Generating and using ephemeral identifiers and message integrity codes

1. A method for generating ephemeral identifiers, the method comprising:

determining, by one or more beacon devices, a current time-count;

determining, by the one or more beacon devices, a time-modified identifier based at least in part on a static identifier and the current time-count; and

determining, by the one or more beacon devices, an ephemeral identifier based at least in part on the time-modified identifier and a rotation key;

wherein determining, by one or more beacon devices, the current time-count comprises obtaining, by the one or more beacon devices, each of a plurality of time-counts from a time-based counter that increments the current time-count by an increment quanta at each instance in which the time-based counter increments the current time-count, wherein the increment quanta is not equal to one; and

wherein the current time-count and the rotation key are provided as one or more shared secrets between the one or more beacon devices and a verifying entity.

2. The method of claim 1 , wherein the time-based counter comprises a one second counter.

3. The method of claim 1 , wherein the one or more shared secrets between the one or more beacon devices and the verifying entity comprises the increment quanta.

4. The method of claim 1 , wherein:

obtaining, by the one or more beacon devices, the current time-count from a time-based counter comprises respectively obtaining, by the one or more beacon devices, each of a plurality of time-counts from the time-based counter at a rotation rate, the rotation rate defining how often a new ephemeral identifier is generated;

determining, by the one or more beacon devices, the time-modified identifier based at least in part on the static identifier and the current time-count comprises respectively determining, by the one or more beacon devices, a plurality of time-modified identifiers based at least in part on the static identifier and the plurality of time-counts; and

determining, by the one or more beacon devices, the ephemeral identifier based at least in part on the time-modified identifier and the rotation key comprises respectively determining, by the one or more beacon devices, a plurality of ephemeral identifiers based at least in part on the plurality of time-modified identifiers and the rotation key.

5. The method of claim 4 , wherein the one or more shared secrets between the one or more beacon devices and the verifying entity comprises the rotation rate.

6. A system for using ephemeral identifiers, the system comprising:

a plurality of beacon devices, wherein a plurality of static identifiers are respectively associated with the plurality of beacon devices, and wherein each of the plurality of beacon devices is configured to periodically determine an ephemeral identifier based on its respective static identifier and a current time-count;

an observing entity configured to receive a first ephemeral identifier from a first beacon device of the plurality of beacon devices; and

a verifying entity configured to:

receive the first ephemeral identifier from the observing entity; and

determine an identity of the first beacon device by locating the first ephemeral identifier in a pre-computed ephemeral identifier cache;

wherein the first ephemeral identifier comprises a time-varied obscuration of the static identifier associated with the first beacon device, the first ephemeral identifier having been generated using an obscuring function known only to the first beacon device and the verifying entity, such that the observing entity cannot compute the identity of the first beacon device independent from communication with the verifying entity; and

wherein the current time-count of the beacon device is obtained from a time-based counter that increments the current time-count by an increment quanta that is not equal to one, wherein the increment quanta comprises a shared secret between the first beacon device and the verifying entity.

7. The system for using ephemeral identifiers of claim 6 , wherein the ephemeral identifier periodically determined by each of the plurality of beacon devices comprises a pseudo-random sequence of identifiers.

8. The system for using ephemeral identifiers of claim 6 , wherein the obscuring function is a block cipher.

9. The system for using ephemeral identifiers of claim 6 , wherein each of the plurality of beacon devices is configured to periodically determine an ephemeral identifier based on its respective static identifier and a current time-count as well as a rotation key.

10. A beacon device, comprising:

one or more processors; and

a memory storing instructions that, when implemented by the one or more processors, cause the one or more processors to perform operations, the operations comprising:

determining a current time-count from a time-based counter that increments the current time-count by an increment quanta that is not equal to one;

providing the current time-count to a verifying entity such that the current time-count is a shared secret between the beacon device and the verifying entity;

determining a time-modified identifier based at least in part on a static identifier and the current time-count;

determining an ephemeral identifier based at least in part on the time-modified identifier and a rotation key; and

emitting a message containing the ephemeral identifier, the message configured to be received by an observing entity that cannot compute the identity of the beacon device independent from communication with the verifying entity.

11. The beacon device of claim 10 , wherein determining the current time-count comprises obtaining each of a plurality of time-counts from a time-based counter at a rotation rate, the rotation rate defining how often a new ephemeral identifier is generated.

12. The beacon device of claim 10 , wherein the message comprises an advertising frame broadcast using Bluetooth low energy (BLE) technology.

13. The beacon device of claim 10 , wherein the beacon device comprises a proximity beacon configured to enable location-based services for an observing entity receiving from the beacon device the message containing the ephemeral identifier.

14. The beacon device of claim 10 , wherein the beacon device comprises an asset-tracking beacon configured to enable tracking of an asset.