Visible to the public Choice of suitable Identity and Access Management standards for mobile computing and communication

TitleChoice of suitable Identity and Access Management standards for mobile computing and communication
Publication TypeConference Paper
Year of Publication2017
AuthorsNaik, N., Jenkins, P., Newell, D.
Conference Name2017 24th International Conference on Telecommunications (ICT)
Date Publishedmay
Keywordsauthentication, Authorization, Human Behavior, IAM, Identity and Access Management, identity and access management standards, Identity management, Mobile communication, mobile computing, Mobile Computing and Communication, mobile computing-based business model, oAuth, OIDC, open authentication, openid connect, pubcrawl, Resiliency, SAML, Scalability, security assertion markup language, SSO, XML
AbstractEnterprises have recognised the importance of personal mobile devices for business and official use. Employees and consumers have been freely accessing resources and services from their principal organisation and partners' businesses on their mobile devices, to improve the efficiency and productivity of their businesses. This mobile computing-based business model has one major challenge, that of ascertaining and linking users' identities and access rights across business partners. The parent organisation owns all the confidential information about users but the collaborative organisation has to verify users' identities and access rights to allow access to their services and resources. This challenge involves resolving how to communicate users' identities to collaborative organisations without sending their confidential information. Several generic Identity and Access Management (IAM) standards have been proposed, and three have become established standards: Security Assertion Markup Language (SAML), Open Authentication (OAuth), and OpenID Connect (OIDC). Mobile computing and communication have some specific requirements and limitations; therefore, this paper evaluates these IAM standards to ascertain suitable IAM to protect mobile computing and communication. This evaluation is based on the three types of analyses: comparative analysis, suitability analysis and security vulnerability analysis of SAML, OAuth and OIDC.
DOI10.1109/ICT.2017.7998280
Citation Keynaik_choice_2017