Secure recognition of mobile devices

1. A method for secure mobile device recognition, comprising:

determining, based on a network message received at a first IOT edge device, that a mobile device is not recognized at the first IOT edge device;

transmitting a token request from the first IOT edge device to the mobile device, and in response receiving at the first IOT edge device a first encrypted token from the mobile device, wherein the first encrypted token is one of a plurality of tokens received at the mobile device from a server different from the first IOT edge device;

transmitting the first encrypted token from the first IOT edge device to the server, wherein the server is configured to determine an identifier corresponding with the mobile device, based on the first encrypted token;

initiating a recognition task for the mobile device, based on the determined identifier;

determining, based on a second network message received at a second IOT edge device different from the first IOT edge device, that the mobile device is not recognized at the second IOT edge device;

transmitting a second token request from the second IOT edge device to the mobile device, and in response receiving at the second IOT edge device a second encrypted token from the mobile device, wherein the second encrypted token is different from the first encrypted token and is another of the plurality of tokens received at the mobile device from the server;

transmitting the second encrypted token from the second IOT edge device to the server, wherein the server is configured to determine the identifier corresponding with the mobile device, based on the second encrypted token; and

initiating a second recognition task for the mobile device, based on the determined identifier.

2. The method of claim 1 , further comprising:

receiving, at the server, a request to generate the plurality of tokens corresponding to the mobile device;

generating the plurality of tokens, comprising the first encrypted token and the second encrypted token, at the server;

storing, using the server, a correlation between the plurality of tokens and the identifier corresponding with the mobile device; and

transmitting the plurality of tokens from the server to the mobile device.

3. The method of claim 2 , wherein generating the plurality of tokens further comprises:

generating the first encrypted token by encrypting a value using format preserving encryption, wherein the format preserving encryption generates a predetermined number of bits.

4. The method of claim 3 , wherein the predetermined number of bits corresponds to a number of bits associated with a Bluetooth Low Energy (BLE) characteristic.

5. The method of claim 3 , wherein the value comprises a token identifier and a counter.

6. The method of claim 1 , wherein determining, based on the first encrypted token, the identifier corresponding with the mobile device further comprises:

receiving, at the server, a request to determine the identifier, the request comprising the first encrypted token;

identifying, using the server, a previously stored correlation between the first encrypted token and the identifier corresponding with the mobile device; and

determining, using the server, the identifier corresponding with the mobile device based on the previously stored correlation.

7. The method of claim 6 , wherein identifying the previously stored correlation further comprises:

decrypting the first encrypted token, at the server, using a secret key;

determining a token identifier based on the decrypted first encrypted token; and

identifying the previously stored correlation using the token identifier.

8. The method of claim 7 , wherein identifying the previously stored correlation comprises querying a database, using the token identifier, for the identifier corresponding with the mobile device.

9. The method of claim 1 , wherein the first IOT edge device comprises a BLE reader.

10. The method of claim 1 , wherein the first IOT edge device maintains a whitelist of previously recognized mobile devices, and wherein the determining that the mobile device is not recognized comprises determining that the mobile device is not included in the whitelist.

11. A non-transitory computer-readable medium containing computer program code that, when executed by operation of one or more computer processors, performs an operation comprising:

determining, based on a network message received at a first IOT edge device, that a mobile device is not recognized at the first IOT edge device;

transmitting a token request from the first IOT edge device to the mobile device, and in response receiving at the first IOT edge device a first encrypted token from the mobile device, wherein the first encrypted token is one of a plurality of tokens received at the mobile device from a server different from the first IOT edge device;

transmitting the first encrypted token from the first IOT edge device to the server, wherein the server is configured to determine an identifier corresponding with the mobile device, based on the first encrypted token;

initiating a recognition task for the mobile device, based on the determined identifier;

determining, based on a second network message received at a second IOT edge device different from the first IOT edge device, that the mobile device is not recognized at the second IOT edge device;

transmitting a second token request from the second IOT edge device to the mobile device, and in response receiving at the second IOT edge device a second encrypted token from the mobile device, wherein the second encrypted token is different from the first encrypted token and is another of the plurality of tokens received at the mobile device from the server;

transmitting the second encrypted token from the second IOT edge device to the server, wherein the server is configured to determine the identifier corresponding with the mobile device, based on the second encrypted token; and

initiating a second recognition task for the mobile device, based on the determined identifier.

