Choice of suitable Identity and Access Management standards for mobile computing and communication

Nitin Naik; Paul Jenkins; David Newell

doi:10.1109/ICT.2017.7998280

Choice of suitable Identity and Access Management standards for mobile computing and communication

Nitin Naik^*, Paul Jenkins, David Newell

^*Corresponding author for this work

College of Engineering and Physical Sciences

Research output: Chapter in Book/Published conference output › Conference publication

Abstract

Enterprises have recognised the importance of personal mobile devices for business and official use. Employees and consumers have been freely accessing resources and services from their principal organisation and partners' businesses on their mobile devices, to improve the efficiency and productivity of their businesses. This mobile computing-based business model has one major challenge, that of ascertaining and linking users' identities and access rights across business partners. The parent organisation owns all the confidential information about users but the collaborative organisation has to verify users' identities and access rights to allow access to their services and resources. This challenge involves resolving how to communicate users' identities to collaborative organisations without sending their confidential information. Several generic Identity and Access Management (IAM) standards have been proposed, and three have become established standards: Security Assertion Markup Language (SAML), Open Authentication (OAuth), and OpenID Connect (OIDC). Mobile computing and communication have some specific requirements and limitations; therefore, this paper evaluates these IAM standards to ascertain suitable IAM to protect mobile computing and communication. This evaluation is based on the three types of analyses: Comparative analysis, suitability analysis and security vulnerability analysis of SAML, OAuth and OIDC.

Original language	English
Title of host publication	Proceedings of the 24th International Conference on Telecommunications
Subtitle of host publication	Intelligence in Every Form, ICT 2017
Publisher	IEEE
ISBN (Electronic)	9781538606421, 978-1-5386-0643-8
ISBN (Print)	978-1-5386-0644-5
DOIs	https://doi.org/10.1109/ICT.2017.7998280
Publication status	Published - 3 Aug 2017
Event	24th International Conference on Telecommunications, ICT 2017 - Limassol, Cyprus Duration: 3 May 2017 → 5 May 2017

Publication series

Name	Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017

Conference

Conference	24th International Conference on Telecommunications, ICT 2017
Country/Territory	Cyprus
City	Limassol
Period	3/05/17 → 5/05/17

Bibliographical note

© 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Keywords

IAM
Identity and Access Management
Mobile Computing and Communication
OAuth
OpenID Connect
SAML
SSO

Access to Document

10.1109/ICT.2017.7998280

MobileCom-IAM-DrNaik
© 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript, 1.73 MB

Cite this

Naik, N., Jenkins, P., & Newell, D. (2017). Choice of suitable Identity and Access Management standards for mobile computing and communication. In Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017 Article 7998280 (Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017). IEEE. https://doi.org/10.1109/ICT.2017.7998280

Naik, Nitin ; Jenkins, Paul ; Newell, David. / Choice of suitable Identity and Access Management standards for mobile computing and communication. Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017. IEEE, 2017. (Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017).

@inproceedings{a2774427ca584109a8016876c93e548e,

title = "Choice of suitable Identity and Access Management standards for mobile computing and communication",

abstract = "Enterprises have recognised the importance of personal mobile devices for business and official use. Employees and consumers have been freely accessing resources and services from their principal organisation and partners' businesses on their mobile devices, to improve the efficiency and productivity of their businesses. This mobile computing-based business model has one major challenge, that of ascertaining and linking users' identities and access rights across business partners. The parent organisation owns all the confidential information about users but the collaborative organisation has to verify users' identities and access rights to allow access to their services and resources. This challenge involves resolving how to communicate users' identities to collaborative organisations without sending their confidential information. Several generic Identity and Access Management (IAM) standards have been proposed, and three have become established standards: Security Assertion Markup Language (SAML), Open Authentication (OAuth), and OpenID Connect (OIDC). Mobile computing and communication have some specific requirements and limitations; therefore, this paper evaluates these IAM standards to ascertain suitable IAM to protect mobile computing and communication. This evaluation is based on the three types of analyses: Comparative analysis, suitability analysis and security vulnerability analysis of SAML, OAuth and OIDC.",

keywords = "IAM, Identity and Access Management, Mobile Computing and Communication, OAuth, OpenID Connect, SAML, SSO",

author = "Nitin Naik and Paul Jenkins and David Newell",

note = "{\textcopyright} 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.; 24th International Conference on Telecommunications, ICT 2017 ; Conference date: 03-05-2017 Through 05-05-2017",

