Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

This might be one of those "not answerable" or "just opinions"-questions but I thought I'd give it a shot.

I'm developing an app with health care information with a friend who's a doctor. The basics of app are done and the information in the database is shaping up so now I've come to the question of wether, and if so how, I should restrict access to that information to just my app. The question of if is one I can answer, but any opinions are welcome. The question of how is where I need your help.

The app is written in Java on Android and the backend in Django, what ways do you see for restricting access to the backend so that other scripts/apps can't access it? One idea I had was for the phone to request an api key on first start and bind it to the IMIE number which I think is unique for each phone, then keep track of those tuples on the server. We(as in I) will likely port this to iOS at some stage, so it needs to be fairly cross-platform, I thought about binding to google accounts instead of IMIE number before.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

While you may be ways how to make it harder the general answer is no (what you are describing is similar in idea to DRM). You must assume that whoever have the application on their phone is able to reverse engineer it and (by definition) have all the necessary keys/passwords.

What you may do is restrict access to certain account by using authentication in similar way stackexchange is restricting access to your account only to you (but cannot restrict you to single application - I can fake the IE request by using telnet). Hence try to check in backend for user and be prepared for (potentially) malicious input from user who tried another application.

As last notes:

  • you want to connect by https of course.
  • check the regulations regarding handling medical data. While IANAL and I've never been in medical-related industry I do know that in some jurisdictions there are laws regarding handling such data and if procedures are not followed you (or your friend) might be in troubles even if nothing will happen.
  • while spoofing IMIE numbers is not legal in many places it is likely to be trivial to spoof it by using Android VM. Also IIRC IMIE is broadcasted through GSM network which crypto is broken for the last 20 years or so (so it can be assumed to be transmitted as plaintext).
share|improve this answer
    
Hm, you do make a couple of good points. Didn't occur to me that it's like DRM, which has been debated almost to death. Thanks for the notes, very informative. I'll skip the DRM, it's seldom if ever worth the hassle. –  dutt Jan 13 '13 at 9:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.