End-to-end encryption with distributed key management in a tracking device environment
A tracking device can provide a hashed identifier to a mobile device, for instance within an advertisement packet. The mobile device can query each of a plurality of entities with the hashed identifier to identify an entity associated with the hash key used to generate the hashed identifier. In some embodiments, the mobile device can query a centralized key server, which in turn can query the plurality of entities to identify the entity associated with the hash key. The mobile device can then receive a public key from the identified entity, can determine a location of the mobile device, and can encrypt the location with the public key. The mobile device can then provide the hashed identifier and the encrypted location to the identified entity, which can provide the encrypted location to an owner of the tracking device for decryption using a private key corresponding to the public key.
1 . A method comprising:
providing, by the mobile device, a hashed identifier received from a tracking device to a centralized key server, the centralized key server configured to 1) query each of a plurality of servers with the hashed identifier, each of the plurality of servers different than and remote from the centralized key server, each server of the plurality of servers associated with a different entity, each server of the plurality of servers associated with a different set of hash keys, and each server of the plurality of servers storing a corresponding different database of hashed identifiers computed using the set of hash keys associated with the server such that a hash key of the set of hash keys used to compute hashed identifiers is rotated periodically such that each server uses a different hash key of the associated different set of hash keys for each distinct predetermined interval of time to compute each hashed identifier during the predetermined interval of time, each server configured to ignore the query in response to determining that the hashed identifier has expired, 2) receive a public key from a first of the servers associated with a first entity, the first server including a corresponding database that includes the hashed identifier and storing a hash key used to compute the hashed identifier, and 3) provide the public key to the mobile device;
encrypting, by the mobile device, location data representative of a location of the mobile device when the mobile device receives the hashed identifier from the tracking device to produce encrypted location data; and
providing, by the mobile device, the encrypted location data to the first entity associated with the hash key.
2 . The method of claim 1 , wherein querying each of the plurality of servers comprises querying a hashed identifier look-up table associated with each server stored by the centralized key server to identify the first entity associated with the hash key used to compute the hashed identifier.
3 . The method of claim 2 , wherein identifying the entity comprises identifying the look-up table that includes the hashed identifier and identifying the first entity associated with the identified look-up table.
4 . The method of claim 1 , wherein querying each of the plurality of servers comprises accessing a link or an API associated with each of the plurality of servers.
5 . The method of claim 1 , wherein the public key is received automatically in response to querying the first server associated with the first entity associated with the hash key.
6 . The method of claim 1 , wherein the public key is received in response to a request for the public key from the centralized key server to the first server associated with the first entity associated with the hash key.
7 . The method of claim 1 , wherein providing the encrypted location data to the first entity associated with the hash key comprises providing the encrypted location data to the centralized key server, and wherein the centralized key server is configured to provide the encrypted location data to the first entity associated with the hash key.
8 . The method of claim 1 , wherein the centralized key server is configured to identify the first entity associated with the hash key to the mobile device, and wherein the mobile device is configured to provide the encrypted location data directly to the identified first entity associated with the hash key.
9 . The method of claim 8 , wherein identifying the first entity associated with the hash key comprises providing a link, an identifier, or an API associated with the first entity associated with the hash key to the mobile device.
10 . The method of claim 1 , wherein the public key comprises a diversified public key of a set of diversified public keys, each associated with a same private key.
11 . A non-transitory computer-readable storage medium storing executable instructions that, when executed by a hardware processor, cause the hardware processor to perform steps comprising:
providing, by the mobile device, a hashed identifier received from a tracking device to a centralized key server, the centralized key server configured to 1) query each of a plurality of servers with the hashed identifier, each of the plurality of servers different than and remote from the centralized key server, each server of the plurality of servers associated with a different entity, each server of the plurality of servers associated with a different set of hash keys, and each server of the plurality of servers storing a corresponding different database of hashed identifiers computed using the set of hash keys set of hash keys associated with the server such that a hash key of the set of hash keys used to compute hashed identifiers is rotated periodically such that each server uses a different hash key of the associated different set of hash keys for each distinct predetermined interval of time to compute each hashed identifier during the predetermined interval of time, each server configured to ignore the query in response to determining that the hashed identifier has expired, 2) receive a public key from a first of the servers associated with a first entity, the first server including a corresponding database that includes the hashed identifier and storing a hash key used to compute the hashed identifier, and 3) provide the public key to the mobile device;
encrypting, by the mobile device, location data representative of a location of the mobile device when the mobile device receives the hashed identifier from the tracking device to produce encrypted location data; and
providing, by the mobile device, the encrypted location data to the first entity associated with the hash key.
12 . The non-transitory computer-readable storage medium of claim 11 , wherein querying each of the plurality of servers comprises querying a hashed identifier look-up table associated with each server stored by the centralized key server to identify the first entity associated with the hash key used to compute the hashed identifier.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein identifying the entity comprises identifying the look-up table that includes the hashed identifier and identifying the first entity associated with the identified look-up table.
14 . The non-transitory computer-readable storage medium of claim 11 , wherein querying each of the plurality of servers comprises accessing a link or an API associated with each of the plurality of servers.
15 . The non-transitory computer-readable storage medium of claim 11 , wherein the public key is received automatically in response to querying the first server associated with the first entity associated with the hash key.
16 . The non-transitory computer-readable storage medium of claim 11 , wherein the public key is received in response to a request for the public key from the centralized key server to the first server associated with the first entity associated with the hash key.
17 . The non-transitory computer-readable storage medium of claim 11 , wherein providing the encrypted location data to the first entity associated with the hash key comprises providing the encrypted location data to the centralized key server, and wherein the centralized key server is configured to provide the encrypted location data to the first entity associated with the hash key.
18 . The non-transitory computer-readable storage medium of claim 11 , wherein the centralized key server is configured to identify the first entity associated with the hash key to the mobile device, and wherein the mobile device is configured to provide the encrypted location data directly to the identified first entity associated with the hash key.
19 . The non-transitory computer-readable storage medium of claim 18 , wherein identifying the first entity associated with the hash key comprises providing a link, an identifier, or an API associated with the first entity associated with the hash key to the mobile device.
20 . The non-transitory computer-readable storage medium of claim 11 , wherein the public key comprises a diversified public key of a set of diversified public keys, each associated with a same private key.