Smart beacon data security

• US 9,608,999 B2
• Filed: 12/02/2014
• Issued: 03/28/2017
• Est. Priority Date: 12/02/2014
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Somani, Avishek, Raina, Sunil
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US14/557,551
• Publication Number:
  US 20160156638A1
• Time in Patent Office: 847 Days
• US Class Current: 1/1
• CPC Class Codes: G01S 1/68 Marker, boundary, call-sign, or like beacons transmitting signals not carrying directional information
• CPC Class Codes: G06Q 30/0261 based on user location
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 12/75 Temporary identity
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A secure beacon-based system includes beacons that may generate dynamic beacon identifiers. A mobile device application may send a request to an application server, including a dynamic beacon identifier. The application server can locally compute the dynamic beacon identifier and compare it to the received beacon identifier to validate the request and determine whether to respond to the request.

Claims

1. A secure beacon-based system comprising:

a plurality of beacons, wherein each beacon of the plurality of beacons, is located in a sub-location of a geographic area, and

each beacon includes hardware comprising dynamic beacon identifier (ID) generation logic, a data storage, and a short-distance transmitter,

wherein the dynamic beacon ID generation logic generates a beacon ID based on information in the data storage, and at least a portion of the beacon ID is dynamic and is varied at intervals or at least a portion of a payload of a beacon message is dynamic and is varied at intervals, and the short-distance transmitter periodically transmits the beacon ID,

wherein the dynamic beacon ID generation logic generates the dynamic portion of the beacon ID or the dynamic payload based on at least one beacon ID calculation function, and an application server stores the at least one beacon ID calculation function to locally compute the dynamic portion of the beacon ID or the dynamic payload, and

wherein each beacon determines input parameters for the at least one beacon ID calculation function, and at least one of the input parameters is a variable input parameter that varies per interval causing an output of the at least one beacon ID calculation function to vary per interval, and the application server determines the same input parameters to locally compute an output of the at least one beacon ID calculation function; and

a mobile application executed by a mobile device, wherein the mobile application receives the beacon ID of a beacon of the plurality of beacons via a short-distance communication interface of the mobile device, and

the mobile application;

determines presence parameters associated with presence of the mobile device at the sub-location of the beacon;

determines whether to send a request to the application server based on the presence parameters;

in response to determining to send the request, generates the request, wherein the request includes the beacon ID comprising at least the dynamic portion; and

sends the request via a network interface of the mobile device to the application server,

wherein the application server receives the request via a network, locally computes the beacon ID comprising at least the dynamic portion based on the at least one beacon ID calculation function, compares the beacon ID from the request with the locally computed beacon ID, and determines whether the mobile device is located near the beacon based on the comparison.

2. The secure beacon-based system of claim 1, wherein the input parameters comprise at least a plurality of date, time, beacon location, beacon sub-location, beacon specific key, vendor specific key, government assigned geographic information, and beacon hardware specific information.

3. The secure beacon-based system of claim 1, wherein the variable input parameter comprises time or a periodically generated code that varies per interval.

4. The secure beacon-based system of claim 1, wherein the at least one beacon ID calculation function comprises a plurality of beacon ID calculation functions, and the beacon ID calculation functions are logically connected in a serial sequence, wherein an output of one of the beacon ID calculation functions is an input to another one of the beacon ID calculation functions.

5. The secure beacon-based system of claim 4, wherein the serial serial sequence of the logically connected beacon ID calculation functions is varied to vary the beacon ID per interval.

6. The secure beacon-based system of claim 1, wherein to compare the beacon ID from the request with the locally computed beacon ID, the application server determines whether the beacon ID from the request matches the locally computed beacon ID.

7. The secure beacon-based system of claim 6, wherein the application server sends information to the mobile application related to the beacon via the network if the beacon ID from the request matches the locally computed beacon ID;

and

the application server ignores the request if the beacon ID from the request does not match the locally computed beacon ID.

8. The secure beacon-based system of claim 1, wherein the data storage of the beacon comprises a secure storage, and information unique to the beacon or unique to a group of the beacons is stored in the secure storage and is retrieved by the dynamic beacon ID generation logic to calculate the beacon ID.

9. A method for mobile application validation, the method comprising:

receiving, at an application server, a request from a mobile application, wherein the request is associated with a beacon and includes a dynamic beacon ID or a dynamic payload of a message received, from the beacon, by a mobile device hosting the mobile application, and

wherein the dynamic beacon ID or the dynamic payload is calculated based on at least one beacon ID calculation function, and the beacon determines input parameters for the at least one beacon ID calculation function, and at least one of the input parameters is a variable input parameter that varies per interval causing an output of the at least one beacon ID calculation function to vary per interval;

in response to receiving the request, computing, by a processor at the application server, a locally computed beacon ID or payload, wherein the computing at the application server the locally computed beacon ID or payload comprises;

storing the at least one beacon ID calculation function at the application server;

determining the same input parameters used to calculate the dynamic beacon ID or a dynamic payload in the request;

computing, by the processor of the application server, the locally computed beacon ID or payload based on the stored at least one beacon ID calculation function and the same input parameters;

comparing the locally computed beacon ID or payload with the received dynamic beacon ID or payload;

determining whether the request from the mobile application is validated based on the comparing;

responding to the request with information associated with the location of the beacon if validated; and

ignoring the request if not validated.

