Preserving Security by Synchronizing a Nonce or Counter Between Systems

• US 20140133656A1
• Filed: 02/21/2013
• Published: 05/15/2014
• Est. Priority Date: 02/22/2012
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Wurster, Charles S., Shang, Ning, Thomas, Panagiotis, Sprigg, Stephen A., Hohlfeld, Matthew, Mclean, Ivan Hugh
• Application Number:
  US13/773,336
• Publication Number:
  US 20140133656A1
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G01S 5/0018 Transmission from mobile station to base station
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/75 Temporary identity
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds

Abstract

Methods, systems and devices enable synchronizing obscured identification information between a wireless identity transmitter and a central server to support one-way communication of the obscured identification information to the central server. The wireless identity transmitter may be a compact device configured to broadcast messages, such as through Bluetooth® advertisements, including an obscured identifier for receipt and relay to the central server by proximate proximity broadcast receivers via sighting messages that may also include location information. The central server may decode received identification codes to identify the wireless identity transmitter. The wireless identity transmitter may create message data by concatenating identifying information with an incrementing nonce, encrypting the concatenated information, and truncating the encrypted information. Alternatively, concatenated identification information may be encrypted with a pseudo-random function and a secret key known by the central server. The central server that may compare received data to pre-calculated encrypted data.

Claims

1. A method for a server to securely identify an originator of a message including obscured information, comprising:

associating a shared secret key with a device identifier corresponding to a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier;

determining whether the decoded device identifier matches the device identifier associated with the shared secret key; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier associated with the wireless identity transmitter.

2. The method of claim 1, wherein the message further includes a nonce, wherein decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier comprises decoding the extracted rolling identifier using a streaming-like encryption algorithm, the nonce extracted from the message and the shared secret key to generate the decoded device identifier.

3. The method of claim 1, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

4. The method of claim 1, wherein the shared secret key has a size of 128 bits.

5. The method of claim 1, wherein decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier further comprises decoding data that was concatenated to the device identifier prior to encryption.

6. A method for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter with a streaming-like encryption algorithm using a secret key shared with a server and the nonce;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval.

7. The method of claim 6, wherein the periodically broadcast message further includes the nonce.

8. The method of claim 6, wherein the nonce represents a non-repeating number generated by the wireless identity transmitter whose value changes each time the device identifier encoding is required to change.

9. The method of claim 6, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

10. The method of claim 6, wherein the message is a single packet with a size of 80 bits or less and wherein the secret key is 128 bits.

11. The method of claim 6, wherein generating the rolling identifier comprises concatenating to the device identifier data to be transmitted and encoding the concatenated identifier and data with the streaming-like encryption algorithm using the secret key shared with a server and the nonce.

12. A method for a server to securely identify an originator of a message including obscured information, comprising:

associating a shared secret key with a nonce and a device identifier for a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

incrementing the nonce to represent a current time of the server;

encoding the device identifier using the shared secret key, the nonce, and a pseudo-random function to generate server-encrypted data;

determining whether the server-encrypted data matches the extracted rolling identifier; and

identifying the originator of the received message as the wireless identity transmitter when the server-encrypted data matches the extracted rolling identifier.

13. The method of claim 12, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

14. The method of claim 12, wherein incrementing the nonce to represent a current time of the server comprises computing the nonce to correspond to a time a proximity broadcast receiver received a broadcast from the wireless identity transmitter based on information included within the message.

15. The method of claim 12, further comprising extracting a nonce from the received message, wherein encoding the device identifier uses the nonce extracted from the received message.

16. A method for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by using a pseudo-random function to encode a device identifier associated with the wireless identity transmitter based on a secret key shared with a server, and the nonce;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

17. The method of claim 16, wherein generating a rolling identifier by using a pseudo-random function comprises concatenating to the device identifier data to be transmitted and using the pseudo-random function to encode the concatenated device identifier and data based on the secret key shared with a server, and the nonce.

18. The method of claim 16, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

19. A method for a server to securely identify an originator of a message including obscured information, comprising:

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using a streaming-like encryption algorithm, the first secret key, and a nonce associated with a pre-computed encoded nonce matching the extracted encoded nonce to generate a decoded device identifier;

when the extracted encoded nonce does not match one of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and the initial nonce associated with the wireless identity transmitter to generate the decoded device identifier; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier of the wireless identity transmitter.

20. The method of claim 19, wherein the first secret key and the second secret key have the same value.

21. A method for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with a server, and the nonce with a streaming-like encryption algorithm;

generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

22. A method for a server to securely identify an originator of a message, comprising:

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

pre-computing a plurality of encoded device identifiers using a streaming-like encryption algorithm with the first secret key, the current nonce, and the device identifier;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, comparing the extracted rolling identifier to the plurality of pre-computed encoded device identifiers; and

identifying the originator of the received message as the wireless identity transmitter when the extracted rolling identifier matches any of the plurality of pre-computed encoded device identifiers.

