Question

I’ve setup a Windows Azure database with the data accessible via oData. I’m trying to work out how to secure the connection between a WP7 device and the database. By secure I mean I only want users of the app to be able to access the data from within the app.

I’ve considered SSL but it’s quite expensive for me – is there another way of securing this connection?

Thanks!

Answer 1

There are multiple definitions of “secure”. You will need authentication, so Azure only lets the correct users access the data. This is usually handled by a user name and password supplied by the WP7 app.

The WP7 app needs to ensure it is talking to the correct server. SSL handles this using a digital certificate. There are other mechanisms but using something based on a public/private key pair is best because you can validate you are connecting to the correct server without being able to impersonate that server. However, the RSA algorithm used in most cases is computationally expensive.

The data sent between the WP7 app and Azure also needs to be confidential, including the user’s password. This is normally handled by encryption. You an choose computationally less expensive algorithm or only encrypt certain data.

The data sent between the WP7 app and Azure also needs some form of tamper detection. Otherwise someone could corrupt the data sent or received. Maybe this is something you can accept for the app but it needs to be a way that an attack cannot easily reproduce. As Shanin’s Maxim says, the attacker knows the system.

The problem is that SSL gives you all of these. Yes, it can be expensive but it is one of the best general purpose solutions available. You can change the cipher suites offered by Azure using using Group Policy, code or PowerShell.

If you do not want to use SSL, you need to know what you can sacrifice. In general I would not recommend doing your own encryption mechanism or protocol because us mere humans tend to screw it up.