IBM 企业移动平台初探. 刘达 IBM 应用开发商合作部

Transcription

1 IBM 企业移动平台初探 刘达 IBM 应用开发商合作部 2

2 议程 IBM 移动开发平台简介 IBM Worklight 简介 IBM Worklight 的架构分析 其他相关移动开发技术和产品 Mobile is a significant component of the evolution of computing Mobile/Wireless/Cloud Web/Desktop Client/Server Host/Mainframe Mobile is different: Transformational business models Faster lifecycles, more iterative Fragmentation drives movement to open standards

3 Mobile is an enterprise priority Growth in Internet Connected Devices Mobile and Cloud are top spending priorities for CIOs WW Media Tablets WW Notebooks WW PCs WW Smartphones Unit Volumes (Millions) E 2013E 2014E 2015E Source: Wells Fargo Securities, January 23, 2012 Fostering the People: The Shift to Engagement Apps Dramatic Growth in Mobile Devices Mobile data traffic exceeded voice in Shipments of Smartphones exceeded total PC shipments for the first time in Billion mobile connected devices are expected to be in use by IBM Global CIO Study 2 Wireless Industry News, August 26, Economist Mobile handset dominance is difficult to predict 1995 Palm 500,000 units sold in 6mts. 70% market share 2001 Nokia 40% Market share of all mobile phones 2008 RIM Fastest growing stock. 56% of smartphones, 77% 3yr CAGR (19.7% share in 10/ Apple Most valuable company in the world, 27.3% of US smartphones Android Has 43.7 of the US smartphone market 10/11

4 Mobile presents an enormous set of opportunities Business to Enterprise Business to Consumer Increase worker productivity Improved claims processing Increase revenue through sales engagements Extend existing applications to mobile workers and customers Reducing fuel, gas, or fleet maintenance costs that are relevant in particular industries Increase employee responsiveness and decision making speed Resolve internal IT issues faster Reduce personnel cost (utilizing personal owned instead of corporate issued devices) Improve customer satisfaction Deeper customer engagement and loyalty Drive increased sales through Personalized offers Customer service Competitive differentiator Improve brand perception Deeper insight into customer buying behavior for up sell and cross sell Improve in store experience with mobile concierge services Trends in Enterprise Mobility The need for business agility along with changing employee behaviors will require enterprises to mitigate operational risk associated with mobility Number and Types of Devices are Evolving Mobility is Driving the Consumerization of IT Increasing Demand for Enterprise Applications Security Requirements Becoming More Complex 1 Billion smart phones and 1.2 Billion Mobile workers by 2014 Large enterprises expect to triple their smartphone user base by % of large enterprises supporting personally-owned devices Billions of downloads from App Stores; longer term trend for app deployment 20%of mobile workers are getting business apps from app stores today 50% of organizations plan to deploy mobile apps within 12 months Threats from rogue applications and social engineering expected to double by % of all apps send device info or personal details

5 Uniqueness of Mobile Mobile Devices are Shared More Often Smartphones and tablets are multipurpose personal devices. Therefore, users share them with friends, and family more often than traditional computing devices laptops and desktops. Social norms on privacy are different when accessing filesystems vs. mobile apps Mobile Devices are Used in More Locations Smartphones and tablets are frequently used in challenging wireless situations that contrast with laptop friendly remote access centers. Laptops are used in a limited number of trusted locations Mobile Devices prioritize User Experience Smartphones and tablets place a premium on user experience and any security protocol that diminishes the experiences will not be adopted or will be circumvented. Workstation level security cannot be assumed unless they are dedicated devices Mobile Devices have multiple personas Smartphones and tablets may have multiple personas entertainment device, work tool, etc. Each persona is used in a different context. Users may want to employ a different security model for each persona without affecting another. Mobile Devices are Diverse Smartphones and tablets employ a variety of different platforms and have numerous applications aimed at pushing the boundaries of collaboration. The standard interaction paradigms used on laptops and desktops cannot be assumed. Primer on Mobile Apps Browser-based Mobile Applications Description: Web application resides on server and is accessed via the Internet using a browser. Advantages: Relatively low development costs Version management Ubiquitous channel for application delivery Disadvantages: Network latency Bandwidth consumption Limited access to device capabilities (i.e. accelerometer, GPS, camera, contacts etc.) Advancements: Tools to provide native lookand-feel Standards (i.e. HTML5) offering greater access to device capabilities, some offline support, and client side execution Techniques to mimic user experience in launching applications Native Applications Description: An application that is mainly acquired through app stores and installed on the device. Platform specific SDKs required for development. Advantages: Rich user experience Offline computing Access to device capabilities Disadvantages: Development and maintenance costs required to support multiple platforms $50k-$150k per app Version support Externally controlled delivery channels (app stores) Advancements: Development frameworks with in-built business models for monetizing applications Hybrid Applications Description: Installed application built using web technologies (i.e. JavaScript, CSS, HTML) that leverage platform specific wrappers to access to device capabilities. Advantages: Reduced development costs over native applications Can support offline computing Access to some of the device capabilities Disadvantages: Inclusion of third-party wrappers could impact performance Version support & management Advancements: Frameworks for building hybrid applications maturing Tools to provide native lookand-feel Improvements in performance

