Click here to close now.


Java IoT Authors: Jim Scott, Pat Romanski, Adrian Bridgwater, Liz McMillan, Pete Waterhouse

Related Topics: @CloudExpo, Industrial IoT, Open Source Cloud, Containers Expo Blog, Agile Computing, Cloud Security

@CloudExpo: Article

Turning Identity-as-a-Service Inside Out

From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Simple question with a surprisingly complex answer: who owns your identity? Our first instinct is to insist that we each own our own identities. After all, we are our identities, right?

Not so fast. There are myriad players who own a piece of your identity, from the credit bureaus to your bank to Facebook to your doctor to your employer. Every single one has some kind of identity management system that keeps track of information about you. In fact, this personally identifiable information (PII) is so powerful that when someone steals it, we call that crime identity theft - as though stealing your PII was the equivalent of stealing your very soul.

The reason PII has such power, of course, is because we give it power. Knowing a username and password gives you the power to access a system. Knowing your Social Security Number and birth date may give you the power to get bank account information from a call center rep. Add a bit more knowledge and you have the power to apply for a loan or a job or a security clearance. The old adage states that knowledge is power, but information only has power if we choose to empower it.

From the perspective of IT, managing user identities has long been in our wheelhouse. The Identity and Access Management (IAM) market matured years ago, and all enterprises have a broad set of robust IAM alternatives to choose from. But hey, it's almost 2013, right? Why buy some IAM product I have to install and maintain. Why don't I just get it in the Cloud?

The Problem with Identity-as-a-Service
No brainer, right? Sign up for Identity-as-a-Service (IDaaS), or perhaps call it Identity Management as a Service (IDMaaS) or IAM as a Service (IAMaaS) - the marketplace still hasn't settled on the term - and you can throw away your Active Directory or LDAP. If all your users want to do is access the Software-as-a-Service (SaaS) offerings you provide, then placing your user directory in the Cloud is an obvious choice. Even when you want to control access to on-premise applications, IDaaS might make sense. After all, your current IAM solution connects to the apps in question over the network as it is. What does it matter whether IAM is running in the Cloud or not? Just put your user directory in the Cloud, configure it to control access to all your apps, and call it a day.

The problem is, this "put all the users in a directory" approach to IAM is increasingly inadequate to cover the kinds of identity management scenarios that we're facing in our maddeningly complex, interconnected world. But this story isn't new, either; after all, federated identity standards and technologies have been around for a decade or more. With federated identity, two separate security domains (that is, different departments or organizations with their own IAM systems) can exchange identity information with each other securely. Think of one of the travel aggregators, like Orbitz or Travelocity. Log into the aggregator Web site and you can purchase tickets and hotel rooms and the like, without ever contacting the airline or hotel directly. Behind the scenes the aggregator and the service provider are exchanging secure tokens that contain a bit of your identity, along with the appropriate instructions.

Federated identity is an essential enabler of Cloud security as well, particularly when the enterprise isn't comfortable moving their IAM to the Cloud. In fact, federating on-premise identity to the Cloud is a central technique we discuss in our Cloud Computing for Architects course. But it's not the same as IDaaS, where an organization actually moves its user directory to the Cloud. And federated identity breaks down when there are too many participants in a complex interaction, like the types of interactions that are becoming increasingly common in the Cloud.

So far so good: IDaaS isn't right for every organization today, but it could easily belong somewhere on your Cloud roadmap. But even when you reach a level of maturity where you're comfortable moving your IAM to the Cloud, IDaaS still falls short, because it doesn't take into account how we as individuals would like to think about our identities. From the perspective of the user, IDaaS moves the control over our own identities even further away from the user - and that's not the way we consumers view the Cloud. From the perspective of the user, the Cloud should empower us. IDaaS does the opposite.

Identity as a Cloud Resource
The reason so many vendors fell into this trap with IDaaS is essentially the horseless carriage problem: we have IAM, we want to move to the Cloud, so let's put IAM in the Cloud - instead of rethinking the problem from the perspective of what the Cloud actually means. So, let's think about this problem in an entirely different way. Instead of beginning with the user directory at the heart of every IAM offering, let's begin with the user identity itself.

