将数据从Android发送到Azure云的安全性如何？

Question

I am wondering if the channel used to transmit data to be sent to the Azure Cloud Mobile service is secured. Using the below code as reference..

table.execute(new TableQueryCallback<tableEntity>() {
        public void onCompleted(List<tableEntity> result, int count,
            Exception exception, ServiceFilterResponse response) {
            if (exception == null) {
                for (tableEntity tableItem: result) {
                    //Some algorithm here
                }
            }
        }
    });

The code executes and attempts to retrieve data from Azure, and I am not sure how secure this process is. Reading the documentations on Azure site, it did not provide the answer that I am looking for..

Reference I have read:

azure.microsoft.com/en-us/documentation/articles/mobile-services-android-how-to-use-client-library/

azure.microsoft.com/en-us/services/mobile-services/

azure.microsoft.com/en-us/documentation/articles/mobile-services-android-get-started/

azure.microsoft.com/en-us/documentation/articles/mobile-services-android-get-started-data/

What I am looking for is how the process of sending/retrieving data to and from Azure works, am I needed to encrypt the data channel? Any guide will be appreciated! Thanks!

Answer 1

Azure Mobile Services is a REST service hosted in the cloud. The client code is making HTTP calls to the REST API behind-the-scenes. So all encryption is done via HTTPS/SSL.

You can find REST API details here: http://msdn.microsoft.com/en-us/library/azure/jj710108.aspx

If you wanted to, you could test your service by using PostMan/curl/Fiddler or any other HTTP client.

The AppKey is sent in the X-ZUMO-APPLICATION HTTP header along with your other requests and acts as a very simple authentication method and is used when you've set up your API/Table endpoint with 'Application Key' permissions.

Permission details here: http://msdn.microsoft.com/en-us/library/azure/jj193161.aspx

Answer 2

I can't find a reliable source for this, but I'm under the impression that the AppKey is used to encrypt the data connection between the client and mobile service.

// Create the Mobile Service Client instance, using the provided
// Mobile Service URL and key
mClient = new MobileServiceClient(
        "MobileServiceUrl",
        "AppKey", 
        this).withFilter(new ProgressFilter());

And of course you can set your table permissions to restrict access to any sensitive data. Obviously this is not enough if you are working with something that you seriously need to encrypt and keep safe.