How do I access databases from a mobile device securely?

Question

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a database from a mobile device securely?

Also considering my specific case, where I have an existing WCF service which does everything I would need for the app, I would like to re-use it. I have been working on using jsonp calls to the service and develop apps for iOS, Android and windows phone. The calls are secured by HTTPS and I would be implementing some authentication policy for the calls. But how secure would all this be?

I have some really sensitive data to worry about. I am using HTML5 and JS for app development to keep it uniform and less difficult to manage for all platforms.

How do I access the database and keep my data secure?

Answer 1

You shouldn't be accessing any external database from a mobile device at all.

From the network's point of view, connection to a database should only be done within a local network where connection is reliable and fast, which is something you will not get with mobile connections.

From the design point of view, exposing a database directly is simply a bad idea, not only it's too lower level, also it will be a nightmare when users are using different versions of your app and trying to do different things to your database. You should provide RESTful web services with appropriate high API abstraction for your mobile app instead.

Answer 2

It's best to not think of making your application "access a database" - your client application logic should be separated from the specifics of the database implementation. The client simply needs to make requests to a server & let the server handle the details of talking to the database for you.

If we step back a bit and ignore that the client is a mobile device, what you want is basically the standard 3-tier software architecture. That is you have a relatively 'dumb' client that communicates with a middle layer that manages the business logic & talks to the database for you. This simplifies your client & allows you to focus on placing security in the middle layer - even if your communications get compromised, a message from a client will never delete all the users if you have no "delete all users" method in your middle tier.

It sounds like you're well on your way, with WCF services to handle client/server communications. Just make sure to think of your client's requests to the server in terms of what the results should be & not the specific steps to get those results and you'll have a pretty clean system.

I don't know much about WCF but there's probably loads of articles on how to properly secure it, if the functionality isn't already built in. Just make sure that you never trust the client to do the right thing and always have your server make sure requests are valid before performing them and you should be golden.