Identity As A Service (IdAAS) & Single Sign On (SSO) Introduction

Why Do You (A Normal User) Need IdAAS  & SSO

You have 100 of logins (laptop, gmail, Munchery, Atlasssia/Jira/Confluece, Concur , Box, SFDC…).  Which means : You need to remember 100 usernames. You need to remember 100 passwords.

This is a pain - to remember 100 usernames & passwords. 

 

And can be a security breach - if you start to get lazy and only use one usernames & passwords for all 100 accounts, a breach into one account is a breach into 100 accounts. Worse yet - if you keep your usernames and passwords on the bottom of your laptop, anyone with access to your laptop can steal all of your identities!

Gave up on tracking multiple passwords? A stickynote comes in handy. :(

Wouldn't It Be Nice :

If you can use one central neutral login - to login into all 100 web apps.
Now you can - using a service called Single Sign On (SSO). And the service is provided by Identity As A Service (IAAS) vendors (such as Okta or Centrify).

How IdAAS and SSO Works:

There are three principles in a IdAAS system : 1. User (you!)  2. Identity Provider (your company, let's call it Acme)  3. Service Provider (web apps such as Salesforce, Box, Jira,...)

The User will sign into an IdAAS provider. The User can the username and password from Acme. Most of the companies will also ask you to use a multi-factor authentication (MFA) so that you will need to have your mobile phone with you to log into the IdAAS. When you log in, there is a quick check through the LDAP from the Identity Provider to authenticated you. Once you are authenticated into the IdAAS, the list of web apps that you are entitled to from the Service Provider. The communication between the IdAAS and the Service Provider is performed via Security Assertion Markup Language (SAML).

It Not Only Helps You - IT Benefits, Too:

IT can also keep its data, network, and end-points (laptops, mobile devices) secure. How? By keeping tabs on who accesses their network, apps and data with 

   1) identity - you are who you claim to be via authentication 

   2) access management tools - once we know who you are, what are you allowed to do. 

These tools allow IT to verify a user’s identity through security and authentication capabilities, including LDAP AND multi factor authentication (MFA). IT can also define data access rules (engineering should not be able to see finance data) and application access rules (finance should not need to access Jira app). 

Who Is In the IdAAS Market?

Okta, Centrify, and Microsoft examples that provide IdAAS.

Explaining A Secure Web Browser Session Through the OSI Networking Layer

(This is from my MBA Networking class project paper focusing on use case approach of looking at IT networking. I bolded key terms that should make this easier to look up terms.)

Let’s examine how the OSI 7 network layers works with a very popular internet application - the web browser! Pretend that you want to browse cnn.com on Firefox browser. You are on a laptop that we can call a client. Starting from the top of the network layer, let's see how the layers work together to provide you with a web browser application.

Using an (7) APPLICATION such as Mozilla Firefox web browser to visit the Universal Resource Locator (URL) http://www.cnn.com, where a URL is a type of Universal Resource Identifier (URI). Firefox browser knows that you are using Hypertext Transport Protocol (HTTP) because your prefaced the request with http, not other URI such as FTP (ftp://ftp.synopsys.com) or FILE (file:///yourpc). Another application example is Spotify music streaming.

To ensure a secure web browsing connection, Hypertext Transport Protocol Secure (HTTPS) is used instead of HTTP. HTTP uses Transport Layer Security (TLS) or the older Secure Socket Layer (SSL) to encrypt data between your browser and the web server. The data is encrypted by using using session keys (keys that expire after browsing is done). The encryption uses X.509 Public Key Infrastructure (PKI). Transport Layer Security (TLS) allows the client (your browser) and the server (the web server ... let's say BankOfBits) to talk to each other securely. Using X.509 Public Key Infrastructure, the client connects to the server first, and the server provides a certificate. The client checks that the server certification is authentic by checking on its own trusted roots (sources that can look at the server certificate and give the ok that it is BankOfBits). Once the client knows that the server is safe, the client creates a SESSION KEY, encrypt it using the server’s public key, then sends the encrypted session key to the server. The server will use its private key to decode the encrypted session key. The client will start sending encrypted data using the session key, which the server will decrypt with the same session key.