6 Evolving Mobile Landscape - Challenges Mobile Development is more expensive than traditional Web App Development: Which smartphone? Which tablet? Which form factor? ios, Android, Blackberry, Windows Phone All of the above.. Skills? Web or native apps? Java or Objective C? Or other? Maintenance? Separate software stacks for each major OS Separate applications for each major OS How do I keep software current? Security? Encryption? Authentication? Response to stolen/lost devices? Management? Can I see my apps? Can I disable them remotely? Enterprise Integration? How do I build cross-channel app? Since the Mobile field is still evolving, so an enterprise would want to pick a platform that can adapt to the future. Challenges of Enterprise Mobility Adapting to the Bring Your Own Device (BYOD) to Work Trend Device Management and Security Application management Achieving Data Separation Privacy Corporate Data protection Providing secure access to enterprise applications & data Secure connectivity Identity, Access and Authorization Developing Secure Mobile Apps Vulnerability testing Designing an Adaptive Security Posture Policy Management Security Intelligence

7 Driving Key Set of Mobile Security Requirements Mobile devices are not only computing platforms but also communication devices, hence mobile security is multi-faceted, driven by customers operational priorities Mobile Security Intelligence Mobile Device Management Data, Network and Access Security App/Test Development Mobile Device Management Acquire/Deploy Register Activation Content Mgmt Manage/Monitor Self Service Reporting Retire De-provision Mobile Device Security Management Device wipe and lockdown Password Management Configuration Policy Compliance Mobile Threat Management Anti-malware Anti-spyware Anti-spam Firewall/IPS Web filtering Web Reputation Mobile Information Protection Data encryption (device, file and app) Mobile data loss prevention Mobile Network Protection Secure Communications (VPN) Edge Protection Mobile Identity and Access Management Identity Management Authorize & Authenticate Certificate Management Multi-factor Secure Mobile Application Development Vulnerability testing Mobile app testing Enforced by tools Enterprise policies Mobile Applications i.e. Native, Hybrid, Web Application Mobile Application Platforms and Containers Device Platforms 30 device Manufacturers, 10 operating platforms i.e. ios, Android, Windows Mobile, Symbian, etc. IBM Mobile Enterprise: A Platform For Mobile Initiatives Banking Insurance Healthcare Telecom Retail Government Others IBM Enterprise Mobile Platform Business Results Extending business to mobile customers and workforce Improve operational efficiencies and reduce costs Differentiate the customer experience Enable new services and business models Workforce Optimization Product and Service Innovation Customer Care and Insights 3 rd Party Mobility Services Social Collaboration User Notification Location Services Mobile Payments Social Mobile Commerce Build mobile applications Connect to, and run backend systems in support of mobile Manage mobile devices and applications Secure my mobile business Extend existing business capabilities to mobile devices Transform the business by creating new opportunities

8 Terminologies Mobile Enterprise Application Platform (MEAP) Address the difficulties for developing mobile software by managing of the diversity of devices, networks and user groups at the time of deployment and throughout the mobile solution lifecycle. Comprises of : Mobile middleware server handles all system integration, security, communications, scalability, cross-platform support etc Mobile client app runs on the device and connect to the middleware server. Mobile Device Management (MDM) To secure, monitor, manage and support mobile devices deployed across enterprises. Generally for B2E (business to employee devices) Functionalities typically includes over-the-air distribution of applications, data and configuration.

