Secure beacon identity
A method may include receiving, from an endpoint device, a request to register a service that is supported by the endpoint device, identifying, in view of the service identified in the request, a service provider of interest that relates to the service, receiving, from the endpoint device, a service connection request to initiate data flow related to the service, validating the endpoint device, and responsive to validating the endpoint device, establishing the service connection to a device associated with the service.
1. A system, comprising:
a memory; and
one or more processors operatively coupled to the memory, the one or more processors being configured to execute operations to cause the system to perform operations comprising:
receive a beacon from a first intermediate device via a first network, wherein the beacon was received by the first intermediate device from an endpoint device via a second network, the beacon comprising a hash value, the hash value being generated using an identity of the endpoint device and a time unit when the beacon was generated;
validate the hash value of the beacon using the identity of the endpoint device and the time unit when the beacon was generated;
forward the beacon to a server via a third network in response to the hash value of the beacon being valid; and
invalidate one or more hash values of the beacon that have time unit values whose difference from a current time is greater than a predetermined threshold value.
2. The system of claim 1 , wherein when validating the hash value of the beacon, the system is to:
precompute hash values for one or more unique device identities and for values of time units up to a fixed time value;
store the precomputed hash values;
compare the hash value received with the beacon with the stored precomputed hash values; and
validate the hash value of the beacon in response to the hash value received with the beacon matching one of the stored precomputed hash values.
3. The system of claim 2 , wherein the stored precomputed hash values are sorted according to hash values.
4. The system of claim 1 , wherein the hash value is further based on a secret key known to the endpoint device and a relay manager server.
5. The system of claim 1 , wherein the hash value is further based on a media access control (MAC) address of the endpoint device.
6. The system of claim 1 , the operations further comprising to continue to receive additional beacons in response to the hash value of the beacon not being valid.
7. The system of claim 1 , wherein the time unit is predetermined before the beacon is generated.
8. The system of claim 1 , the operations further comprising to compensate for clock drift of the endpoint device such that the time unit when the beacon was generated is correct.
9. The system of claim 8 , the operations further comprising to adjust a clock of the endpoint device based on temperature variation or crystal inaccuracy.
10. The system of claim 1 , wherein the hash value of the beacon prevents the identity of the endpoint device from being discernible by a third party.
11. A system, comprising:
a memory; and
one or more processors operatively coupled to the memory, the one or more processors being configured to execute operations to cause the system to perform operations comprising:
calculate hash values for a set of unique device identities and for values of time units up to a fixed time value;
store the hash values;
receive a beacon from a first intermediate device via a first network, wherein the beacon was received by the first intermediate device from an endpoint device via a second network, the beacon comprising a hash value, the hash value being generated using an identity of the endpoint device and a time unit when the beacon was generated;
compare the hash value received with the beacon with the stored hash values;
validate the hash value of the beacon in response to the hash value received with the beacon matching one of the stored hash values as a result of the identity of the endpoint device and the time unit when the beacon was generated;
delete stored computed hash values for time unit values whose difference from a current time is greater than a predetermined threshold value; and
forward the beacon to a server via a third network in response to the hash value of the beacon being valid.
12. The system of claim 11 , wherein the stored computed hash values are sorted according to hash values.
13. The system of claim 11 , the operations further comprising to:
invalidate the hash value of the beacon in response to the hash value received with the beacon not matching one of the stored computed hash values; and
continue to receive additional beacons in response to the hash value of the beacon being invalidated.
14. The system of claim 11 , the operations further comprising to:
invalidate the computed hash values as time units elapse;
delete the invalidated hash values from storage; and
calculate new computed hash values as time units elapse.
15. A system, comprising:
a memory; and
one or more processors operatively coupled to the memory, the one or more processors being configured to execute operations to cause the system to perform operations comprising:
receive a beacon from a first intermediate device via a first network, wherein the beacon was received by the first intermediate device from an endpoint device via a second network, the beacon comprising a hash value, the hash value being generated using an identity of the endpoint device and a time unit when the beacon was generated;
calculate a clock drift of the endpoint device wherein the clock drift occurs from a temperature of a timing crystal of the endpoint device, and the clock drift is calculated and adjusted based on the temperature of the timing crystal of the endpoint device;
adjust the time unit in view of the calculated clock drift;
validate the hash value of the beacon using the identity of the endpoint device and the time unit when the beacon was generated; and
forward the beacon to a server via a third network in response to the hash value of the beacon being valid.
16. The system of claim 15 , the operations further comprising to periodically synchronize a clock of the endpoint device with a clock of a relay manager server.
17. The system of claim 15 , the operations further comprising to delete stored computed hash values for time unit values whose difference from a current time is greater than a predetermined threshold value.
18. The system of claim 15 , the operations further comprising to invalidate one or more hash values that have a time unit that is earlier than a latest resolved time.
19. A system, comprising:
a memory; and
one or more processors operatively coupled to the memory, the one or more processors being configured to execute operations to cause the system to perform operations comprising:
receive a beacon from a first intermediate device via a first network, wherein the beacon was received by the first intermediate device from an endpoint device via a second network, the beacon comprising a hash value, the hash value being generated using an identity of the endpoint device and a time unit when the beacon was generated;
calculate a clock drift of the endpoint device, wherein the clock drift is occurs from crystal frequency deviation and an elapsed time since the last clock synchronization, and the clock drift is calculated and adjusted based on the crystal frequency deviation and the elapsed time since the last clock synchronization;
adjust the time unit in view of the calculated clock drift;
validate the hash value of the beacon using the identity of the endpoint device and the time unit when the beacon was generated; and
forward the beacon to a server via a third network in response to the hash value of the beacon being valid.
20. A method, comprising:
receiving a beacon from a first intermediate device via a first network, wherein the beacon was received by the first intermediate device from an endpoint device via a second network, the beacon comprising a hash value, the hash value being generated using an identity of the endpoint device and a time unit when the beacon was generated;
validating the hash value of the beacon using the identity of the endpoint device and the time unit when the beacon was generated;
forwarding the beacon to a server via a third network in response to the hash value of the beacon being valid; and
invalidating one or more hash values of the beacon that have time unit values whose difference from a current time is greater than a predetermined threshold value.