23. A method for a server to securely identify an originator of a message, comprising:

generating a plurality of initial model payloads with an encryption algorithm, a shared secret key, an initial nonce, and a device identifier associated with a wireless identity transmitter, wherein the encryption algorithm is shared with the wireless identity transmitter;

generating a plurality of current model payloads with the encryption algorithm, the shared secret key, a current nonce, and the device identifier associated with the wireless identity transmitter;

receiving the message including a payload with obscured identification information;

comparing the payload of the received message to the plurality of current model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of current model payloads;

when the payload of the received message does not match any of the plurality of current model payloads, comparing the payload of the received message to the plurality of initial model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of initial model payloads; and

updating the current nonce associated with the wireless identity transmitter when the payload of the received message matches at least one of an initial model payload and a current model payload.

24. A method for a wireless identity transmitter receiving incoming messages, the method comprising:

periodically broadcasting messages that indicate availability for receiving incoming transmissions via short-range wireless transmissions for a first period;

receiving a link advertisement message during a second period in response to the first period expiring;

negotiating a link with a proximity broadcast receiver based on information within the received link advertisement message;

authenticating the negotiated link; and

processing incoming messages via the negotiated link, and

wherein the negotiated link is performed via Bluetooth pairing.

25. The method of claim 24, wherein the incoming messages include at least one of firmware updates, configuration information, trigger signals, and software instructions.

26. The method of claim 24, wherein the first period is defined by at least one of a timer on the wireless identity transmitter, clock signals, and a received message from the proximity broadcast receiver.

27. A server configured to securely identify an originator of a message including obscured information, comprising:

means for associating a shared secret key with a device identifier corresponding to a wireless identity transmitter;

means for receiving the message including a rolling identifier;

means for extracting the rolling identifier from the received message;

means for decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier;

means for determining whether the decoded device identifier matches the device identifier associated with the shared secret key; and

means for identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier associated with the wireless identity transmitter.

28. The server of claim 27, wherein the message further includes a nonce, and wherein means for decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier comprises means for decoding the extracted rolling identifier using a streaming-like encryption algorithm, the nonce extracted from the message and the shared secret key to generate the decoded device identifier.

29. The server of claim 27, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

30. The server of claim 27, wherein the shared secret key has a size of 128 bits.

31. The server of claim 27, wherein means for decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier further comprises means for decoding data that was concatenated to the device identifier prior to encryption.

32. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification inform, comprising:

means for initializing a nonce within the wireless identity transmitter;

means for generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter with a streaming-like encryption algorithm using a secret key shared with a server and the nonce;

means for periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

means for incrementing the nonce at a predefined interval.

33. The wireless identity transmitter of claim 32, wherein the periodically broadcast message further includes the nonce.

34. The wireless identity transmitter of claim 32, wherein the nonce represents a non-repeating number generated by the wireless identity transmitter whose value changes each time the device identifier encoding is required to change.

35. The wireless identity transmitter of claim 32, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

36. The wireless identity transmitter of claim 32, wherein the message is a single packet with a size of 80 bits or less and wherein the secret key is 128 bits.

37. The wireless identify transmitter of claim 32, wherein means for generating the rolling identifier comprises means for concatenating to the device identifier data to be transmitted and encoding the concatenated identifier and data with the streaming-like encryption algorithm using the secret key shared with a server and the nonce.

38. A server configured to securely identify an originator of a message including obscured information, comprising:

means for associating a shared secret key with a nonce and a device identifier for a wireless identity transmitter;

means for receiving the message including a rolling identifier;

means for extracting the rolling identifier from the received message;

means for incrementing the nonce to represent a current time of the server;

means for encoding the device identifier using the shared secret key, the nonce, and a pseudo-random function to generate server-encrypted data;

means for determining whether the server-encrypted data matches the extracted rolling identifier; and

means for identifying the originator of the received message as the wireless identity transmitter when the server-encrypted data matches the extracted rolling identifier.

39. The server of claim 38, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

40. The server of claim 38, wherein means for incrementing the nonce to represent a current time of the server comprises means for computing the nonce to correspond to a time a proximity broadcast receiver received a broadcast from the wireless identity transmitter based on information included within the message.

41. The server of claim 38, further comprising means for extracting a nonce from the received message, wherein means for encoding the device identifier uses the nonce extracted from the received message.

42. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification information, comprising:

means for initializing a nonce within the wireless identity transmitter;

means for generating a rolling identifier by using a pseudo-random function to encode a device identifier associated with the wireless identity transmitter based on a secret key shared with a server, and the nonce;

means for periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

means for incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

43. The wireless identity transmitter of claim 42, wherein means for generating a rolling identifier by using a pseudo-random function comprises means for concatenating to the device identifier data to be transmitted and using the pseudo-random function to encode the concatenated device identifier and data based on the secret key shared with a server, and the nonce.

44. The wireless identity transmitter of claim 42, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

45. A server configured to securely identify an originator of a message including obscured information, comprising:

means for associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

means for pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

means for receiving the message including a rolling identifier and an encoded nonce;

means for extracting the encoded nonce from the received message;

means for extracting the rolling identifier from the received message;

means for comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

means for decoding the extracted rolling identifier using a streaming-like encryption algorithm, the first secret key, and a nonce associated with a pre-computed encoded nonce matching the extracted encoded nonce to generate a decoded device identifier when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces;

means for decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and the initial nonce associated with the wireless identity transmitter to generate the decoded device identifier when the extracted encoded nonce does not match one of the plurality of pre-computed encoded nonces; and

means for identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier of the wireless identity transmitter.

