THE MOBILE HELIX SECURE DELIVERY PLATFORM

Transcription

1 SECURE ENTERPRISE HTML5 THE MOBILE HELIX SECURE DELIVERY PLATFORM A MOBILE HELIX WHITEPAPER

2 THE MOBILE HELIX SECURE DELIVERY PLATFORM This whitepaper describes the way the Mobile Helix solution delivers apps and data to end-users/employees. The paper describes the components of the Mobile Helix Link system. It then describes the flow and process of delivery. The Mobile Helix solution provides strong end-to-end security, a zero deployment model for pure HTML5 apps and fast delivery of Web pages to improve mobile users' experience. With Mobile Helix Link, the enterprise is able to extend the intranet infrastructure to mobile endpoints while simultaneously leveraging existing investments in the enterprise Web and addressing the unique security and performance challenges of mobility. Link System Overview The Mobile Helix Link system consists of four components: The Link Gateway, which is a reverse proxy that is the central entry point to the enterprise network. The Gateway controls and optimizes traffic between the external, public Internet and the private, corporate Intranet. The Gateway is deployed in the DMZ in an on-premises deployment, and a large-scale deployment will have many gateways for redundancy and load balancing. The Link Controller is the system management console. The Controller manages all users, all devices, and all apps available on a mobile device via the Link system. The Controller integrates with Active Directory (AD) or LDAP to import users and groups, and the Controller manages authentication via AD, LDAP, or any SAML-based single sign-on solution. The Controller uses a role-based security and policy architecture to enable IT administrators to set flexible device, applications, and data policies from a central console. The Controller also monitors the Link system and collects audit data and analytics in a central database. 1

3 The Link Application Server hosts Mobile Helix's pure HTML5 apps. Each app is built using the Link HTML5 SDK and is hosted in a standard Java EE container. Examples of Link apps include Link Content Share and Link . Enterprises can host their own HTML5 apps built with or without the Link HTML5 SDK and legacy Web applications available for mobile access using existing Web server, application server, or portal infrastructure. The Link Application Servers are firewall protected and integrate with standard HTTPS load balancers. The Link Container runs on mobile devices and ensures secure access to corporate assets by encrypting data at rest and in motion. The Container includes browser technology supporting critical HTML5 features including offline storage and video. In addition, the Container is enhanced with Apache Cordova (formerly PhoneGap) to enable browser access to device features that are not available across platforms via the HTML5 standard. THE MOBILE HELIX LINK SYSTEM CONSISTS OF 4 COMPONENTS: 1. Link Gateway 2. Link Controller 3. Link Application Server 4. Link Container Link may be deployed fully on-premises or in a hybrid deployment with selected components in the cloud. In a cloud deployment, the Link cloud can either integrate with existing VPN infrastructure to access the corporate network or it can use a relay architecture to transmit encrypted data via a persistent, outbound connection from the corporate network to the cloud for routing to the mobile device. Mobile Helix Technology Architecture Overview The Mobile Helix technology architecture shown above outlines how different technology platforms, implemented across the Link system components described in the previous section, work together to enable the development and delivery of pure HTML5 apps, to protect corporate data, and to apply policies to the Link system. The Mobile Helix technology architecture includes: The Link HTML5 SDK, which is a fully standards-compliant HTML5 SDK for creating rich mobile apps that are intuitive, cross platform, and, when integrated with the Link system, transparently secured., which ensures end-to-end secure delivery of pure HTML5 1 mobile apps, enterprise Web applications, and enterprise content and data. 1 Pure HTML5 apps are fully standards-compliant HTML5/CSS3/JavaScript apps delivered by standard Web servers, app servers, or portal servers via HTTPS. Pure HTML5 means 100% open, standards-based, and cross-platform mobile app development integrated transparently into a secured, containerized browser that operates across all of the major mobile platforms. 2

4 The Mobile Helix Data Security Platform, which ensures that data is uniformly protected at rest on all supported devices and enables granular policy and rolebased control of enterprise data stored on mobile devices. The Mobile Helix Administration Platform, which enables IT to manage and provision users and endpoints accessing the Link system, track and audit data delivered to mobile devices, provision pure HTML5 mobile apps and enterprise Web applications for mobile access, and monitor the Link system. Figure 1: The Mobile Helix Technology Architecture This paper describes one of the unique capabilities of the Mobile Helix technology platform, the Mobile Helix Secure Delivery Platform, which enables Link to deliver data and applications securely to mobile endpoints. Mobile Helix Secure Delivery Platform The Mobile Helix Link solution delivers pure HTML5 apps and existing enterprise Web apps to mobile devices securely and seamlessly. There are five components of the Mobile Helix Secure Delivery Platform: 1. Provisioning of applications 2. End-to-end secure delivery 3. Optimized delivery of Web pages and data 4. SSO integration to extend the enterprise identity infrastructure 5. App-store-free app deployment 3

5 Figure 2: Provisioning of Applications The administrator provisions mobile pure HTML5 apps and standard Web applications using the Link controller. Profiles are created in the Controller to select which users have access to which applications, and policies are attached to user roles and application profiles to determine the application s off-line data storage behavior. Profiles are also used to manage per app authorization or to provide more granularity to existing LDAP/Active Directory based profiles. Using role based access control, IT administrators can restrict access to sensitive data and applications to a limited set of users. When users login to Link, they see only the applications they have been provisioned to use. End- to-end Secure Delivery Link provides end-to-end secure delivery of provisioned apps from the enterprise network to the device without the need for VPN. Link's security architecture is designed to protect data and applications from the most present threats of compromise. To protect the enterprise network, all communications to the corporate network are routed through the Link Gateway, which acts as a reverse proxy to securely serve provisioned enterprise Web apps to the endpoints. The Link Gateway resides in the DMZ and can be integrated with existing HTTPS load balancers. All communications between the endpoint and the Gateway are encrypted via SSL and delivered via HTTPS. The Gateway ensures that only authorized users running the Link Container on authorized endpoints are permitted access to corporate resources. On the endpoint, all apps reside inside of the Link Container to ensure that application code and data are encrypted at rest. Optimized Delivery of Web Pages The Gateway optimizes Web requests via several methods. First, all traffic is compressed. Second, protocol-level redirects are transparently handled in the Gateway to avoid round-trips to and from the device. Third, returned Web pages are scanned to 4