9 The IBM Mobile Platform (i.e., what you need to build and effectively incorporate mobile apps with your business) Security Gateway Rational Lifecycle Tivoli Security Worklight Mobile Platform IBM Mobile Platform Mobile Device Management Elastic Caching SOA & Connectivity Analytics Decision Management Enterprise Apps Business Process Management Connectivity MQTT, Broker, CastIron 议程 IBM 移动开发平台简介 IBM Worklight 简介 IBM Worklight 的架构分析 其他相关移动开发技术和产品

10 Worklight At a Glance Apps Development Build once. Run anywhere. Android, ios, Blackberry, Microsoft, igoogle, Facebook app, Adobe AIR Runtime Skins for different resolutions Standards based language Application Lifecycle Management Centralized Build Process Security Secured offline access On device encryption of user data Single sign-on mechanism SSL encryption Protection against reverse engineering vulnerabilities Multi-factor authentication Enterprise Integration Direct access to back-end systems Leverage existing SOA services Server-side caching Application Management App distribution App Version management Remote disabling apps Direct Update Push Notification service management Analytics and Usage report Middleware WebSphere Application Server Reliable, Highly Available and Scalable Worklight Overview Built on Eclipse and Integrate with RAD Worklight Studio The most complete, extensible development environment with maximum code reuse and per-device optimization Runs on WAS 7 Worklight Server Mobile middleware offering unified push notifications, version management, security and integration Runs on devices Worklight Runtime Components Extensive libraries and client APIs that expose and interface with native device functionality and the Worklight Server Integrated with WAS Admin Console Worklight Console A web-based console for real-time analytics and control of your mobile apps and infrastructure

11

12 议程 IBM 移动开发平台简介 IBM Worklight 简介 IBM Worklight 的架构分析 其他相关移动开发技术和产品 Apps Development with Worklight Studio Eclipse-based IDE Integrate with Rational Application Developer Combining native and standard web technologies in one multiplatform app Environment-specific optimization 3rd-party libraries integration Device SDK integration Back-end connectivity utilities

13 Supported Application Types Supports a variety of application types Mobile iphone ipad Android BlackBerry Windows Phone Mobile web app Desktop Windows 7 and Vista Adobe AIR Mac OS Dashboard Web Applications Facebook igoogle Embedded web page Worklight Mobile Application Types Web Apps Hybrid Apps - Web Hybrid Apps - Mixed Native Apps Written in HTML5 JavaScript and CSS3. Quick and cheap to develop, but less powerful than native. Source code consists of web code and included Worklight libraries and executed in a native shell. User augments web code with native language for unique needs and maximized user experience. Platform-specific. Requires unique expertise, pricey and long to develop. Can deliver higher user experience. Mobile Browser Worklight Runtime Worklight Runtime Native Application Web Code <!DOCTYPE html PUBLIC <html> <! - - created <head><title>xyz</title> </head> <body> </p> </body> </html> Web Code <!DOCTYPE html PUBLIC <html> <! - - created <head><title>xyz</title </head> </body> </html> <!DOCTY PE html PUBLIC created </p> </body> </html> Web Native Device APIs Device APIs Device APIs

14 Mobile Application Types Comparation What are Hybrid Apps? Install as Native Apps For example: For ios, it will have an IPA file extension For Android, it will have an APK file extension Can be uploaded to Apple AppStore and Android Market Worklight Runtime Component is deployed with the app which can interpret HTML5 code. Full access to device features (such as camera, GPS etc) Code in web language, run as native app Worklight Runtime Component Web Code <!DOCTYPE html PUBLIC <html> <! - - created <head><title>xyz</title </head> </body> </html> Device APIs Deployed Native App

15 Single Shared Codebase Common code placed in primary file Environment optimization code is maintained separately Incorporated Device SDKs Android and Blackberry SDK

16 Incorporated Device SDKs ios SDK Integrating Best-in-class Tools Worklight is compatible with prominent HTML5 libraries and tools: 32

17 Worklight Client Architecture

18

19 Runtime Skinning Use Cases Different Screen Sizes Different Screen Densities Different Input Method Support for HTML5 Example Mobile Skin on Android

20 Example Mobile Skin on ipad Build and Deploy Build all and Deploy Create the vendor project Deploy server portion of the app to Worklight server

21 Centralized Build Integration with Rational Team Concert Worklight Build System Mobile Development Lifecycle Management Individual Developer Workstation Rational Application Developer Rational Team Concert Server Native Mobile Toolkits & Emulators RTC Repository Central Team Server Rational Team Concert Team Build Engine Shared Build Server Builder Rational Application Developer Web & Mobile Tools Rational Team Concert Eclipse Client Worklight Studio Eclipse Client RIM SDK Android SDK ios SDK

