End-to-end encryption with distributed key management in a tracking device environment
A tracking device can provide a hashed identifier to a mobile device, for instance within an advertisement packet. The mobile device can query each of a plurality of entities with the hashed identifier to identify an entity associated with the hash key used to generate the hashed identifier. In some embodiments, the mobile device can query a centralized key server, which in turn can query the plurality of entities to identify the entity associated with the hash key. The mobile device can then receive a public key from the identified entity, can determine a location of the mobile device, and can encrypt the location with the public key. The mobile device can then provide the hashed identifier and the encrypted location to the identified entity, which can provide the encrypted location to an owner of the tracking device for decryption using a private key corresponding to the public key.
1. A method comprising:
receiving, by a centralized key server, a hashed identifier from a mobile device, the hashed identifier received by the mobile device from and computed by a tracking device using a hash key;
querying, by the centralized key server, a table stored by the centralized key server and including sets of hash keys each associated with a set of tracking devices and a different entity of a plurality of entities, the sets of hash keys stored by the table computed in advance of being queried by the centralized key server;
receiving, by the centralized key server, a public key from a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device, wherein the first entity is configured to provide an indication that the first entity is associated with the hash key in response to a communication from the centralized key server, and wherein the centralized key server is configured to request the public key from the first entity via a link or API associated with the first entity in response; and
providing, by the centralized key server, the public key to the mobile device, wherein the mobile device is configured to access location data representative of the mobile device, encrypt the accessed location data using the public key to produce encrypted location data, and provide the encrypted location data to the first entity, and wherein the centralized key server does not receive the encrypted location data.
2. The method of claim 1 , wherein querying the table comprises accessing a link listed within the table.
3. The method of claim 1 , wherein querying the table comprises accessing an API associated with the table.
4. The method of claim 3 , wherein the public key is received via a second API associated with the first entity.
5. The method of claim 3 , wherein the public key is received from the first entity in response to querying the table.
6. The method of claim 1 , wherein each entity is configured to store the computed candidate hashed identifiers within the table.
7. The method of claim 1 , wherein each entity is configured to compute the candidate hashed identifiers in response to being queried.
8. The method of claim 1 , wherein the first entity is identified in response to the hashed identifier matching one of the candidate hashed identifiers stored within the table.
9. The method of claim 1 , wherein the mobile device does not provide an indication to a user of the mobile device that the mobile device received the hashed identifier or detected the tracking device.
10. The method of claim 1 , wherein the mobile device does not provide an indication to a user of the mobile device that the mobile device encrypted the location data or provided the encrypted location data to the first entity.
11. The method of claim 1 , wherein the public key is associated with a corresponding private key, wherein the first entity is configured to provide the encrypted location data to a device of an owner of the tracking device, and wherein the device of the owner is configured to decrypt the location data using the private key.
12. The method of claim 11 , wherein the device of the owner is configured to determine the location of the mobile device based on the decrypted location data, and to display the location of the mobile device within a map interface.
13. The method of claim 1 , wherein the public key is associated with a corresponding private key, wherein the first entity has access to the corresponding private key, and wherein the first entity is configured to decrypt the encrypted location data and store the decrypted location data.
14. The method of claim 1 , wherein the first entity is configured to store the encrypted location data as a last known location of the tracking device.
15. The method of claim 1 , wherein the public key comprises a diversified public key of a set of diversified public keys, each associated with a same private key.
16. The method of claim 1 , wherein each entity of the plurality of entities comprises an independent company.
17. A centralized tracking server comprising a hardware processor and a non-transitory computer-readable storage medium storing executable instructions that, when executed by the hardware processor, cause the centralized tracking server to perform steps comprising:
receiving, by the centralized key server, a hashed identifier from a mobile device, the hashed identifier received by the mobile device from and computed by a tracking device using a hash key;
querying, by the centralized key server, a table stored by the centralized key server and including sets of hash keys each associated with a set of tracking devices and a different entity of a plurality of entities, the sets of hash keys stored by the table computed in advance of being queried by the centralized key server;
receiving, by the centralized key server, a public key from a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device, wherein the first entity is configured to provide an indication that the first entity is associated with the hash key in response to a communication from the centralized key server, and wherein the centralized key server is configured to request the public key from the first entity via a link or API associated with the first entity in response; and
providing, by the centralized key server, the public key to the mobile device, wherein the mobile device is configured to access location data representative of the mobile device, encrypt the accessed location data using the public key to produce encrypted location data, and provide the encrypted location data to the first entity, and wherein the centralized key server does not receive the encrypted location data.
18. A non-transitory computer-readable storage medium storing executable instructions that, when executed by a hardware processor of a centralized tracking server, cause the centralized tracking server to perform steps comprising:
receiving, by the centralized key server, a hashed identifier from a mobile device, the hashed identifier received by the mobile device from and computed by a tracking device using a hash key;
querying, by the centralized key server, a table stored by the centralized key server and including sets of hash keys each associated with a set of tracking devices and a different entity of a plurality of entities, the sets of hash keys stored by the table computed in advance of being queried by the centralized key server;
receiving, by the centralized key server, a public key from a first entity of the plurality of entities associated with the hash key used to compute the hashed identifier, the public key associated with the tracking device, wherein the first entity is configured to provide an indication that the first entity is associated with the hash key in response to a communication from the centralized key server, and wherein the centralized key server is configured to request the public key from the first entity via a link or API associated with the first entity in response; and
providing, by the centralized key server, the public key to the mobile device, wherein the mobile device is configured to access location data representative of the mobile device, encrypt the accessed location data using the public key to produce encrypted location data, and provide the encrypted location data to the first entity, and wherein the centralized key server does not receive the encrypted location data.