Cloud-Native Identity and Access Management for Enterprise Platforms

Abstract

Cloud-native enterprise architectures have broken out the network perimeter, and now identity has become the front line of defense in the world of security. This review covers the current landscape of cloud-native enterprise identity and access management (IAM) solutions and how the industry has moved beyond a static approach to identity management and perimeter-based security, and is now shifting to dynamic, continually verified access control. A collection of essential research is synthesized covering access-control theory, federated authentication, security of containers and microservices, identity of the service, zero-trust concepts and machine-identity governance. On the basis of this synthesis, we argue that a four-plane theoretical model can be introduced to separate authentication, authorization reasoning, enforcement, and auditability into four closely coupled but independent evolving planes for the system. An illustrative evaluation, gleaned from published benchmarks, illustrates the expected behaviour of this model over 3 dimensions: authorization latency, enforcement overhead and scalability in the face of growth in identities. The results show that the model is viable for realistic enterprise workloads when optimizing policy evaluation and accounting for the overhead of policy enforcement, and provide limits for deployments using latency sensitive and throughput bounded workloads. Finally, the review highlights open challenges and directions for future research, providing a unified point of reference for both researchers and practitioners in the field of secure and scalable identity management in today's enterprise world.