The (5) SESSION and (6) PRESENTATION layers are not germane to discussion.  Some of the functionality might be shifted into the APPLICATION layer (such as TLS/SSL).

The (4) TRANSPORT layer uses Transmission Control Protocol (TCP), which is a connection based protocol (as opposed to User Datagram Protocol (UDP), a connectionless protocol). TCP is responsible for taking the email data from the application and keep trying until the email is sent reliably (CRC, checksum) and in order (flow control), or not sent via the network layer. TCP keeps track of the packets sent, numbers them so that it can keep the packets in order on the receiving side, as for a packet resend if packets are dropped, checks that the packets are not corrupted (using checksum, hashing). UDP is more simple than TCP because it does not track sequence of the packets nor the corruptness of the packets. UDP is used for streaming of music or video - where dropping some packets is ok. A TCP segment consists of a TCP header and a TCP payload. A TCP header contains information such as source port, destination port, sequence number (to support connection based protocol).  Many common services deploys fixed port numbers. For example, FTP uses port 20 or 21, Secure Shell (SSH) uses port 22, telnet uses port 23, Simple Mail Transfer Protocol (SMTP) uses port 25.  New services such as Spotify (streaming music) uses port 4047, either TCP (connection) or UDP (connection-less). Port numbers will be relevant in the firewall section.

In the (3) NETWORK layer, the email server uses Internet Protocol (IP) to try to forward the email data by finding the best route to the next most available server/hop. Internet Protocol Security (IPSec) is used to encrypt data at the IP/network layer. Once the next network node (forwarding address) is known, the email data is broken down into little frames defined by the data link layer. The IP dictates how many individual devices can be addressed. IPv4 can address 32-bit of range, equating to about 4 billion addresses. That is not enough for the new age of IOT. So IPv6 was introduced, which has an address range of 128 bits. An IP Packet is comprised of a packet header and packet data. The packet header contains information such as source IP address, destination IP address, time-to-live, etc.

The (2) DATA LINK layer is serves two basic functionality : Logic Link Control (LLC) and Media Access Control (MAC). In the LLC, data is encapsulated into Ethernet Frames. Each Ethernet Frame contains a SFD, source MAC address, destination MAC address, payload, FCD, etc.   The MAC is responsible for ensuring that the frames are sent, is correct (check sum), and controls access to the media (CSMA/CD). The little frames of data is finally passed to the real world via the physical layer.

The (1) PHYSICAL layer, which can be wired (Ethernet, USB, Optical, …) or wireless (Wifi, GSM, Blutooth, …). Most of us are probably reading this over a Wifi wireless network that is adopting IEEE 802.11g/n/ac protocol.

SSD - Upgrade from AHCI to NVMe to Extract Gains From Flash

On my Macbook Air, the built in SSD flash drive uses the AHCI protocol, not the more advanced NVMe protocol that was designed for SSD flash drive. Why did Apple do this? Traditional computer systems read and write data to hard disk drives (HDD) using ATA or Advanced Host Controller Interface (AHCI) protocol. AHCI was designed for the physical behavior of a HDD - need time to spool up the platter, to find the first valid data on the platter, need time go to another place on the platter if the data is not stored contiguously on the platter.

But with the advent of solid state drives (SSD), the original ways of talking to storage using AHCI is outmoded.  That's why a new interface, designed for SSD, is needed. That is called Non Volatile Memory Express (NVMe).   It eliminates the overhead of the older protocol  - spooling up a platter, find first valid data on a platter - and  focuses on the strengths of SSD through lower latency and higher throughput.

There is also the PHYSICAL connection to consider. The traditional IDE/SATA/SATA Express physical connector interface is now replaced by PCIe.

