0

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a database from a mobile device securely?

Also considering my specific case, where I have an existing WCF service which does everything I would need for the app, I would like to re-use it. I have been working on using jsonp calls to the service and develop apps for iOS, Android and windows phone. The calls are secured by HTTPS and I would be implementing some authentication policy for the calls. But how secure would all this be?

I have some really sensitive data to worry about. I am using HTML5 and JS for app development to keep it uniform and less difficult to manage for all platforms.

How do I access the database and keep my data secure?

  • 3
    I edited your question to remove references to the term "best practices." This normally results in your question being closed due to the question being too broad and answers being too subjective. I would recommend editing your question to be more specific as well, but I was not comfortable doing that and potentially changing the intent of the question in the process. – user22815 Mar 6 '14 at 16:20
  • 2
    If you are using HTML5 and JavaScript, there is no difference between mobile device and desktop or notebook. – Jan Hudec Mar 6 '14 at 20:31
5

You shouldn't be accessing any external database from a mobile device at all.

From the network's point of view, connection to a database should only be done within a local network where connection is reliable and fast, which is something you will not get with mobile connections.

From the design point of view, exposing a database directly is simply a bad idea, not only it's too lower level, also it will be a nightmare when users are using different versions of your app and trying to do different things to your database. You should provide RESTful web services with appropriate high API abstraction for your mobile app instead.

  • I want to access a webservice (WCF) in my acase which would be on the same network as the DB and I totally agree with your point. My question is are webservices a option to use? – Ron Mar 7 '14 at 1:24
  • Sure they are. What difference do you imagine between accessing the web service from a browser and a mobile application? – Barmar Mar 7 '14 at 6:02
3

It's best to not think of making your application "access a database" - your client application logic should be separated from the specifics of the database implementation. The client simply needs to make requests to a server & let the server handle the details of talking to the database for you.

If we step back a bit and ignore that the client is a mobile device, what you want is basically the standard 3-tier software architecture. That is you have a relatively 'dumb' client that communicates with a middle layer that manages the business logic & talks to the database for you. This simplifies your client & allows you to focus on placing security in the middle layer - even if your communications get compromised, a message from a client will never delete all the users if you have no "delete all users" method in your middle tier.

It sounds like you're well on your way, with WCF services to handle client/server communications. Just make sure to think of your client's requests to the server in terms of what the results should be & not the specific steps to get those results and you'll have a pretty clean system.

I don't know much about WCF but there's probably loads of articles on how to properly secure it, if the functionality isn't already built in. Just make sure that you never trust the client to do the right thing and always have your server make sure requests are valid before performing them and you should be golden.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.