46. The server of claim 45, wherein the first secret key and the second secret key have the same value.

47. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification information, comprising:

means for initializing a nonce within the wireless identity transmitter;

means for generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with a server, and the nonce with a streaming-like encryption algorithm;

means for generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

means for periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions; and

means for incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

48. A server configured to securely identify an originator of a message, comprising:

means for associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

means for pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

means for pre-computing a plurality of encoded device identifiers using a streaming-like encryption algorithm with the first secret key, the current nonce, and the device identifier;

means for receiving the message including a rolling identifier and an encoded nonce;

means for extracting the encoded nonce from the received message;

means for extracting the rolling identifier from the received message;

means for comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

means for comparing the extracted rolling identifier to the plurality of pre-computed encoded device identifiers when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces; and

means for identifying the originator of the received message as the wireless identity transmitter when the extracted rolling identifier matches any of the plurality of pre-computed encoded device identifiers.

49. A server configured to identify an originator of a message, comprising:

means for generating a plurality of initial model payloads with an encryption algorithm, a shared secret key, an initial nonce, and a device identifier associated with a wireless identity transmitter, wherein the encryption algorithm is shared with the wireless identity transmitter;

means for generating a plurality of current model payloads with the encryption algorithm, the shared secret key, a current nonce, and the device identifier associated with the wireless identity transmitter;

means for receiving the message including a payload with obscured identification information;

means for comparing the payload of the received message to the plurality of current model payloads;

means for identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of current model payloads;

means for comparing the payload of the received message to the plurality of initial model payloads when the payload of the received message does not match any of the plurality of current model payloads;

means for identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of initial model payloads; and

means updating the current nonce associated with the wireless identity transmitter when the payload of the received message matches at least one of an initial model payload and a current model payload.

50. A wireless identity transmitter configured to receive incoming messages, comprising:

means for periodically broadcasting messages that indicate availability for receiving incoming transmissions via short-range wireless transmissions for a first period;

means for receiving a link advertisement message during a second period in response to the first period expiring;

means for negotiating a link with a proximity broadcast receiver based on information within the received link advertisement message;

means for authenticating the negotiated link; and

means for processing incoming messages via the negotiated link,

wherein the negotiated link is performed via Bluetooth pairing.

51. The wireless identity transmitter of claim 50, wherein the incoming messages include at least one of firmware updates, configuration information, trigger signals, and software instructions.

52. The wireless identity transmitter of claim 50, wherein the first period is defined by at least one of a timer on the wireless identity transmitter, clock signals, and a received message from the proximity broadcast receiver.

53. A server configured to securely identify an originator of a message including obscured information, comprising:

a memory; and

a server processor coupled to the memory, wherein the server processor is configured with server processor-executable instructions to perform operations comprising;

associating a shared secret key with a device identifier corresponding to a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier;

determining whether the decoded device identifier matches the device identifier associated with the shared secret key; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier associated with the wireless identity transmitter.

54. The method of claim 53, wherein the message further includes a nonce, and wherein the server processor is configured with server processor-executable instructions to perform operations such that decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier comprises decoding the extracted rolling identifier using a streaming-like encryption algorithm, the nonce extracted from the message and the shared secret key to generate the decoded device identifier.

55. The server of claim 53, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

56. The server of claim 53, wherein the shared secret key has a size of 128 bits.

57. The server of claim 53, wherein the server processor is configured with server processor-executable instructions to perform operations such that decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier further comprises decoding data that was concatenated to the device identifier prior to encryption.

58. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification inform, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter with a streaming-like encryption algorithm using a secret key shared with a server and the nonce;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval.

59. The wireless identity transmitter of claim 58, wherein the periodically broadcast message further includes the nonce.

60. The wireless identity transmitter of claim 58, wherein the nonce represents a non-repeating number generated by the wireless identity transmitter whose value changes each time the device identifier encoding is required to change.

61. The wireless identity transmitter of claim 58, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

62. The wireless identity transmitter of claim 58, wherein the message is a single packet with a size of 80 bits or less and wherein the secret key is 128 bits.

63. The wireless identity transmitter of claim 58, wherein the processor is configured with processor-executable instructions to perform operations such that generating the rolling identifier comprises concatenating to the device identifier data to be transmitted and encoding the concatenated identifier and data with the streaming-like encryption algorithm using the secret key shared with a server and the nonce.

64. A server configured to securely identify an originator of a message including obscured information, comprising:

a memory; and

a server processor coupled to the memory, wherein the server processor is configured with server processor-executable instructions to perform operations comprising;

associating a shared secret key with a nonce and a device identifier for a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

incrementing the nonce to represent a current time of the server;

encoding the device identifier using the shared secret key, the nonce, and a pseudo-random function to generate server-encrypted data;

determining whether the server-encrypted data matches the extracted rolling identifier; and

identifying the originator of the received message as the wireless identity transmitter when the server-encrypted data matches the extracted rolling identifier.

