System for protecting location information
A system ( 200 ) for protecting location information has beacons ( 240 ), a provider server ( 220 ) for providing at least one location based service, a location server ( 230 ) and mobile devices ( 210 ). The mobile device has a location engine ( 211 ) for controlling the location information and a location based application ( 212 ) for using the location information. The provider server generates unique data and authorizes the location based application, and subsequently provides location based services in dependence on an encrypted location. The location server determines the location based on a property of the radiation and encrypts the location. The location engine obtains a verification of customer data of the location based application, which indicates that use rights allow transfer of the location information to the location based application, and upon obtaining the verification transfers the encrypted location to the location based application. The location based application is authorized by the provider server, processes the encrypted location and uses the location based service.
1. A system for protecting location information, the system comprising:
beacons, each beacon having a radiation emitter for emitting radiation comprising a beacon identifier and at least one location identifier for identifying an area where the beacon associated with the beacon identifier is located;
a provider server for providing at least one location based service;
a location server having a location secret;
a mobile device comprising:
a radiation receiver for receiving the radiation from the beacons and determining at least one property of the radiation,
a location engine coupled to the radiation receiver for obtaining the location identifier and the property of the radiation, and
a location based application having customer data indicative of use rights of using the location information;
the provider server being arranged for:
communicating with the location server for generating unique data for the location based application based on the location secret,
providing the unique data based on the location secret,
authorizing the location based application prior to using the location based service by exchanging at least part of the unique data with the location based application, and
providing at least one location based service in dependence on an encrypted location;
the location server being arranged for:
communicating with the provider server for generating the unique data,
receiving the property of the radiation from the location engine and based on the property of the radiation determining the location of the mobile device, and
encrypting the location and transferring the encrypted location to the location engine;
the location engine being arranged for controlling the location information by:
receiving at least part of the customer data from the location based application,
obtaining a verification of the customer data as received from the location based application, the verification indicating that the use rights for the obtained location identifier allow transfer of the location information to the location based application, and
upon obtaining the verification, transferring the encrypted location to the location based application;
the location based application being arranged for using the location information by:
exchanging at least part of the unique data with the provider server for being authorized by the provider server,
obtaining a customer data indicative of use rights of using the location information,
requesting location information by transmitting at least part of the unique data and the customer data to the location engine,
processing the encrypted location based on the unique data, and
using the location based service as provided in dependence on the encrypted location.
2. The system as claimed in claim 1 , wherein the location server is arranged for;
providing, on request, corresponding customer data corresponding to the location identifier; and
obtaining the verification by:
requesting the location server to provide the corresponding customer data, and
comparing the corresponding customer data and the customer data received from the location based application.
3. The system as claimed in claim 1 , wherein:
the location engine is arranged for sending the customer data and the location identifier to the location server and receiving the verification from the location server; and
the location server is arranged for:
receiving the customer data and the location identifier,
providing the verification by comparing corresponding customer data corresponding to the location identifier and the customer data received from the location based application, and
sending the verification to the location engine.
4. The system as claimed in claim 1 , wherein:
the location server is arranged for encrypting the location based on part of the unique data of the location based application, and
the location based application is arranged for processing the encrypted location by decrypting the encrypted location based on the part of the unique data.
5. The system as claimed in claim 1 , wherein the location server is arranged for, upon the verification, receiving at least part of the unique data of the location based application, and/or checking validity of the unique data based on the location secret.
6. The system as claimed in claim 1 , wherein:
the location server is arranged for encrypting the location based on a provider key that is received from the provider server;
the location based application is arranged for processing the location information by transferring the encrypted location to the provider server; and
the provider server is arranged for decrypting the encrypted location based on the provider key and for providing the location based service in dependence on the decrypted location.
7. The system as claimed in claim 1 , wherein:
the location identifier is authenticated or cryptographically protected, and/or
the use rights are restricted to using the location engine and/or the location information for at least one of:
a specified location,
a specified access network,
a specified time period.
8. The system as claimed in claim 1 , wherein the communicating between the location server and the provider server for generating the unique data comprises one of:
sharing the location secret between the location server and the provider server, or
the provider server requesting the location server to generate the unique data based on the location secret.
9. The system as claimed in claim 1 , wherein:
the unique data comprise a unique identifier and a unique key that are cryptographically associated; and/or
the customer data comprise a customer identifier and/or security credentials; and/or
the unique data and the customer data constitute a set of security credentials that are cryptographically associated.
10. The system as claimed in claim 1 , wherein the provider server is arranged for providing the part of the unique data to the location based application during installing the location based application on the mobile device.
11. The system as claimed in claim 1 , wherein:
the location based application is arranged for processing the encrypted location by transferring the encrypted location to the provider server; and
the provider server is arranged for decrypting the encrypted location based on part of the unique data of the location based application and for providing the location based service in dependence on the decrypted location.