Even with storage upgrades (HDD to SSD), other upgrades are needed as well. First, upgrade the HW interface (SATA->PCIe). Next, upgrade the SW interfaces (AHCI -> NVMe). Early Apple MacBooks had SSD drives, had PCIe interfaces, but didn't support NVMe yet.

 

In the world of high-speed storage, the conversation has shifted from hard disk drives (HDDs) versus solid-state drives (SSDs) to the protocols that govern them. When it comes to SSDs running on the PCIe interface, two acronyms dominate the discussion: NVMe and AHCI. While both serve as communication protocols between the storage device and the rest of your computer, they are far from equal. Think of it as the difference between a winding country road and a multi-lane superhighway – both get you to your destination, but one is significantly faster and more efficient.

This blog post will delve into the key differences between NVMe and AHCI, exploring why NVMe has become the undisputed champion for PCIe SSDs.

A Tale of Two Protocols: Understanding the Basics

At its core, the protocol determines how your SSD communicates with your computer's CPU. This "language" dictates the speed and efficiency of data transfer.

AHCI (Advanced Host Controller Interface) was developed in 2004, a time when HDDs with their spinning platters were the primary form of storage. It was a significant improvement over its predecessor, IDE, but its design is fundamentally rooted in the mechanics of traditional hard drives.

NVMe (Non-Volatile Memory Express), on the other hand, was designed from the ground up for flash-based storage like SSDs. Introduced in 2011, it was created to take full advantage of the low latency and high parallelism of modern solid-state technology.

The key takeaway here is the design philosophy: AHCI was built for spinning disks, while NVMe was tailor-made for the flash memory in your SSD.

The Performance Gap: Why NVMe Reigns Supreme

The architectural differences between NVMe and AHCI translate into a significant performance disparity, especially on the high-bandwidth PCIe interface. Here's a breakdown of the key areas where NVMe excels:

Command Queuing and Depth

This is arguably the most significant advantage of NVMe. Imagine a single-lane road versus a massive highway.

    AHCI: Supports only one command queue with a depth of up to 32 commands. This means it can only handle a limited number of data requests at a time, creating a bottleneck.

    NVMe: Blows AHCI out of the water with support for up to 65,536 command queues, each with a queue depth of up to 65,536 commands. This massive parallelism allows for a far greater number of simultaneous read and write operations, leading to dramatically higher IOPS (Input/Output Operations Per Second).

Latency

Latency is the delay before a transfer of data begins. Lower latency means a more responsive system.

    AHCI: Has a latency of around 6 microseconds. This is due to a more complex communication path that involves more register reads.

    NVMe: Boasts a much lower latency of approximately 2.8 microseconds. This is because it communicates more directly with the CPU, streamlining the data transfer process.

Direct Communication with the CPU

    AHCI: Data has to pass through a SATA controller before reaching the CPU, adding an extra step and increasing latency.

    NVMe: On a PCIe SSD, NVMe communicates directly with the CPU, eliminating the middleman and further reducing latency and improving efficiency.

Real-World Impact: What Does This Mean for You?

These technical advantages translate into tangible benefits for the end-user:

    Blazing Fast Speeds: NVMe SSDs can achieve read and write speeds that are multiples of their AHCI counterparts. While a SATA SSD using AHCI tops out at around 550 MB/s, a high-end NVMe SSD can easily surpass 7,000 MB/s.

    Quicker Boot Times: While both AHCI and NVMe SSDs offer a massive improvement over HDDs, NVMe can shave off a few more precious seconds from your system's startup time.

    Faster Application and Game Loading: For gamers and professionals working with large files (video editors, 3D artists, etc.), the difference is night and day. Games and applications load significantly faster, and large files are transferred in a fraction of the time.

    Improved Multitasking: The superior command queuing of NVMe makes for a much smoother experience when running multiple applications simultaneously.

Is AHCI Still Relevant for PCIe SSDs?