65. The server of claim 64, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

66. The server of claim 64, wherein the server processor is configured with server processor-executable instructions to perform operations such that incrementing the nonce to represent a current time of the server comprises computing the nonce to correspond to a time a proximity broadcast receiver received a broadcast from the wireless identity transmitter based on information included within the message.

67. The server of claim 64, wherein the server processor is configured with server processor-executable instructions to perform operations further comprising extracting a nonce from the received message, wherein encoding the device identifier uses the nonce extracted from the received message.

68. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification information, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a secret key shared with a server, and the nonce with a pseudo-random function;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

69. The wireless identity transmitter of claim 68, wherein the server processor is configured with server processor-executable instructions to perform operations such that generating a rolling identifier by using a pseudo-random function comprises concatenating to the device identifier data to be transmitted and using the pseudo-random function to encode the concatenated device identifier and data based on the secret key shared with a server, and the nonce.

70. The wireless identity transmitter of claim 68, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

71. A server configured to identify an originator of a message including obscured information, comprising:

a memory; and

a server processor coupled to the memory, wherein the server processor is configured with server processor-executable instructions to perform operations comprising;

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

decoding the extracted rolling identifier using a streaming-like encryption algorithm, the first secret key, and a nonce associated with a pre-computed encoded nonce matching the extracted encoded nonce to generate a decoded device identifier when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces;

decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and the initial nonce associated with the wireless identity transmitter to generate the decoded device identifier when the extracted encoded nonce does not match one of the plurality of pre-computed encoded nonces; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier of the wireless identity transmitter.

72. The server of claim 71, wherein the first secret key and the second secret key have the same value.

73. A wireless identity transmitter configured to transmit obscured information to enable one-way communication of identification information, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with a server, and the nonce with a streaming-like encryption algorithm;

generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

74. A server configured to securely identify an originator of a message, comprising:

a memory; and

a server processor coupled to the memory, wherein the server processor is configured with server processor-executable instructions to perform operations comprising;

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

pre-computing a plurality of encoded device identifiers using a streaming-like encryption algorithm with the first secret key, the current nonce, and the device identifier;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

comparing the extracted rolling identifier to the plurality of pre-computed encoded device identifiers when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces;

identifying the originator of the received message as the wireless identity transmitter when the extracted rolling identifier matches any of the plurality of pre-computed encoded device identifiers.

75. A server configured to securely identify an originator of a message, comprising:

a memory; and

a server processor coupled to the memory, wherein the server processor is configured with server processor-executable instructions to perform operations comprising;

generating a plurality of initial model payloads with an encryption algorithm, a shared secret key, an initial nonce, and a device identifier associated with a wireless identity transmitter, wherein the encryption algorithm is shared with the wireless identity transmitter;

generating a plurality of current model payloads with the encryption algorithm, the shared secret key, an current nonce, and the device identifier associated with the wireless identity transmitter;

receiving the message including a payload with obscured identification information;

comparing the payload of the received message to the plurality of current model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of current model payloads;

comparing the payload of the received message to the plurality of initial model payloads when the payload of the received message does not match any of the plurality of current model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of initial model payloads; and

updating the current nonce associated with the wireless identity transmitter when the payload of the received message matches at least one of an initial model payload and a current model payload.

76. A wireless identity transmitter configured to receive incoming messages, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

periodically broadcasting messages that indicate availability for receiving incoming transmissions via short-range wireless transmissions for a first period;

receiving a link advertisement message during a second period in response to the first period expiring;

negotiating a link with a proximity broadcast receiver based on information within the received link advertisement message;

authenticating the negotiated link; and

processing the incoming messages via the negotiated link,

wherein the negotiated link is performed via Bluetooth pairing.

77. The wireless identity transmitter of claim 76, wherein the incoming messages include at least one of firmware updates, configuration information, trigger signals, and software instructions.

78. The wireless identity transmitter of claim 76, wherein the first period is defined by at least one of a timer on the wireless identity transmitter, clock signals, and a received message from the proximity broadcast receiver.

79. A non-transitory server-readable storage medium having stored thereon server-executable instructions configured to cause a server to perform operations for the server to securely identify an originator of a message including obscured information, the operations comprising:

associating a shared secret key with a device identifier corresponding to a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier;

determining whether the decoded device identifier matches the device identifier associated with the shared secret key; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier associated with the wireless identity transmitter.

80. The non-transitory server-readable storage medium of claim 79, wherein the message further includes a nonce, and wherein the stored server-executable instructions are configured to cause a server to perform operations such that decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier comprises decoding the extracted rolling identifier using a streaming-like encryption algorithm, the nonce extracted from the message and the shared secret key to generate the decoded device identifier.

81. The non-transitory server-readable storage medium of claim 79, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

82. The non-transitory server-readable storage medium of claim 79, wherein the shared secret key has a size of 128 bits.

83. The non-transitory server-readable storage medium of claim 79, wherein the stored server-executable instructions are configured to cause a server to perform operations such that decoding the extracted rolling identifier using a streaming-like encryption algorithm, and the shared secret key to generate a decoded device identifier further comprises decoding data that was concatenated to the device identifier prior to encryption.