Essentially, we'd like to have some kind of avatar: a digital representation of our identity that the user controls for themselves. In other words, something like a digital wallet or key ring that manages PII on behalf of the user. Such technologies have been around for a few decades, of course; in fact, the whole idea of a digital wallet dates from the era in the 1990s. But such technologies didn't take off, for two reasons. First, big companies didn't like the idea of giving their customers control of their own identities. Second, we didn't have the Cloud.

Let's put off the discussion of control for a moment, because putting the Cloud piece into the puzzle will help us deal with the control issue. We need to consider the Cloud, however, because it changes everything. What the Cloud brings to the table is not just the ability to treat identity management as a service. It also enables us to treat identities themselves as Cloud resources.

As we discussed in an earlier ZapFlash, there are many different types of Cloud resources, including servers, storage, networks, queues, etc. Furthermore, the list isn't fixed. As Cloud Computing matures, we expect and encourage new types of resources. What makes them Cloud resources is that the user is able to dynamically provision and deprovision them with minimal management effort or service provider interaction.

So, let's take the notion of a user identity - or to be more precise, the user's avatar - and consider it to be a Cloud resource. The user, that is, we can provision such avatars as we see fit. And because they're in the Cloud, they're location independent. Facebook could use our avatar. Assign it privileges or other properties. Or our bank. Or our employer. But we control it.

Furthermore, we can choose how we control our Avatar. We may wish to log into its Web interface, but that's only one option. We could also use a hardware device like a flash drive or a USB dongle. We could add biometrics to the device, say via a fingerprint reader. Or we could install software on our computers that would enable us to control the avatar.

Treating identities as Cloud resources can also provide privacy boundaries. For example, I might instruct my avatar to provide my Social Security Number to my bank and the IRS, but not to Facebook. And of course, one of the primary benefits of this approach is that I can maintain my personal information in a single place. If I move, I notify my avatar, and everyone I've authorized to see my address automatically gets the update.

The ZapThink Take
In fact, treating identity as a provisionable Cloud resource - an avatar in the Cloud - makes so much sense that you might wonder why nobody has already made a billion dollars on this idea. The answer, of course, is control. Remember all the hullabaloo when Microsoft tried to position Passport as a general purpose identity store? Customers rebelled and Microsoft ended up in court - several times, in fact. Fundamentally, nobody wanted Microsoft to be in control of our identities.

Today we're going through a similar situation with Facebook, Twitter, and the like. Why bother creating yet another login with yet another password to forget, when we can simply log into that new site with our Facebook ID? Yes, we all go along, until we eventually realize we really don't want to give Facebook so much control over our online identity.

The Cloud, at least in theory, shifts this control to the user. The user should be responsible for provisioning Cloud resources. Yes, there needs to be software behind the scenes that makes provisionable avatars work and keeps them secure, but if they are truly Cloud resources, the Cloud service providers won't control them. Their customers will.

Image source: Sundaram Ramaswamy

More Stories By Jason Bloomberg

Jason Bloomberg is the leading expert on architecting agility for the enterprise. As president of Intellyx, Mr. Bloomberg brings his years of thought leadership in the areas of Cloud Computing, Enterprise Architecture, and Service-Oriented Architecture to a global clientele of business executives, architects, software vendors, and Cloud service providers looking to achieve technology-enabled business agility across their organizations and for their customers. His latest book, The Agile Architecture Revolution (John Wiley & Sons, 2013), sets the stage for Mr. Bloomberg’s groundbreaking Agile Architecture vision.

Mr. Bloomberg is perhaps best known for his twelve years at ZapThink, where he created and delivered the Licensed ZapThink Architect (LZA) SOA course and associated credential, certifying over 1,700 professionals worldwide. He is one of the original Managing Partners of ZapThink LLC, the leading SOA advisory and analysis firm, which was acquired by Dovel Technologies in 2011. He now runs the successor to the LZA program, the Bloomberg Agile Architecture Course, around the world.

Mr. Bloomberg is a frequent conference speaker and prolific writer. He has published over 500 articles, spoken at over 300 conferences, Webinars, and other events, and has been quoted in the press over 1,400 times as the leading expert on agile approaches to architecture in the enterprise.

