through an Application Programming Interface (API) specified in standards like WS-Trust or OAuth. 

The actual exchange, whether passive or active, is performed using standard protocols.  In addition to the obvious send and receive functions, these protocols can also request a token, request a response, and even transform tokens in various ways.  Examples of such standards include SAML, WS-Federation, WS-Trust, OAuth and OpenID.  With so many options, it is not uncommon for a Security Token Service to support multiple protocols and multiple endpoints, and for a single security token to pass through multiple STS endpoints and be transformed multiple times. 

Two Base Use Cases

The two most common use cases for federated identity are Single Sign-On (SSO) and API Security.  As the name implies, SSO allows users to sign on once (with a strong password or other credentials), then access all authorized applications (internal and external) via a portal or other convenient means of navigation.  Because it is browser-based, SSO generally employs SAML or WS-Federation with passive exchange redirects to the Security Token Service. 

API Security requires an active client or server that directly contacts the STS via Web services.  The popular standards include WS-Trust, OAuth and REST.  As with SSO, the claims asserted in the security token can be used to set up a session and/or provision an account.  Unlike with SSO, the claims can also be used for server-to-server applications, or by a service acting as (or on behalf of) a user. 

In Conclusion

As the popularity of cloud-based applications continues to grow, IT departments will increasingly turn to federated identity as the preferred means for managing access control.  With federated identity, users and the IT staff both benefit from greater convenience and productivity.  Users log in only once, remembering only one strong password, to access all authorized applications.  The IT staff gains full, centralized control over all access privileges for both internal and external applications, and is no longer burdened with constant calls to the Help Desk from users forgetting their passwords. 

The most important aspect of federated identity is not its ease of use, however; it is the enhanced security.  Standards like SAML and WS-Federation were purpose-built to provide robust security in the cloud.  They keep authentication strong and securely within the enterprise firewall.  They eliminate the need to maintain sensitive access control information external to the organization.  They enable successful on- and off-boarding of all employees on a common directory server.  They make it easier to pass security audits by giving full visibility into user access.  They afford the flexibility needed to accommodate special or unusual needs.  And they scale without adding significant cost or increased complexity. 

About the Authors

Patrick Harding, CTO, Ping Identity

Harding brings more than 20 years of experience in software development, networking infrastructure and information security to the role of Chief Technology Officer for Ping Identity. Harding is responsible for Ping Identity’s technology strategy. Previously, Harding was a vice president and security architect at Fidelity Investments where he was responsible for aligning identity management and security technologies with the strategic goals of the business. Harding was integrally involved with the implementation of federated identity technologies at Fidelity — from “napkin” to production. An active leader in the Identity Security space, Harding is a Founding Board Member for the Information Card Foundation, a member of the Cloud Security Alliance Board of Advisors, on the steering committee for OASIS and actively involved in the Kantara Initiative and Project Concordia. He is a regular speaker at RSA, Digital ID World, SaaS Summit, Burton Catalyst and other conferences. Harding holds a BS Degree in Computer Science from the University of New South Wales in Sydney, Australia.

*Arctec Group Managing Principal Gunnar Peterson also contributed to the content of this article. 

To learn more about Identity’s role in Cloud Security, see the Cloud Security Institute’s “Cloud Security:  The Identity Factor” Webinar.

 

Subscribe to HPCwire's Weekly Update!

Be the most informed person in the room! Stay ahead of the tech trends with industy updates delivered to you every week!

TACC Helps ROSIE Bioscience Gateway Expand its Impact

April 26, 2017

Biomolecule structure prediction has long been challenging not least because the relevant software and workflows often require high end HPC systems that many bioscience researchers lack easy access to. Read more…

By John Russell

Messina Update: The U.S. Path to Exascale in 16 Slides

April 26, 2017

Paul Messina, director of the U.S. Exascale Computing Project, provided a wide-ranging review of ECP’s evolving plans last week at the HPC User Forum. Read more…

By John Russell

IBM, Nvidia, Stone Ridge Claim Gas & Oil Simulation Record

April 25, 2017

IBM, Nvidia, and Stone Ridge Technology today reported setting the performance record for a “billion cell” oil and gas reservoir simulation. Read more…

By John Russell

ASC17 Makes Splash at Wuxi Supercomputing Center

April 24, 2017

A record-breaking twenty student teams plus scores of company representatives, media professionals, staff and student volunteers transformed a formerly empty hall inside the Wuxi Supercomputing Center into a bustling hub of HPC activity, kicking off day one of 2017 Asia Student Supercomputer Challenge (ASC17). Read more…

By Tiffany Trader

HPE Extreme Performance Solutions

Remote Visualization Optimizing Life Sciences Operations and Care Delivery

As patients continually demand a better quality of care and increasingly complex workloads challenge healthcare organizations to innovate, investing in the right technologies is key to ensuring growth and success. Read more…