84. A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, the operations comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter with a streaming-like encryption algorithm using a secret key shared with a server and the nonce;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval.

85. The non-transitory processor-readable storage medium of claim 84, wherein the periodically broadcast message further includes the nonce.

86. The non-transitory processor-readable storage medium of claim 84, wherein the nonce represents a non-repeating number generated by the wireless identity transmitter whose value changes each time the device identifier encoding is required to change.

87. The non-transitory processor-readable storage medium of claim 84, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

88. The non-transitory processor-readable storage medium of claim 84, wherein the message is a single packet with a size of 80 bits or less and wherein the secret key is 128 bits.

89. The non-transitory processor-readable storage medium of claim 84, wherein the stored server-executable instructions are configured to cause a server to perform operations such that generating the rolling identifier comprises concatenating to the device identifier data to be transmitted and encoding the concatenated identifier and data with the streaming-like encryption algorithm using the secret key shared with a server and the nonce.

90. A non-transitory server-readable storage medium having stored thereon server-executable instructions configured to cause a server to perform operations for the server to securely identify an originator of a message including obscured information, the operations comprising:

associating a shared secret key with a nonce and a device identifier for a wireless identity transmitter;

receiving the message including a rolling identifier;

extracting the rolling identifier from the received message;

incrementing the nonce to represent a current time of the server;

encoding the device identifier using the shared secret key, the nonce, and a pseudo-random function to generate server-encrypted data;

determining whether the server-encrypted data matches the extracted rolling identifier; and

identifying the originator of the received message as the wireless identity transmitter when the server-encrypted data matches the extracted rolling identifier.

91. The non-transitory server-readable storage medium of claim 90, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

92. The non-transitory server-readable storage medium of claim 90, wherein the server-executable instructions are configured to cause the server to perform operations such that incrementing the nonce to represent a current time of the server comprises computing the nonce to correspond to a time a proximity broadcast receiver received a broadcast from the wireless identity transmitter based on information included within the message.

93. The non-transitory server-readable storage medium of claim 90, wherein the server-executable instructions are configured to cause the server to perform operations further comprising extracting a nonce from the received message, wherein encoding the device identifier uses the nonce extracted from the received message.

94. A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, the operations comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a secret key shared with a server, and the nonce with a pseudo-random function;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

95. The non-transitory server-readable storage medium of claim 94, wherein the processor-executable instructions are configured to cause a processor to perform operations such that generating a rolling identifier by using a pseudo-random function comprises concatenating to the device identifier data to be transmitted and using the pseudo-random function to encode the concatenated device identifier and data based on the secret key shared with a server, and the nonce.

96. The non-transitory processor-readable storage medium of claim 94, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

97. A non-transitory server-readable storage medium having stored thereon server-executable instructions configured to cause a server to perform operations for the server to securely identify an originator of a message including obscured information, the operations comprising:

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using a streaming-like encryption algorithm, the first secret key, and a nonce associated with a pre-computed encoded nonce matching the extracted encoded nonce to generate a decoded device identifier;

when the extracted encoded nonce does not match one of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and the initial nonce associated with the wireless identity transmitter to generate the decoded device identifier; and

identifying the originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier of the wireless identity transmitter.

98. The non-transitory server-readable storage medium of claim 97, wherein the first secret key and the second secret key have the same value.

99. A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for a wireless identity transmitter to transmit obscured information to enable one-way communication of identification information, the operations comprising:

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with a server, and the nonce with a streaming-like encryption algorithm;

generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter.

100. A non-transitory server-readable storage medium having stored thereon server-executable instructions configured to cause a server to perform operations for the server to securely identify an originator of a message, the operations comprising:

associating a device identifier for a wireless identity transmitter with an initial nonce, a current nonce, a first secret key, and a second secret key;

pre-computing a plurality of encoded nonces using a pseudo-random function with the second secret key and the current nonce;

pre-computing a plurality of encoded device identifiers using a streaming-like encryption algorithm with the first secret key, the current nonce, and the device identifier;

receiving the message including a rolling identifier and an encoded nonce;

extracting the encoded nonce from the received message;

extracting the rolling identifier from the received message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, comparing the extracted rolling identifier to the plurality of pre-computed encoded device identifiers;

identifying the originator of the received message as the wireless identity transmitter when the extracted rolling identifier matches any of the plurality of pre-computed encoded device identifiers.

101. A non-transitory server-readable storage medium having stored thereon server-executable instructions configured to cause a server to perform operations for the server to securely identify an originator of a message, the operations comprising:

generating a plurality of initial model payloads with an encryption algorithm, a shared secret key, an initial nonce, and a device identifier associated with a wireless identity transmitter, wherein the encryption algorithm is shared with the wireless identity transmitter;

generating a plurality of current model payloads with the encryption algorithm, the shared secret key, an current nonce, and the device identifier associated with the wireless identity transmitter;

receiving the message including a payload with obscured identification information;

comparing the payload of the received message to the plurality of current model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of current model payloads;

when the payload of the received message does not match any of the plurality of current model payloads, comparing the payload of the received message to the plurality of initial model payloads;

identifying the wireless identity transmitter when the payload of the received message matches one of the plurality of initial model payloads; and

updating the current nonce associated with the wireless identity transmitter when the payload of the received message matches at least one of an initial model payload and a current model payload.

