End-to-end encryption with distributed key management in a tracking device environment
A tracking device can provide a hashed identifier to a mobile device, for instance within an advertisement packet. The mobile device can query each of a plurality of entities with the hashed identifier to identify an entity associated with the hash key used to generate the hashed identifier. In some embodiments, the mobile device can query a centralized key server, which in turn can query the plurality of entities to identify the entity associated with the hash key. The mobile device can then receive a public key from the identified entity, can determine a location of the mobile device, and can encrypt the location with the public key. The mobile device can then provide the hashed identifier and the encrypted location to the identified entity, which can provide the encrypted location to an owner of the tracking device for decryption using a private key corresponding to the public key.
1. A method comprising:
receiving, by a mobile device, a hashed identifier from a tracking device, the tracking device configured to compute the hashed identifier using a hash key, the hashed identifier corresponding to the tracking device;
querying, by the mobile device, a server associated with each of a plurality of entities within a directory with the hashed identifier, each entity within the directory associated with a set of hash keys and associated with a set of tracking devices, wherein each entity is configured to compute a candidate hashed identifier for each combination of hash key in the set of hash keys associated with the entity and tracking device in the set of tracking devices associated with the entity;
receiving, by the mobile device, a public key from a server associated with a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device;
accessing, by the mobile device, location data representative of a location of the mobile device;
encrypting, by the mobile device, the accessed location data using the public key to produce encrypted location data; and
providing, by the mobile device, the encrypted location data to the first entity.
2. The method of claim 1 , wherein querying a server associated with an entity comprises accessing a link listed within the directory associated with the server.
3. The method of claim 1 , wherein querying a server associated with an entity comprises accessing a first API associated with the server.
4. The method of claim 3 , wherein receiving the public key from the server comprises receiving the public key via a second API associated with the server.
5. The method of claim 1 , wherein each entity is configured to compute the candidate hashed identifiers in advance of being queried by the mobile device.
6. The method of claim 1 , wherein each entity is configured to compute the candidate hashed identifiers in response to being queried by the mobile device.
7. The method of claim 1 , wherein each entity determines that the entity is associated with the hash key used to compute the hashed identifier in response the hashed identifier matching one of the candidate hashed identifiers computed by the entity.
8. The method of claim 1 , wherein the first entity, in response to determining that the first entity is associated with the hash key used to compute the hashed identifier, is configured to provide an indication to the mobile device that the first entity is associated with the hash key used to compute the hashed identifier.
9. The method of claim 8 , wherein the mobile device, in response to receiving the indication that the first entity is associated with the hash key used to compute the hashed identifier, is configured to request the public key from the first entity via a link or API associated with the first entity, and wherein the first entity, in response to receiving the request, is configured to provide the public key to the mobile device.
10. The method of claim 1 , wherein the mobile device does not provide an indication to a user of the mobile device that the mobile device received the hashed identifier or detected the tracking device.
11. The method of claim 1 , wherein the mobile device does not provide an indication to a user of the mobile device that the mobile device encrypted the location data or provided the encrypted location data to the first entity.
12. The method of claim 1 , wherein the public key is associated with a corresponding private key, wherein the first entity is configured to provide the encrypted location data to a device of an owner of the tracking device, and wherein the device of the owner is configured to decrypt the location data using the private key.
13. The method of claim 12 , wherein the device of the owner is configured to determine the location of the mobile device based on the decrypted location data, and to display the location of the mobile device within a map interface.
14. The method of claim 1 , wherein the public key is associated with a corresponding private key, wherein the first entity has access to the corresponding private key, and wherein the first entity is configured to decrypt the encrypted location data and store the decrypted location data.
15. The method of claim 1 , wherein the first entity is configured to store the encrypted location data as a last known location of the tracking device.
16. The method of claim 1 , wherein the public key comprises a diversified public key of a set of diversified public keys, each associated with a same private key.
17. The method of claim 1 , wherein each entity of the plurality of entities comprises an independent company.
18. A mobile device comprising a hardware processor and a non-transitory computer-readable storage medium storing executable instructions that, when executed by the hardware processor, cause the hardware processor to perform steps comprising:
receiving, by the mobile device, a hashed identifier from a tracking device, the tracking device configured to compute the hashed identifier using a hash key, the hashed identifier corresponding to the tracking device;
querying, by the mobile device, a server associated with each of a plurality of entities within a directory with the hashed identifier, each entity within the directory associated with a set of hash keys and associated with a set of tracking devices, wherein each entity is configured to compute a candidate hashed identifier for each combination of hash key in the set of hash keys associated with the entity and tracking device in the set of tracking devices associated with the entity;
receiving, by the mobile device, a public key from a server associated with a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device;
accessing, by the mobile device, location data representative of a location of the mobile device;
encrypting, by the mobile device, the accessed location data using the public key to produce encrypted location data; and
providing, by the mobile device, the encrypted location data to the first entity.
19. A non-transitory computer-readable storage medium storing executable instructions that, when executed by a hardware processor of a mobile device, cause the hardware processor to perform steps comprising:
receiving, by the mobile device, a hashed identifier from a tracking device, the tracking device configured to compute the hashed identifier using a hash key, the hashed identifier corresponding to the tracking device;
querying, by the mobile device, a server associated with each of a plurality of entities within a directory with the hashed identifier, each entity within the directory associated with a set of hash keys and associated with a set of tracking devices, wherein each entity is configured to compute a candidate hashed identifier for each combination of hash key in the set of hash keys associated with the entity and tracking device in the set of tracking devices associated with the entity;
receiving, by the mobile device, a public key from a server associated with a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device;
accessing, by the mobile device, location data representative of a location of the mobile device;
encrypting, by the mobile device, the accessed location data using the public key to produce encrypted location data; and
providing, by the mobile device, the encrypted location data to the first entity.