While NVMe is the clear winner, some older motherboards with M.2 slots might only support AHCI over PCIe. In such cases, you can still use a PCIe SSD, but you'll be leaving a significant amount of performance on the table. It's like putting a sports car engine in a family sedan – you won't be able to utilize its full potential.

The Verdict: NVMe is the Clear Choice

For anyone building a new PC or upgrading their storage, the choice is clear. If your motherboard supports it, an NVMe SSD is the way to go. The performance benefits over an AHCI-based drive are substantial and will result in a faster, more responsive, and more enjoyable computing experience. AHCI served its purpose well in the era of mechanical hard drives, but for the lightning-fast world of PCIe SSDs, NVMe is the undisputed king.Here you can see that a SW protocol can be mated with different HW protocol. For example, PCIe can support both AHCI and NVMe. On some of the Macbook Airs that I have used, the SSD is already connected to the SSD, but it is still using the older AHCI SW protocol. Apple has started to updated MacOS to support NVMe in the high end Macbooks. Hope to see this in Macbook Airs soon!

Why I Will Still Buy HDD - A Harsh Change From Microsoft OneDrive

How many of us signed up for free online cloud storage, but only to have the terms change on us years later. That's what happened with Microsoft OneDrive - we were promised 15GB of storage, but now that is being cut down to 5GB. Most of us understand the freemium pricing model, but to have the rules change on us is unfair. 

I want my storage to under my control. As a result, I went to buy a WD 4T Network Attached Storage (NAS)  to build my own private cloud storage. It supports DLNA - which means if I store movies, music, or pictures on it - I can view it on any TV or app that can receive DLNA streaming.

Conjoint Analysis - An analytic framework for deciding trade-offs between features

I did this a while back while scoping out trades offs between price versus hardware inside a tablet. Hardware features looked at are often focused on "CPU" and screen size. 

Application Processor (AP) is the CPU brains inside of a tablet. Why called application processor? Because the AP often not contains a traditional CPU, but it often also includes a separate graphics processing unit (GPU) - needed to make streaming video more smooth and makes games more realistic. There are two major AP architectures : ARM and Intel. ARM has been licensed by most AP design companies : Apple, Qualcomm (which then is sold to Samsung, Apple, ...), Samsung, Mediatek (then sold to HTC, ...), etc. Intel's Atom has been used in less brand known tablets such as Acer.  Indirectly tied to the AP is the size of the local memory (DDR). 

Screen size is the other dominate hardware feature used to make a tablet purchase decision. Some consumers look at the absolute size (diagonal measure, pixel count) as opposed to pixel density (how share the display will be). 

Here is an quick of a conjoint analysis.

S(N) denotes screen size. P(N) denotes # of processor cores and RAM. The conjoint (crossing of the S(N)xP(N)) denotes segments - and targets personas/use cases/budget.

Customers Using Old Versions of Your Software - Windows 10 Wants You To Switch By Giving a Sense of Urgency

Evernote Basic - Freemium And Change In Business Model

Evernote is a fantastic way to capture notes - typed, drawn, picture, web URL.
The notes are stored in their cloud, and I currently access it on my  Macbook Pro, iPhone, iPad, and an Android tablet.

Evernote Basic plan is a freemium plan (basic features free, upgrade will cost money).
This is all free. But for only another 27 days. I first saw this on my Macbook Pro:

An Evernote blog also talk about this (it is closed and refers readers to its forum):

Evernote forum announcing the price change and opportunities for users to vent:

What will be the ramifications of Evernote changing its Freemium business model - from supporting lots (?) of devices to now only supporting two devices?


"Thumbs Down" from dottotech.

Will users economize and find ways to work around this? For example, on the Macbook Pro, use the web version instead of the Evernote app?

Macbook Pro App (don't use this because counts as a device)

Firefox web browser on Macbook Pro (use this instead of app)

Will users be turned off and switch to an alternative such as Microsoft One?