102. A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for a wireless identity transmitter receiving incoming messages, the operations comprising:

periodically broadcasting messages that indicate availability for receiving incoming transmissions via short-range wireless transmissions for a first period;

receiving a link advertisement message during a second period in response to the first period expiring;

negotiating a link with a proximity broadcast receiver based on information within the received link advertisement message;

authenticating the negotiated link; and

processing incoming messages via the negotiated link,

wherein the negotiated link is performed via Bluetooth pairing.

103. The non-transitory processor-readable storage medium of claim 102, wherein the incoming messages include at least one of firmware updates, configuration information, trigger signals, and software instructions.

104. The non-transitory processor-readable storage medium of claim 102, wherein the first period is defined by at least one of a timer on the wireless identity transmitter, clock signals, and a received message from the proximity broadcast receiver.

105. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a secret key shared with the server, and the nonce with a streaming-like encryption algorithm;

periodically broadcasting a message including the rolling identifier and the nonce using short-range wireless transmissions via the first transceiver; and

incrementing the nonce at a predefined interval, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving the message including the rolling identifier and the nonce from the wireless identity transmitter via the second transceiver;

transmitting to the server via the network device a sighting message that includes the rolling identifier and the nonce, and

wherein the server is configured with server-executable instructions to perform operations comprising;

associating the secret key with the device identifier corresponding to the wireless identity transmitter;

receiving the sighting message including the rolling identifier and the nonce;

extracting the nonce and the rolling identifier from the received sighting message;

decoding the extracted rolling identifier using the streaming-like encryption algorithm, the secret key, and the extracted nonce to generate a decoded device identifier;

determining whether the decoded device identifier matches the device identifier associated with the secret key; and

identifying an originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier associated with the wireless identity transmitter.

106. The system of claim 105, wherein the streaming-like encryption algorithm is an AES-CTR cipher.

107. The system of claim 105, wherein the secret key has a size of 128 bits.

108. The system of claim 105, wherein the nonce represents a non-repeating number generated by the wireless identity transmitter whose value changes each time the device identifier encoding is required to change.

109. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a secret key shared with the server, and the nonce with a pseudo-random function;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions via the first transceiver; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving the message including the rolling identifier from the wireless identity transmitter via the second transceiver;

transmitting to the server via the network device a sighting message that includes the rolling identifier, and

wherein the server is configured with server-executable instructions to perform operations comprising;

associating the secret key with the nonce and the device identifier for the wireless identity transmitter;

receiving the sighting message from the proximity broadcast receiver including the rolling identifier;

extracting the rolling identifier from the received sighting message;

incrementing the nonce to represent a current time of the server;

encoding the device identifier using the secret key, the nonce, and the pseudo-random function to generate server-encrypted data;

determining whether the server-encrypted data matches the extracted rolling identifier; and

identifying an originator of the received message as the wireless identity transmitter when the server-encrypted data matches the extracted rolling identifier.

110. The system of claim 109, wherein the pseudo-random function is one of a Keyed-Hash Message Authentication Code (HMAC) or a Cipher-Based Message Authentication Code (CMAC).

111. The system of claim 109, wherein the server is configured with server-executable instructions to perform operations such that incrementing the nonce to represent a current time of the server comprises computing the nonce to correspond to a time the proximity broadcast receiver received the message from the wireless identity transmitter based on information included within the sighting message.

112. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with the server, and the nonce with a streaming-like encryption algorithm;

generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions via the first transceiver; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving the message including the rolling identifier and the encoded nonce from the wireless identity transmitter via the second transceiver;

transmitting to the server via the network device a sighting message that includes the rolling identifier and the encoded nonce, and

wherein the server is configured with server-executable instructions to perform operations comprising;

associating the device identifier for the wireless identity transmitter with an initial nonce, a current nonce, the first secret key shared with the wireless identity transmitter, and the second secret key;

pre-computing a plurality of encoded nonces using the pseudo-random function with the second secret key and the current nonce;

receiving from the proximity broadcast receiver the sighting message including the rolling identifier and the encoded nonce;

extracting the encoded nonce from the received sighting message;

extracting the rolling identifier from the received sighting message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and a stored nonce that is associated with a pre-computed encoded nonce matching the extracted encoded nonce to generate a decoded device identifier;

when the extracted encoded nonce does not match one of the plurality of pre-computed encoded nonces, decoding the extracted rolling identifier using the streaming-like encryption algorithm, the first secret key, and the initial nonce associated with the wireless identity transmitter to generate the decoded device identifier; and

identifying an originator of the received message as the wireless identity transmitter when the decoded device identifier matches the device identifier of the wireless identity transmitter.