Mr. Bloomberg’s previous book, Service Orient or Be Doomed! How Service Orientation Will Change Your Business (John Wiley & Sons, 2006, coauthored with Ron Schmelzer), is recognized as the leading business book on Service Orientation. He also co-authored the books XML and Web Services Unleashed (SAMS Publishing, 2002), and Web Page Scripting Techniques (Hayden Books, 1996).

Prior to ZapThink, Mr. Bloomberg built a diverse background in eBusiness technology management and industry analysis, including serving as a senior analyst in IDC’s eBusiness Advisory group, as well as holding eBusiness management positions at USWeb/CKS (later marchFIRST) and WaveBend Solutions (now Hitachi Consulting).

@ThingsExpo Stories
Organizations already struggle with the simple collection of data resulting from the proliferation of IoT, lacking the right infrastructure to manage it. They can't only rely on the cloud to collect and utilize this data because many applications still require dedicated infrastructure for security, redundancy, performance, etc. In his session at 17th Cloud Expo, Emil Sayegh, CEO of Codero Hosting, will discuss how in order to resolve the inherent issues, companies need to combine dedicated and cloud solutions through hybrid hosting – a sustainable solution for the data required to manage I...
Clearly the way forward is to move to cloud be it bare metal, VMs or containers. One aspect of the current public clouds that is slowing this cloud migration is cloud lock-in. Every cloud vendor is trying to make it very difficult to move out once a customer has chosen their cloud. In his session at 17th Cloud Expo, Naveen Nimmu, CEO of Clouber, Inc., will advocate that making the inter-cloud migration as simple as changing airlines would help the entire industry to quickly adopt the cloud without worrying about any lock-in fears. In fact by having standard APIs for IaaS would help PaaS expl...
Apps and devices shouldn't stop working when there's limited or no network connectivity. Learn how to bring data stored in a cloud database to the edge of the network (and back again) whenever an Internet connection is available. In his session at 17th Cloud Expo, Bradley Holt, Developer Advocate at IBM Cloud Data Services, will demonstrate techniques for replicating cloud databases with devices in order to build offline-first mobile or Internet of Things (IoT) apps that can provide a better, faster user experience, both offline and online. The focus of this talk will be on IBM Cloudant, Apa...
SYS-CON Events announced today that Cloud Raxak has been named “Media & Session Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Raxak Protect automates security compliance across private and public clouds. Using the SaaS tool or managed service, developers can deploy cloud apps quickly, cost-effectively, and without error.
SYS-CON Events announced today that ProfitBricks, the provider of painless cloud infrastructure, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. ProfitBricks is the IaaS provider that offers a painless cloud experience for all IT users, with no learning curve. ProfitBricks boasts flexible cloud servers and networking, an integrated Data Center Designer tool for visual control over the cloud and the best price/performance value available. ProfitBricks was named one of the coolest Clo...
SYS-CON Events announced today that IBM Cloud Data Services has been named “Bronze Sponsor” of SYS-CON's 17th Cloud Expo, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. IBM Cloud Data Services offers a portfolio of integrated, best-of-breed cloud data services for developers focused on mobile computing and analytics use cases.
Mobile messaging has been a popular communication channel for more than 20 years. Finnish engineer Matti Makkonen invented the idea for SMS (Short Message Service) in 1984, making his vision a reality on December 3, 1992 by sending the first message ("Happy Christmas") from a PC to a cell phone. Since then, the technology has evolved immensely, from both a technology standpoint, and in our everyday uses for it. Originally used for person-to-person (P2P) communication, i.e., Sally sends a text message to Betty – mobile messaging now offers tremendous value to businesses for customer and empl...
Learn how IoT, cloud, social networks and last but not least, humans, can be integrated into a seamless integration of cooperative organisms both cybernetic and biological. This has been enabled by recent advances in IoT device capabilities, messaging frameworks, presence and collaboration services, where devices can share information and make independent and human assisted decisions based upon social status from other entities. In his session at @ThingsExpo, Michael Heydt, founder of Seamless Thingies, will discuss and demonstrate how devices and humans can be integrated from a simple clust...
Who are you? How do you introduce yourself? Do you use a name, or do you greet a friend by the last four digits of his social security number? Assuming you don’t, why are we content to associate our identity with 10 random digits assigned by our phone company? Identity is an issue that affects everyone, but as individuals we don’t spend a lot of time thinking about it. In his session at @ThingsExpo, Ben Klang, Founder & President of Mojo Lingo, will discuss the impact of technology on identity. Should we federate, or not? How should identity be secured? Who owns the identity? How is identity ...
