A little known but important standard is close to approval, and could improve trust and security in mobile cloud services.
The internet standards body, the IETF (Internet Engineering Task Force), is expected to approve OAuth 2.0 this week. This will provide a common framework to secure native mobile applications and API calls, especially when these are communicating in the cloud. It will achieve this with a set of secure identify access tokens.
According to ZDnet’s Identity Matters blog, the OAuth 2.0 Authorization Framework working group says all outstanding questions on the specifications have now been answered after a three-month review period. Now it just remains for the spec to be approved by the IETF’s security area director, Stephen Farrell, who is expected to send it by the end of this week to the RFC Editor Queue. That signals the standard is ready for publication and Farrell has already indicated that OAuth 2.0 has ‘enough positions to pass’.
The working group has also submitted a second spec for a particular type of security token for use with the framework, called ‘bearer token usage’. The next IETF meeting is slated for July 29, and final approval could be forthcoming then.
OAuth 2.0 provides authentication and authorization for many different types of clients, allowing them to access so-called RESTful APIs securely. REST (Representational State Transfer) is a web service architecture which has become dominant in modern web and cloud services because of its relative simplicity. As more and more types of mobile devices communicate with it, security will become a critical issue to which OAuth 2.0 could make an important contribution.
In particular, it will help to secure mobile computing by supporting single sign-on for native mobile apps. Users employ access tokens produced by the authorization server instead of having usernames and passwords.
OAuth 2.0 will also be the basis of other proposed identity standards such as OpenID Connect, the work of the OpenID Foundation, which adds more authentication capabilities on top of the OAuth framework. Then there is User Managed Access, an OAuth-based protocol which enables tight access controls over personal or sensitive data stored in social or other sharing sites ‘ potentially critical as concerns over user privacy escalate.