113. The system of claim 112, wherein the first secret key and the second secret key have the same value.

114. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a first secret key shared with the server, and the nonce with a streaming-like encryption algorithm;

generating an encoded nonce by encoding the nonce using a pseudo-random function with a second secret key shared with the server;

periodically broadcasting a message including the rolling identifier and the encoded nonce using short-range wireless transmissions via the first transceiver; and

incrementing the nonce at a predefined interval to maintain a current time of the wireless identity transmitter, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving the message including the rolling identifier and the encoded nonce from the wireless identity transmitter via the second transceiver;

transmitting to the server via the network device a sighting message that includes the rolling identifier and the encoded nonce, and

wherein the server is configured with server-executable instructions to perform operations comprising;

associating the device identifier for the wireless identity transmitter with an initial nonce, a current nonce, the first secret key, and the second secret key;

pre-computing a plurality of encoded nonces using the pseudo-random function with the second secret key and the current nonce;

pre-computing a plurality of encoded device identifiers using the streaming-like encryption algorithm with the first secret key, the current nonce, and the device identifier;

receiving from the proximity broadcast receiver the sighting message including the rolling identifier and the encoded nonce;

extracting the encoded nonce from the received sighting message;

extracting the rolling identifier from the received sighting message;

comparing the extracted encoded nonce to the plurality of pre-computed encoded nonces;

when the extracted encoded nonce matches any of the plurality of pre-computed encoded nonces, comparing the extracted rolling identifier to the plurality of pre-computed encoded device identifiers;

identifying an originator of the received message as the wireless identity transmitter when the extracted rolling identifier matches any of the plurality of pre-computed encoded device identifiers.

115. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

initializing a nonce within the wireless identity transmitter;

generating a rolling identifier by encoding a device identifier associated with the wireless identity transmitter, a secret key shared with the server, and the nonce with a streaming-like encryption algorithm;

periodically broadcasting a message including the rolling identifier using short-range wireless transmissions via the first transceiver; and

incrementing the nonce at a predefined interval, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving the message including the rolling identifier from the wireless identity transmitter via the second transceiver;

transmitting to the server via the network device a sighting message that includes the rolling identifier, and

wherein the server is configured with server-executable instructions to perform operations comprising;

generating a plurality of initial model payloads with the encryption algorithm, the secret key, an initial nonce, and the device identifier associated with the wireless identity transmitter, wherein the encryption algorithm is shared with the wireless identity transmitter;

generating a plurality of current model payloads with the encryption algorithm, the secret key, a current nonce, and the device identifier associated with the wireless identity transmitter;

receiving from the proximity broadcast receiver the sighting message including a payload with obscured identification information;

comparing the payload of the received sighting message to the plurality of current model payloads;

identifying the wireless identity transmitter when the payload of the received sighting message matches one of the plurality of current model payloads;

when the payload of the received sighting message does not match any of the plurality of current model payloads, comparing the payload of the received sighting message to the plurality of initial model payloads;

identifying the wireless identity transmitter when the payload of the received sighting message matches one of the plurality of initial model payloads; and

updating the current nonce associated with the wireless identity transmitter when the payload of the received message matches at least one of an initial model payload and a current model payload.

116. A system, comprising:

a server;

a wireless identity transmitter; and

a proximity broadcast receiver,

wherein the wireless identity transmitter comprises;

a first memory;

a first transceiver configured to broadcast short-range wireless signals capable of being received by the proximity broadcast receiver; and

a first processor coupled to the first memory and the first transceiver, and configured with processor-executable instructions to perform operations comprising;

periodically broadcasting messages that indicate availability for receiving incoming transmissions via short-range wireless transmissions using the first transceiver for a first period;

receiving a link advertisement message during a second period in response to the first period expiring;

negotiating a link with the proximity broadcast receiver based on information within the received link advertisement message, wherein the negotiated link is performed via a Bluetooth pairing;

authenticating the negotiated link; and

processing incoming messages via the negotiated link, and

wherein the proximity broadcast receiver comprises;

a second memory;

a second transceiver configured to exchange short-range wireless signals with the wireless identity transmitter;

a network device configured to exchange signals with the server;

a second processor coupled to the second memory, the second transceiver, and the network device and configured with processor-executable instructions to perform operations comprising;

receiving using the network device a message from the server;

receiving a broadcast message that indicates the availability of the wireless identity transmitter for receiving the incoming transmissions;

transmitting the link advertisement message based on the availability indicated in the received broadcast message;

negotiating the link with the wireless identity transmitter based on the information within the link advertisement message, wherein the negotiated link is performed via the Bluetooth pairing;

authenticating the negotiated link; and

transmitting the message from the server to the wireless identity transmitter via the negotiated link, and

wherein the server is configured with server-executable instructions to perform operations comprising transmitting the message to the proximity broadcast receiver.

117. The system of claim 116, wherein the message transmitted to the wireless identity transmitter includes at least one of firmware updates, configuration information, trigger signals, and software instructions.

118. The system of claim 116, wherein the first period is defined by at least one of a timer on the wireless identity transmitter, clock signals, and a second message from the proximity broadcast receiver.

119. A method for a first communication device communicating with increased security using Bluetooth, comprising:

establishing a communications link with a second communication device;

storing a nonce shared with the second communication device;

receiving a message indicating a rolling Bluetooth machine address via the communications link;

generating an expected Bluetooth machine address of the second communication device using the nonce and an encryption algorithm shared with the second communication device;

comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

processing the received message when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

incrementing the nonce in response to determining that a nonce update is needed.