12. The non-transitory computer-readable medium of claim 11 , the operation further comprising:

receiving, at the server, a request to generate the plurality of tokens corresponding to the mobile device;

generating the plurality of tokens, comprising the first encrypted token and the second encrypted token, at the server, comprising:

generating the first encrypted token by encrypting a value using format preserving encryption, wherein the format preserving encryption generates a predetermined number of bits;

storing, using the server, a correlation between the plurality of tokens and the identifier corresponding with the mobile device; and

transmitting the plurality of tokens from the server to the mobile device.

13. The non-transitory computer-readable medium of claim 11 , wherein determining, based on the first encrypted token, the identifier corresponding with the mobile device further comprises:

receiving, at the server, a request to determine the identifier, the request comprising the first encrypted token;

identifying, using the server, a previously stored correlation between the first encrypted token and the identifier corresponding with the mobile device; and

determining, using the server, the identifier corresponding with the mobile device based on the previously stored correlation.

14. The non-transitory computer-readable medium of claim 13 , wherein identifying the previously stored correlation further comprises:

decrypting the first encrypted token, at the server, using a secret key;

determining a token identifier based on the decrypted first encrypted token; and

identifying the previously stored correlation using the token identifier.

15. A system, comprising:

a processor; and

a memory containing a program that, when executed on the processor, performs an operation, the operation comprising:

determining, based on a network message received at a first IOT edge device, that a mobile device is not recognized at the first IOT edge device;

transmitting a token request from the first IOT edge device to the mobile device, and in response receiving at the first IOT edge device a first encrypted token from the mobile device, wherein the first encrypted token is one of a plurality of tokens received at the mobile device from a server different from the first IOT edge device;

transmitting the first encrypted token from the first IOT edge device to the server, wherein the server is configured to determine an identifier corresponding with the mobile device, based on the first encrypted token;

initiating a recognition task for the mobile device, based on the determined identifier;

determining, based on a second network message received at a second IOT edge device different from the first IOT edge device, that the mobile device is not recognized at the second IOT edge device;

transmitting a second token request from the second IOT edge device to the mobile device, and in response receiving at the second IOT edge device a second encrypted token from the mobile device, wherein the second encrypted token is different from the first encrypted token and is another of the plurality of tokens received at the mobile device from the server;

transmitting the second encrypted token from the second IOT edge device to the server, wherein the server is configured to determine the identifier corresponding with the mobile device, based on the second encrypted token; and

initiating a second recognition task for the mobile device, based on the determined identifier.

16. The system of claim 15 , the operation further comprising:

receiving, at the server, a request to generate the plurality of tokens corresponding to the mobile device;

generating the plurality of tokens, comprising the first encrypted token and the second encrypted token, at the server, comprising:

generating the first encrypted token by encrypting a value using format preserving encryption, wherein the format preserving encryption generates a predetermined number of bits;

storing, using the server, a correlation between the plurality of tokens and the identifier corresponding with the mobile device; and

transmitting the plurality of tokens from the server to the mobile device.

17. The system of claim 15 , wherein determining, based on the first encrypted token, the identifier corresponding with the mobile device further comprises:

receiving, at the server, a request to determine the identifier, the request comprising the first encrypted token;

identifying, using the server, a previously stored correlation between the first encrypted token and the identifier corresponding with the mobile device; and

determining, using the server, the identifier corresponding with the mobile device based on the previously stored correlation.