Best way to track mobile clients which use dynamic IP addresses

Question

I need to track users of my mobile application. When they are connected using wifi, they have a static IP address which never changes - this makes tracking easy. However, if they use their mobile network their IP addresses change on every request which makes tracking difficult.

I'm interested to see how other may have approached this problem and implemented a suitable tracking strategy in this situation?

EDIT: The solution needs to be as secure as possible to prevent users circumventing being tracked.

Thanks

Answer 1

I assume by tracking you mean that a webservice knows that two differents requests are from the same user ?

If so then you just need to use the standard web tools for this : Sessions and cookies.

Make your app generate a unique id at launch and send this unique id as a cookie or variable with every requests you make to your webservice. This way you really uniquely identifie them.

Also note : Wifi can give you a static Ip address inside the network in which the device is connected bu not on the Internet. The external(public) ip you can retrieve is the one of your router. Most of the time and with most internet providers, if the connection fails for some reason, the router will have a new ip affected to it. Beside if two persons are using the same router to connect to your webservice, they will have the same public ip address.

EDIT : The usual way of being more secure is the one used by most websites : The UID used to authenticate a user is generated by the web server(and not the app) on the first request/authentication of a session. This UID is passed from the webserver to the app that then resend it with every requests. This limits "session stealing" to the duration of the session. Request that do not send a UID or a UID that does not exists in the database are illegitimate.

EDIT 2 : The OP added in the comment below that what he really wants is limits the number of requests made by a single user in a certain time. Pratically, this means uniquely identifying a device. One way to do this is to compute a UID on the device at first launch and store it on the device. Then send this UID to the webservice with each request. The webservice will be responsible to limit the number of hits by a specific UID.

Note : Be careful of how you generate the UID. Android as a Android_ID but it is known to be null sometimes and to change over time. This guy seems to have found a not to easily spoofable Device UID :

Answer 2

You should be able to use the device id: http://developer.android.com/reference/android/telephony/TelephonyManager.html#getDeviceId ()

Edit: Or create an UUID the first time the app launches, more suggestions and information here: http://android-developers.blogspot.com/2011/03/identifying-app-installations.html