6 identify and preload required resources, which minimizes reduce the number of roundtrips required for a single page load. The Gateway also maintains a symmetric cache of data signatures that are cached locally on the device, and data is de-duplicated using these signatures before it is sent to the device. The secure Web browser renders the returned page on the device and caches returned data locally according to the data storage policy defined in the Controller. For more detail on the Mobile Helix Data Security Platform read the paper entitled Mobile Helix Data Security. SSO Integration to Extend the Enterprise Identity Infrastructure Link integrates with existing SSO systems either based on Windows Integrated Authentication (using Kerberos or NTLMv2) or SAMLv2. SSO allows users to navigate to different apps without having to authenticate again, and it extends the enterprise identity infrastructure to the mobile device, including existing password strength and expiration policies. SSO also addresses a key usability challenge of a multi-app environment typing a complex password on a mobile device is difficult, error prone, and frustrating. With Link, users only enter their passwords once to initiate a session. When users login to the Link Container, they are asked to provide their enterprise credentials. Their encrypted credentials are sent to the Link controller over SSL to authenticate. Typically, the Controller forwards the information to an enterprise authentication system (Active Directory, LDAP, Kerberos or a SAML IDP). Upon successful authentication, the Controller retrieves the applications that the user is provisioned for (based on user profile) and the Link Container displays an icon for each application in the main workspace on the device. Geographic Routing When users authenticate with the Link Controller, the authentication request includes the current location of the device (obtained via GPS). The Controller will determine which deployed and running Gateway is geographically closest to the authenticating device and, based on the shortest distance, assign the device to a Gateway. Geographic routing significantly reduces network latency and improves the user experience for companies with mobile workers all over the world. App-Store-Free Delivery One of the main benefits of the Secure Delivery Platform is app-store-free delivery. Native apps for ios or Android require an external delivery system (an on-premises or inthe-cloud enterprise app store) and generate costly version management and data transmission overheads. Every time a new version of the native app is delivered either to fix security issues or to add more features, the administrator has to ensure that all users download the latest native app, or IT must support multiple legacy versions of a native app. Version management for native apps is ultimately no easier than version 5

7 management for Windows desktop applications, and much like the desktop world, IT has to build an infrastructure and workflow for supporting upgrades including app inventory, monitoring, management, authorization, etc. In addition to the process and infrastructure challenges of managing native apps, the native enterprise app store mechanism does not scale without significant investment in the supporting network infrastructure. The bandwidth required to deliver native apps can become a load on the enterprise network and consumes costly bandwidth on the cellular network. Frequent notifications to upgrade can annoy users, as can the rising costs in their data plans. As the number of apps increases, the number of users increases, and the update frequency increases, the cost of such a delivery system can quickly become a burden for IT and end users. By contrast, the Mobile Helix Secure Delivery Platform requires zero deployment, as the app store is the Link Container itself and the delivery relies on standard Web infrastructure. Benefits of the Secure Delivery Platform include: Delivery is secured by Link's end-to-end security in transit and on device IT can be assured that users are running the latest versions of each app and any security patches or other fixes are instantly deployed to the entire user base Apps update transparently freeing users from the installation overhead and cost of new app versions The delivery infrastructure scales with the enterprise Web infrastructure, including existing HTTPS load balancers and other Web scalability infrastructure With the Mobile Helix Secure Delivery Platform, the delivery of apps becomes entirely the responsibility of the IT department rather than a recurring burden on end users. Conclusion provides strong end-to-end security, appstore-free deployment of pure HTML5 apps, and fast delivery of Web pages to improve mobile users' experience. With Mobile Helix Link, the enterprise is able to extend the intranet infrastructure to mobile endpoints while simultaneously leveraging existing investments in the enterprise Web and addressing the unique challenges of mobility. With Link and the Mobile Helix Secure Deliver Platform, mobility is simple and seamless. 6

8 About Mobile Helix Link Mobile Helix is an enterprise application and data security platform provider focused on enabling unrestricted enterprise productivity. We are redefining endpoint computing by evolving and extending existing IT infrastructure and standards rather than reinventing them. At our core are three fundamental principles that are at the center of everything that we do: 1) we are applicationand data-centric we embrace the blurring lines between phones, tablets and laptops, permitting IT to relinquish control of the endpoint device entirely and embrace a bring-your-own-anything policy; 2) we provide unmatched yet unobtrusive security for sensitive corporate data by intelligently securing the data rather than the devices; and 3) simplicity is embedded into the DNA of our products, our designs and our communications. Our solution, Mobile Helix Link, is the industry s first pure HTML5 platform that combines unparalleled data security, a unique HTML5 application development and delivery platform, and breakthrough patent-pending performance enhancement technology. To learn more about Mobile Helix Link please visit us at. MOBILE HELIX INC. Mobile Helix Inc Avenue of the Americas, 9th Floor New York, NY USA phone contact@mobilehelix.com