120. The method of claim 119, further comprising:

changing the nonce by a predefined set of offset values when the rolling Bluetooth machine address of the received message does not match the expected Bluetooth machine address;

generating new expected Bluetooth machine addresses based on the changed nonce for comparisons to the rolling Bluetooth machine address of the received message during a period; and

ignoring the received message when no matches are found during the period.

121. A first communication device configured to communicate with increased security using Bluetooth, comprising:

means for establishing a communications link with a second communication device;

means for storing a nonce shared with the second communication device;

means for receiving a message indicating a rolling Bluetooth machine address via the communications link;

means for generating an expected Bluetooth machine address of the second communication device using the nonce and an encryption algorithm shared with the second communication device;

means for comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

means for processing the received message when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

means for incrementing the nonce in response to determining that a nonce update is needed.

122. The first communication device of claim 121, further comprising:

means for changing the nonce by a predefined set of offset values when the rolling Bluetooth machine address of the received message does not match the expected Bluetooth machine address;

means for generating new expected Bluetooth machine addresses based on the changed nonce for comparisons to the rolling Bluetooth machine address of the received message during a period; and

means for ignoring the received message when no matches are found during the period.

123. A first communication device configured to communicate with increased security using Bluetooth, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured with processor-executable instructions to perform operations comprising;

establishing a communications link with a second communication device;

storing a nonce shared with the second communication device;

receiving a message indicating a rolling Bluetooth machine address via the communications link;

generating an expected Bluetooth machine address of the second communication device using the nonce and an encryption algorithm shared with the second communication device;

comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

processing the received message when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

incrementing the nonce in response to determining that a nonce update is needed.

124. The first communication device of claim 123, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

changing the nonce by a predefined set of offset values when the rolling Bluetooth machine address of the received message does not match the expected Bluetooth machine address;

generating new expected Bluetooth machine addresses based on the changed nonce for comparisons to the rolling Bluetooth machine address of the received message during a period; and

ignoring the received message when no matches are found during the period.

125. A non-transitory processor-readable storage medium having stored thereon processor-executable software instructions configured to cause a processor to perform operations for a first communication device to communicate with increased security using Bluetooth, the operations comprising:

establishing a communications link with a second communication device;

storing a nonce shared with the second communication device;

receiving a message indicating a rolling Bluetooth machine address via the communications link;

generating an expected Bluetooth machine address of the second communication device using the nonce and an encryption algorithm shared with the second communication device;

comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

processing the received message when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

incrementing the nonce in response to determining that a nonce update is needed.

126. The non-transitory processor-readable storage medium of claim 125, wherein the processor-executable software instructions to perform operations further comprising:

changing the nonce by a predefined set of offset values when the rolling Bluetooth machine address of the received message does not match the expected Bluetooth machine address;

generating new expected Bluetooth machine addresses based on the changed nonce for comparisons to the rolling Bluetooth machine address of the received message during a period; and

ignoring the received message when no matches are found during the period.

127. A method for communicating with increased security using Bluetooth, comprising:

establishing, in a first communication device, a communications link with a second communication device;

storing a nonce shared with the second communication device;

generating in the second communication device a rolling Bluetooth machine address using the nonce and an encryption algorithm shared with the first communication device;

transmitting a message from the second communication device to the first communication device using the rolling Bluetooth machine address;

receiving in the first communication device the message indicating the rolling Bluetooth machine address via the communications link;

generating in the first communication device an expected Bluetooth machine address of the second communication device using the nonce and the encryption algorithm shared with the second communication device;

comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

processing the received message in the first communication device when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

incrementing the nonce in response to determining that a nonce update is needed.

128. A system, comprising:

a first communication device, and

a second communication device,

wherein the first communication device comprises;

a first memory; and

a first transceiver configured to broadcast short-range wireless signals capable of being received by the second communication device, and configured with processor-executable instructions to perform operations comprising;

establishing a communications link with the second communication device;

storing a nonce shared with the second communication device;

receiving a message indicating a rolling Bluetooth machine address via the communications link;

generating an expected Bluetooth machine address of the second communication device using the nonce and an encryption algorithm shared with the second communication device;

comparing the rolling Bluetooth machine address of the received message to the expected Bluetooth machine address;

processing the received message when the rolling Bluetooth machine address of the received message matches the expected Bluetooth machine address generated by the first communication device; and

incrementing the nonce in response to determining that a nonce update is needed, and

wherein the second communication device comprises;

a second memory; and

a second transceiver configured to broadcast short-range wireless signals capable of being received by the first communication device, and configured with processor-executable instructions to perform operations comprising;

establishing the communications link with the first communication device;

storing the nonce shared with the first communication device;

generating the rolling Bluetooth machine address using the nonce and the encryption algorithm shared with the first communication device;

transmitting the message to the first communication device using the rolling Bluetooth machine address;

receiving incoming messages from the second communication device via the communications link; and

incrementing the nonce in response to determining that the nonce update is needed.