year = "2017",

month = aug,

day = "3",

doi = "10.1109/ICT.2017.7998280",

language = "English",

isbn = "978-1-5386-0644-5",

series = "Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017",

publisher = "IEEE",

booktitle = "Proceedings of the 24th International Conference on Telecommunications",

address = "United States",

}

Naik, N, Jenkins, P & Newell, D 2017, Choice of suitable Identity and Access Management standards for mobile computing and communication. in Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017., 7998280, Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017, IEEE, 24th International Conference on Telecommunications, ICT 2017, Limassol, Cyprus, 3/05/17. https://doi.org/10.1109/ICT.2017.7998280

Choice of suitable Identity and Access Management standards for mobile computing and communication. / Naik, Nitin; Jenkins, Paul; Newell, David.
Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017. IEEE, 2017. 7998280 (Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017).

Research output: Chapter in Book/Published conference output › Conference publication

TY - GEN

T1 - Choice of suitable Identity and Access Management standards for mobile computing and communication

AU - Naik, Nitin

AU - Jenkins, Paul

AU - Newell, David

N1 - © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

PY - 2017/8/3

Y1 - 2017/8/3

N2 - Enterprises have recognised the importance of personal mobile devices for business and official use. Employees and consumers have been freely accessing resources and services from their principal organisation and partners' businesses on their mobile devices, to improve the efficiency and productivity of their businesses. This mobile computing-based business model has one major challenge, that of ascertaining and linking users' identities and access rights across business partners. The parent organisation owns all the confidential information about users but the collaborative organisation has to verify users' identities and access rights to allow access to their services and resources. This challenge involves resolving how to communicate users' identities to collaborative organisations without sending their confidential information. Several generic Identity and Access Management (IAM) standards have been proposed, and three have become established standards: Security Assertion Markup Language (SAML), Open Authentication (OAuth), and OpenID Connect (OIDC). Mobile computing and communication have some specific requirements and limitations; therefore, this paper evaluates these IAM standards to ascertain suitable IAM to protect mobile computing and communication. This evaluation is based on the three types of analyses: Comparative analysis, suitability analysis and security vulnerability analysis of SAML, OAuth and OIDC.

AB - Enterprises have recognised the importance of personal mobile devices for business and official use. Employees and consumers have been freely accessing resources and services from their principal organisation and partners' businesses on their mobile devices, to improve the efficiency and productivity of their businesses. This mobile computing-based business model has one major challenge, that of ascertaining and linking users' identities and access rights across business partners. The parent organisation owns all the confidential information about users but the collaborative organisation has to verify users' identities and access rights to allow access to their services and resources. This challenge involves resolving how to communicate users' identities to collaborative organisations without sending their confidential information. Several generic Identity and Access Management (IAM) standards have been proposed, and three have become established standards: Security Assertion Markup Language (SAML), Open Authentication (OAuth), and OpenID Connect (OIDC). Mobile computing and communication have some specific requirements and limitations; therefore, this paper evaluates these IAM standards to ascertain suitable IAM to protect mobile computing and communication. This evaluation is based on the three types of analyses: Comparative analysis, suitability analysis and security vulnerability analysis of SAML, OAuth and OIDC.

KW - IAM

KW - Identity and Access Management

KW - Mobile Computing and Communication

KW - OAuth

KW - OpenID Connect

KW - SAML

KW - SSO

UR - http://www.scopus.com/inward/record.url?scp=85028533582&partnerID=8YFLogxK

UR - https://ieeexplore.ieee.org/document/7998280

U2 - 10.1109/ICT.2017.7998280

DO - 10.1109/ICT.2017.7998280

M3 - Conference publication

AN - SCOPUS:85028533582

SN - 978-1-5386-0644-5

T3 - Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017

BT - Proceedings of the 24th International Conference on Telecommunications

PB - IEEE

T2 - 24th International Conference on Telecommunications, ICT 2017

Y2 - 3 May 2017 through 5 May 2017

ER -

Naik N, Jenkins P, Newell D. Choice of suitable Identity and Access Management standards for mobile computing and communication. In Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017. IEEE. 2017. 7998280. (Proceedings of the 24th International Conference on Telecommunications: Intelligence in Every Form, ICT 2017). doi: 10.1109/ICT.2017.7998280

Choice of suitable Identity and Access Management standards for mobile computing and communication

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this