Identification, authentication, and authorization

Identification, authentication, and authorization are the key concepts in information security. Identification is simply claiming you are somebody. Authentication is proving that you are who you say you are. Authorization is where an authority gives you the permission to carry out a specific task or set of tasks. It is highly likely that these concepts will come into play for a ResearchKit-based application, considering that the application may record, transmit, and display sensitive information about the participant.

ResearchKit does not provide any support for identification, authentication, or authorization; it is up to the application developer to implement the required functionality. Depending on the requirements of an application, the developer may need to implement features to identify and authenticate a participant for both the iOS device and web services (for example, data collection service). Identifying and authenticating to a device is to ensure that the right person is using the application. Identifying and authenticating to a web service is to ensure that the data is only collected from consented individuals.

For devices with Touch ID, Apple's fingerprint recognition feature, an application developer may use this technology to identify and authenticate a participant to the device. Available in all iOS devices, Apple's keychain technology may be used to store log-on credential for any web services. Once a participant has been authenticated to the device, the application may retrieve the web services' credentials from the keychain.