Groq This: New AI Chips to Give GPUs a Run for Deep Learning Money

April 24, 2017

CPUs and GPUs, move over. Thanks to recent revelations surrounding Google’s new Tensor Processing Unit (TPU), the computing world appears to be on the cusp of a new generation of chips designed specifically for deep learning workloads. Read more…

By Alex Woodie

Musk’s Latest Startup Eyes Brain-Computer Links

April 21, 2017

Elon Musk, the auto and space entrepreneur and severe critic of artificial intelligence, is forming a new venture that reportedly will seek to develop an interface between the human brain and computers. Read more…

By George Leopold

MIT Mathematician Spins Up 220,000-Core Google Compute Cluster

April 21, 2017

On Thursday, Google announced that MIT math professor and computational number theorist Andrew V. Sutherland had set a record for the largest Google Compute Engine (GCE) job. Sutherland ran the massive mathematics workload on 220,000 GCE cores using preemptible virtual machine instances. Read more…

By Tiffany Trader

NERSC Cori Shows the World How Many-Cores for the Masses Works

April 21, 2017

As its mission, the high performance computing center for the U.S. Department of Energy Office of Science, NERSC (the National Energy Research Supercomputer Center), supports a broad spectrum of forefront scientific research across diverse areas that includes climate, material science, chemistry, fusion energy, high-energy physics and many others. Read more…

By Rob Farber

Messina Update: The U.S. Path to Exascale in 16 Slides

April 26, 2017

Paul Messina, director of the U.S. Exascale Computing Project, provided a wide-ranging review of ECP’s evolving plans last week at the HPC User Forum. Read more…

By John Russell

ASC17 Makes Splash at Wuxi Supercomputing Center

April 24, 2017

A record-breaking twenty student teams plus scores of company representatives, media professionals, staff and student volunteers transformed a formerly empty hall inside the Wuxi Supercomputing Center into a bustling hub of HPC activity, kicking off day one of 2017 Asia Student Supercomputer Challenge (ASC17). Read more…

By Tiffany Trader

Groq This: New AI Chips to Give GPUs a Run for Deep Learning Money

April 24, 2017

CPUs and GPUs, move over. Thanks to recent revelations surrounding Google’s new Tensor Processing Unit (TPU), the computing world appears to be on the cusp of a new generation of chips designed specifically for deep learning workloads. Read more…

By Alex Woodie

NERSC Cori Shows the World How Many-Cores for the Masses Works

April 21, 2017

As its mission, the high performance computing center for the U.S. Department of Energy Office of Science, NERSC (the National Energy Research Supercomputer Center), supports a broad spectrum of forefront scientific research across diverse areas that includes climate, material science, chemistry, fusion energy, high-energy physics and many others. Read more…

By Rob Farber

Hyperion (IDC) Paints a Bullish Picture of HPC Future

April 20, 2017

Hyperion Research – formerly IDC’s HPC group – yesterday painted a fascinating and complicated portrait of the HPC community’s health and prospects at the HPC User Forum held in Albuquerque, NM. HPC sales are up and growing ($22 billion, all HPC segments, 2016). Read more…

By John Russell

Knights Landing Processor with Omni-Path Makes Cloud Debut

April 18, 2017

HPC cloud specialist Rescale is partnering with Intel and HPC resource provider R Systems to offer first-ever cloud access to Xeon Phi "Knights Landing" processors. The infrastructure is based on the 68-core Intel Knights Landing processor with integrated Omni-Path fabric (the 7250F Xeon Phi). Read more…

By Tiffany Trader

CERN openlab Explores New CPU/FPGA Processing Solutions

April 14, 2017

Through a CERN openlab project known as the ‘High-Throughput Computing Collaboration,’ researchers are investigating the use of various Intel technologies in data filtering and data acquisition systems. Read more…

By Linda Barney

DOE Supercomputer Achieves Record 45-Qubit Quantum Simulation

April 13, 2017

In order to simulate larger and larger quantum systems and usher in an age of “quantum supremacy,” researchers are stretching the limits of today’s most advanced supercomputers. Read more…

By Tiffany Trader

Google Pulls Back the Covers on Its First Machine Learning Chip

April 6, 2017

This week Google released a report detailing the design and performance characteristics of the Tensor Processing Unit (TPU), its custom ASIC for the inference phase of neural networks (NN). Read more…

By Tiffany Trader

Quantum Bits: D-Wave and VW; Google Quantum Lab; IBM Expands Access

March 21, 2017

For a technology that’s usually characterized as far off and in a distant galaxy, quantum computing has been steadily picking up steam. Read more…

By John Russell

Trump Budget Targets NIH, DOE, and EPA; No Mention of NSF

March 16, 2017

President Trump’s proposed U.S. fiscal 2018 budget issued today sharply cuts science spending while bolstering military spending as he promised during the campaign. Read more…