22 Worklight Server Distribution of mobile web apps Enterprise connectivity: Secure client/server connectivity Direct access to enterprise back-end data and transaction capabilities Authentication enforcement Client control: Application version management and remote disabling Direct update of application code Unified Push Notifications Aggregation of usage statistics 43 Direct Update On-device Logic App Store 1 Download Worklight Runtime 2 Transfer Pre-packaged resources 1.Web resources packaged with app to ensure initial offline availability 2.Web resources transferred to app's cache storage Worklight Server 4 3 Check for updates Web resources Update web resource Cached resources 3.App checks for updates On startup On foreground 4.Updated web resources downloaded when necessary 44

23 Back-end Integration Secure back-end integration XML-based declarative specification (JSON) Multi-source data mashups Eclipse plug-in supporting autocomplete and validation Simplified adapter testing Server-side debugging (soon) Web services and JDBC integration Access to session data and user properties Server side Caching Leverage existing SOA services and ESB 45 Push Notification Receiving Notification on the Device 46

24 Unified Push Notifications Device Runtime Components Framework for server integration: Secure server connectivity Authentication Remote disable & notification Push registration Dynamic page loading & caching (soon) Event reporting for analytics & audit Cross-platform compatibility layer Runtime Skinning Secure encrypted storage 48

25 Securing Mobile Apps Protecting data on the device Secure Encrypted Offline challenge- offline authentication response on cache startup Jailbreak App and authenticity malware testing detection Enforcing Security Updates Remote Direct disable update Streamline Corporate Security Process Shell as organization al sandbox Robust Authentication and Authorization Application Security Authenticatio n integration framework Data protection realms Using device id as 2 nd factor Proven platform security SSL with server identity verification Code obfuscation 49 Mechanism Benefits Details Encrypted offline cache SSL identity verification for AJAX Client code attestation Remote code updates Remote disable of specific versions Authentication process framework Server-side safeguards Device identification Mobile Security Measures Protect against stealing sensitive information via malware, stolen devices Protect against man-in-themiddle attacks Prevent impersonation by phishing apps Protect apps from manipulation by malware Ensure timely propagation of critical security updates to entire install base Ensure timely propagation of critical security updates to entire install base Lower the cost and complexity of robust integration with the authentication infrastructure Prevention of SQL injection XSRF protection Prevent account-hijacking Uses AES256 and PCKS #5 for on-device encrypted storage of appgenerated information, with random server-generated numbers for high security Allows user authentication when server is offline Implemented in JS (highly obfuscated) with optional native performance enhancements Client-side AJAX framework automatically verifies Worklight-server credentials Challenge-response based mechanism for proving client-application identity Uses tamper-resistant self-inspecting code New versions of the code can be distributed without requiring update of the app (currently JS/HTML) Server-side console allows configuration of allowed app versions. Administrator can force users to install security updates to the native code Server-side architecture for integration with back-end authentication infrastructure based on JAAS, with Authentication realms Client-side framework for asynchronous login requests on session expiration Prepared-statement enforcement Validation of submitted data against session cookie Safely report device ID to the server Identifying a user with specific devices

26 Mechanism Benefits Details Enterprise SSO integration VPN alternative Mobile Security Measures Leverage existing enterprise authentication facilities and user credentials Enable employeeowned devices Enable the secure delivery and operation of mobile applications for employee owned devices or device types not allowed on the corporate network Enable the secure delivery in cases where the installation of VPN client on mobile devices is not possible or complicated to manage Client side mechanism obtains and encrypts user credentials, sends to the server with requests Encryption incorporates user-supplied PIN, Server side secret and deviceid Credentials cannot be retrieved from lost or stolen device Client side and server side framework act as SSL based VPN Network access control and policies pre-configured in the client side framework layer Network access and security measures updated using server side framework On device encrypted storage to prevent compromise of sensitive data Worklight Console Application Version Management Push management Usage reports and analytics Reports of custom application events Configurable audit log Administrative dashboards for: Deployed applications Installed adapters Push notifications Data export to BI enterprise systems

27 Dynamic Control of Deployed Apps Centralized control of all installed applications and adapters Remotely disable apps by device and version Customize user messages Push Services Management

28 Advanced Reporting Functionality