Azure IoT Hub Integration in Mobile IoT Applications
Azure IoT Hub differs from AWS IoT Core mainly in authentication model and protocols. No MQTT over WebSocket via SigV4 — instead SAS tokens (Shared Access Signatures) or X.509. For mobile apps this means different strategy: don't give user SAS Connection String, generate short-lived SAS tokens on backend.
Authentication via SAS Tokens
SAS Connection String (HostName=...;SharedAccessKeyName=...;SharedAccessKey=...) — root credentials equivalent. Never embed in mobile app. Solution — backend proxy: user authenticates in your system, backend generates SAS token with limited lifetime (8–24 hours) for specific device ID and returns to client.
Token generation on Node.js:
const crypto = require('crypto');
function generateSasToken(resourceUri, signingKey, expiresInMins) {
const expiry = Math.ceil(Date.now() / 1000 + expiresInMins * 60);
const stringToSign = `${encodeURIComponent(resourceUri)}\n${expiry}`;
const hmac = crypto.createHmac('sha256', Buffer.from(signingKey, 'base64'));
const signature = hmac.update(stringToSign).digest('base64');
return `SharedAccessSignature sr=${encodeURIComponent(resourceUri)}&sig=${encodeURIComponent(signature)}&se=${expiry}`;
}
Mobile client gets this token and connects to IoT Hub via AMQP over WebSocket or MQTT. On Flutter use mqtt_client with SAS token in password field. On React Native — azure-iot-device npm package via react-native-tcp-socket or AMQP via rhea (AMQP 1.0).
Cloud-to-Device and Device-to-Cloud Messages
IoT Hub supports several messaging patterns:
Device-to-Cloud (D2C) — telemetry from device to hub. Mobile app as "virtual device" publishes commands via D2C. Limit: 256 KB per message, max 8000 messages/day on free tier.
Cloud-to-Device (C2D) — commands from cloud to device. Use for push commands: backend sends C2D to specific deviceId, device receives and executes. Delivery acknowledgment — positive/negative/none.
Direct Methods — synchronous request-response with timeout (1–300 sec). Ideal for commands needing confirmation: "set temperature 22°C" → response from device with status. Called from mobile via REST API: POST /twins/{deviceId}/methods.
Device Twin
Analog of AWS Device Shadow — Device Twin. Stores desired and reported properties. For mobile — main way to read current device state without persistent MQTT: GET /twins/{deviceId} via IoT Hub REST API with Bearer token.
Typical mistake: accessing Device Twin directly from mobile, passing IoT Hub connection string. Correct — via own API layer, proxying requests and verifying user's device access rights.
Azure Notification Hubs for Push
Push by IoT events — via Azure Event Grid + Azure Function + Azure Notification Hubs. Event Grid subscribes to IoT Hub events (Microsoft.Devices.DeviceTelemetry), triggers Function, Function sends push via Notification Hubs to FCM/APNs.
On Flutter integrate via firebase_messaging (for FCM) — Azure Notification Hubs manages registration and targeting, delegates delivery to FCM/APNs. Tagging registrations by userId lets send push to specific user without token storage on IoT backend.
Timeline
Basic integration (SAS tokens, MQTT/AMQP connection, Device Twin) — 2–3 weeks. Direct Methods, Event Grid, push notifications — additional 2 weeks. Pricing depends on device count, IoT Hub tier, and required message frequency.