如何保护从 Web 角色到 SQL Azure 的连接？
我们正在尝试按照 Microsoft Azure 安全最佳实践中的建议来实现 Gatekeeper 设计模式，但我在确定如何实现时遇到了一些困难。
为了提供该项目的一些背景信息，我们将使用传统的分层方法（演示、业务、数据等）开发一个已经开发的网站，并将其转换为使用 Azure。客户希望围绕此流程构建一些额外的安全性，因为它现在将位于云中。
处理此问题的最初建议是使用队列并让辅助角色处理输入到队列中的请求。我们遇到的一些问题是如何正确序列化对象，包括我们需要在该对象上运行哪些方法以及这种方法固有的延迟。
我们还考虑过在辅助角色中设置一些 WCF 服务，但我在思考如何准确处理此问题时遇到了一些困难。 （除了这是我的第一个 Azure 项目之外，这也是我第一次尝试 WCF。）我们在这里遇到了与对象序列化相同的问题。
另一个想法是在另一个 Web 角色中设置一些 Web 服务，但这似乎会带来相同的安全问题，因为我们无法对请求执行基于 IP 的安全性。
我搜索了又搜索，但还没有真正找到任何可以实现我们想要做的事情的示例（或者我没有意识到它们这样做）。任何人都可以提供一些代码示例指导吗？谢谢。
We're trying to implement the Gatekeeper Design pattern as recommended in Microsoft Security Best Practices for Azure, but I;m having some trouble determining how to do that.
To give some background on the project, we're taking an already developed website using the traditional layered approach (presentation, business, data, etc.) and converting it over to use Azure. The client would like some added security built around this process since it will now be in the cloud.
The initial suggestion to handle this was to use Queues and have worker roles process requests entered into the queue. Some of the concerns we've come across are how to properly serialize the objects and include what methods we need run on that object as well as the latency inherent in such an approach.
We've also looked setting up some WCF services in the Worker Role, but I'm having a little trouble wrapping my head around how exactly to handle this. (In addition to this being my first Azure project, this would also be my first attempt at WCF.) We'd run into the same issue with object serialization here.
Another thought was to set up some web services in another web role, but that seems to open the same security issue since we won't be able to perform IP-based security on the request.
I've searched and searched but haven't really found any samples that do what we're trying to do (or I didn't recognize them as doing so). Can anyone provide some guidance with code samples? Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
请不要以错误的方式理解这一点，但听起来您面临着基于“客户希望增加安全性”的“要求”过度设计解决方案的危险。 开发 Windows Azure 应用程序的安全最佳实践文档是一把非常大的枪，您应该只向大目标开火，即，您实际上需要强化应用程序来存储高度敏感数据的场景。构建这样的东西可能会花费大量的时间和精力。性能，因此请确保您权衡专业级和专业级的性能。彻底骗了。
您是否考虑过利用 SQL Azure 防火墙 作为附加（并且可能可以接受）安全措施？您可以指定 IP 地址级别的访问权限，甚至可以通过存储过程以编程方式配置它。您可以阻止对数据库的所有外部访问，使您的 Azure 应用程序（Web/辅助角色）成为唯一允许访问的“客户端”。
Please do not take this the wrong way, but it sounds like you are in danger of over-engineering a solution based on the "requirement" that 'the client would like some added security'. The gatekeeper pattern that is described on page 13 of the Security Best Practices For Developing Windows Azure Applications document is a very big gun which you should only fire at large targets, i.e., scenarios where you actually need hardened applications storing highly sensitive data. Building something like this will potentially cost a lot of time & performance, so make sure you weigh pro's & con's thoroughly.
Have you considered leveraging SQL Azure firewall as an additional (and possibly acceptable) security measure? You can specify access on an IP address level and even configure it programmatically through stored procedures. You can block all external access to your database, making your Azure application (web/worker roles) the only "client" that is allowed to gain access.
为了具体回答您的问题之一，您可以使用 X.509 证书来保护对 WCF 服务的访问并实现消息安全；如果您还需要 SSL 连接来保护传输中的数据，则需要同时使用消息安全和传输安全。这不是地球上最简单的事情，但它是可能的。您可以设置为只有具有正确证书的服务器才能发出 WCF 请求。查看此线程以获取更多详细信息和更多提示：http://social.msdn.microsoft.com/Forums/en-US/windowsazuresecurity/thread/1f77046b-82a1-48c4-bb0d-23993027932a
此外，WCF 还可以轻松只要将对象标记为可序列化即可交换对象。因此，进行 WCF 调用将极大地简化您与客户端来回交换对象的方式。
To answer one of your questions specifically, you can secure access to a WCF service using X.509 certificates and implement message security; if you also need an SSL connection to protect data in transit you would need to use both message and transport security. It's not the simplest thing on earth, but it's possible. You can make it so only the servers that have the correct certificate can make the WCF request. Take a look at this thread for more details and a few more pointers: http://social.msdn.microsoft.com/Forums/en-US/windowsazuresecurity/thread/1f77046b-82a1-48c4-bb0d-23993027932a
Also, WCF makes it easy to exchange objects as long as you mark them Serializable. So making WCF calls would dramatically simplify how you exchange objects back and forth with your client(s).