You have your devices and your data, but what about the rest of your Internet of Things story? Two popular classes of technologies that nicely handle the Big Data analytics for Internet of Things are Apache Hadoop and NoSQL. Hadoop is designed for parallelizing analytical work across many servers and is ideal for the massive data volumes you create with IoT devices. NoSQL databases such as Apache HBase are ideal for storing and retrieving IoT data as “time series data.”
SYS-CON Events announced today that HPM Networks will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. For 20 years, HPM Networks has been integrating technology solutions that solve complex business challenges. HPM Networks has designed solutions for both SMB and enterprise customers throughout the San Francisco Bay Area.
The broad selection of hardware, the rapid evolution of operating systems and the time-to-market for mobile apps has been so rapid that new challenges for developers and engineers arise every day. Security, testing, hosting, and other metrics have to be considered through the process. In his session at Big Data Expo, Walter Maguire, Chief Field Technologist, HP Big Data Group, at Hewlett-Packard, will discuss the challenges faced by developers and a composite Big Data applications builder, focusing on how to help solve the problems that developers are continuously battling.
As enterprises capture more and more data of all types – structured, semi-structured, and unstructured – data discovery requirements for business intelligence (BI), Big Data, and predictive analytics initiatives grow more complex. A company’s ability to become data-driven and compete on analytics depends on the speed with which it can provision their analytics applications with all relevant information. The task of finding data has traditionally resided with IT, but now organizations increasingly turn towards data source discovery tools to find the right data, in context, for business users, d...
SYS-CON Events announced today that MobiDev, a software development company, will exhibit at the 17th International Cloud Expo®, which will take place November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software development company with representative offices in Atlanta (US), Sheffield (UK) and Würzburg (Germany); and development centers in Ukraine. Since 2009 it has grown from a small group of passionate engineers and business managers to a full-scale mobile software company with over 150 developers, designers, quality assurance engineers, project manage...
“The Internet of Things transforms the way organizations leverage machine data and gain insights from it,” noted Splunk’s CTO Snehal Antani, as Splunk announced accelerated momentum in Industrial Data and the IoT. The trend is driven by Splunk’s continued investment in its products and partner ecosystem as well as the creativity of customers and the flexibility to deploy Splunk IoT solutions as software, cloud services or in a hybrid environment. Customers are using Splunk® solutions to collect and correlate data from control systems, sensors, mobile devices and IT systems for a variety of Ind...
SYS-CON Events announced today that Solgeniakhela will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Solgeniakhela is the global market leader in Cloud Collaboration and Cloud Infrastructure software solutions. Designed to “Bridge the Gap” between Personal and Professional Social, Mobile and Cloud user experiences, our solutions help large and medium-sized organizations dramatically improve productivity, reduce collaboration costs, and increase the overall enterprise value by bringing ...
Sensors and effectors of IoT are solving problems in new ways, but small businesses have been slow to join the quantified world. They’ll need information from IoT using applications as varied as the businesses themselves. In his session at @ThingsExpo, Roger Meike, Distinguished Engineer, Director of Technology Innovation at Intuit, will show how IoT manufacturers can use open standards, public APIs and custom apps to enable the Quantified Small Business. He will use a Raspberry Pi to connect sensors to web services, and cloud integration to connect accounting and data, providing a Bluetooth...
SYS-CON Events announced today that Micron Technology, Inc., a global leader in advanced semiconductor systems, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Micron’s broad portfolio of high-performance memory technologies – including DRAM, NAND and NOR Flash – is the basis for solid state drives, modules, multichip packages and other system solutions. Backed by more than 35 years of technology leadership, Micron's memory solutions enable the world's most innovative computing, consumer,...
Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
SYS-CON Media announced that Splunk, a provider of the leading software platform for real-time Operational Intelligence, has launched an ad campaign on Big Data Journal. Splunk software and cloud services enable organizations to search, monitor, analyze and visualize machine-generated big data coming from websites, applications, servers, networks, sensors and mobile devices. The ads focus on delivering ROI - how improved uptime delivered $6M in annual ROI, improving customer operations by mining large volumes of unstructured data, and how data tracking delivers uptime when it matters most.