By John Russell

HPC Compiler Company PathScale Seeks Life Raft

March 23, 2017

HPCwire has learned that HPC compiler company PathScale has fallen on difficult times and is asking the community for help or actively seeking a buyer for its assets. Read more…

By Tiffany Trader

Nvidia Responds to Google TPU Benchmarking

April 10, 2017

Nvidia highlights strengths of its newest GPU silicon in response to Google's report on the performance and energy advantages of its custom tensor processor. Read more…

By Tiffany Trader

CPU-based Visualization Positions for Exascale Supercomputing

March 16, 2017

In this contributed perspective piece, Intel’s Jim Jeffers makes the case that CPU-based visualization is now widely adopted and as such is no longer a contrarian view, but is rather an exascale requirement. Read more…

By Jim Jeffers, Principal Engineer and Engineering Leader, Intel

For IBM/OpenPOWER: Success in 2017 = (Volume) Sales

January 11, 2017

To a large degree IBM and the OpenPOWER Foundation have done what they said they would – assembling a substantial and growing ecosystem and bringing Power-based products to market, all in about three years. Read more…

By John Russell

TSUBAME3.0 Points to Future HPE Pascal-NVLink-OPA Server

February 17, 2017

Since our initial coverage of the TSUBAME3.0 supercomputer yesterday, more details have come to light on this innovative project. Of particular interest is a new board design for NVLink-equipped Pascal P100 GPUs that will create another entrant to the space currently occupied by Nvidia's DGX-1 system, IBM's "Minsky" platform and the Supermicro SuperServer (1028GQ-TXR). Read more…

By Tiffany Trader

Leading Solution Providers

Tokyo Tech’s TSUBAME3.0 Will Be First HPE-SGI Super

February 16, 2017

In a press event Friday afternoon local time in Japan, Tokyo Institute of Technology (Tokyo Tech) announced its plans for the TSUBAME3.0 supercomputer, which will be Japan’s “fastest AI supercomputer,” Read more…

By Tiffany Trader

Is Liquid Cooling Ready to Go Mainstream?

February 13, 2017

Lost in the frenzy of SC16 was a substantial rise in the number of vendors showing server oriented liquid cooling technologies. Three decades ago liquid cooling was pretty much the exclusive realm of the Cray-2 and IBM mainframe class products. That’s changing. We are now seeing an emergence of x86 class server products with exotic plumbing technology ranging from Direct-to-Chip to servers and storage completely immersed in a dielectric fluid. Read more…

By Steve Campbell

IBM Wants to be “Red Hat” of Deep Learning

January 26, 2017

IBM today announced the addition of TensorFlow and Chainer deep learning frameworks to its PowerAI suite of deep learning tools, which already includes popular offerings such as Caffe, Theano, and Torch. Read more…

By John Russell

BioTeam’s Berman Charts 2017 HPC Trends in Life Sciences

January 4, 2017

Twenty years ago high performance computing was nearly absent from life sciences. Today it’s used throughout life sciences and biomedical research. Genomics and the data deluge from modern lab instruments are the main drivers, but so is the longer-term desire to perform predictive simulation in support of Precision Medicine (PM). There’s even a specialized life sciences supercomputer, ‘Anton’ from D.E. Shaw Research, and the Pittsburgh Supercomputing Center is standing up its second Anton 2 and actively soliciting project proposals. There’s a lot going on. Read more…

By John Russell

Facebook Open Sources Caffe2; Nvidia, Intel Rush to Optimize

April 18, 2017

From its F8 developer conference in San Jose, Calif., today, Facebook announced Caffe2, a new open-source, cross-platform framework for deep learning. Caffe2 is the successor to Caffe, the deep learning framework developed by Berkeley AI Research and community contributors. Read more…

By Tiffany Trader

HPC Startup Advances Auto-Parallelization’s Promise

January 23, 2017

The shift from single core to multicore hardware has made finding parallelism in codes more important than ever, but that hasn’t made the task of parallel programming any easier. Read more…

By Tiffany Trader

HPC Technique Propels Deep Learning at Scale

February 21, 2017

Researchers from Baidu’s Silicon Valley AI Lab (SVAIL) have adapted a well-known HPC communication technique to boost the speed and scale of their neural network training and now they are sharing their implementation with the larger deep learning community. Read more…

By Tiffany Trader

IDG to Be Bought by Chinese Investors; IDC to Spin Out HPC Group

January 19, 2017

US-based publishing and investment firm International Data Group, Inc. (IDG) will be acquired by a pair of Chinese investors, China Oceanwide Holdings Group Co., Ltd. Read more…

By Tiffany Trader

  • arrow
  • Click Here for More Headlines
  • arrow
Share This