10. The method of claim 9, wherein determining whether the request from the mobile application is validated comprises:

determining whether the locally computed beacon ID or payload matches the dynamic beacon ID or payload.

11. The method of claim 9, wherein the mobile device is determined to be at a sub-location of the beacon if the locally computed beacon ID or payload matches the dynamic beacon ID or payload.

12. A secure beacon-based system comprising:

a plurality of beacons, wherein each beacon of the plurality of beacons is located in a sub-location of a geographic area, and each beacon periodically broadcasts a beacon ID via a short-distance transmitter;

a mobile application executed by a mobile device, wherein the mobile application;

receives the beacon ID of a beacon of the plurality of beacons via a short-distance communication interface of the mobile device;

determines presence parameters associated with presence at the sub-location of the beacon;

determines whether to enter a peripheral mode based on the presence parameters; and

in response to determining to enter the peripheral mode, broadcasts a peripheral mode signal announcing the presence of the mobile application,

wherein the peripheral mode signal includes a peripheral mode ID, and at least a portion of the peripheral mode ID is dynamic and is varied at intervals, wherein the mobile application generates the peripheral mode ID based on at least one calculation function, wherein the mobile application determines input parameters for the at least one calculation function, and wherein at least one of the input parameters is a variable input parameter that varies per interval causing an output of the at least one calculation function to vary per interval; and

a zone computer located in the geographic location of the plurality of beacons, wherein the zone computer;

receives the peripheral mode signal, that includes the peripheral mode ID;

determines whether the mobile device is in an area of validation of the zone computer;

in response to determining the mobile device is in the area of validation, sends a message to the mobile application to authenticate the mobile application,

wherein to send the message to the mobile application to authenticate the mobile application, the zone computer;

stores the at least one calculation function;

determines the same input parameters used to calculate the peripheral mode ID at the mobile application;

computes, by a processor, a locally computed peripheral mode ID based on the stored at least one calculation function and the same input parameters;

compares the received peripheral mode ID with the locally computed peripheral mode ID to invoke authentication of the mobile application; and

in response to the authentication of the mobile application, sends a single-use code to the mobile application, wherein the single-use code is calculated according to a code generation function;

wherein the mobile application receives the code from the zone computer via the short-distance communication interface of the mobile device and sends a request, including the single-use code and the beacon ID, to an application server via a network interface of the mobile device, and

wherein the application server;

receives the request via a network;

generates a locally computed single-use code according to the code generation function;

compares the locally computed single-use code with the single-use code in the request to validate the request from the mobile application;

if validated, sends information to the mobile application via the network in response to the request; and

if not validated, ignores the request.

13. The secure beacon-based system of claim 12, wherein to compare the locally computed single-use code with the single-use code in the request, the application server determines whether the single-use code from the request matches the locally computed single-use code.

14. The secure beacon-based system of claim 12, wherein to validate the mobile application, the application server determines whether the code in the request is related to the beacon ID in the request.

15. The secure beacon-based system of claim 12, wherein the zone computer ignores the authentication of the mobile application if the received peripheral mode ID does not match the locally computed peripheral mode ID.

16. A secure beacon-based system comprising:

a plurality of beacons, wherein each beacon of the plurality of beacons is located in a sub-location of a geographic area, and each beacon periodically broadcasts a beacon ID via a short-distance transmitter;

a mobile application executed by a mobile device, wherein the mobile application receives the beacon ID of a beacon of the plurality of beacons via a short-distance communication interface of the mobile device,

wherein the mobile application;

determines presence parameters associated with presence at the sub-location of the beacon;

determines whether to enter a peripheral mode based on the presence parameters;

in response to determining to enter the peripheral mode, broadcasts a peripheral mode signal including at least one of service or characteristic of the mobile application, the peripheral mode signal including a peripheral mode ID, and wherein at least a portion of the peripheral mode ID is dynamic and is varied at intervals;

generates the peripheral mode ID based on at least one calculation function;

determines input parameters for the at least one calculation function, wherein at least one of the input parameters is a variable input parameter that varies per interval causing an output of the at least one calculation function to vary per interval; and

a zone computer located in the geographic location of the plurality of beacons, wherein the zone computer;

receives the peripheral mode signal including the peripheral mode ID;

determines whether the mobile device is in an area of validation of the zone computer; and

in response to determining the mobile device is in the area of validation, sends a message to the mobile application to authenticate the mobile application,

wherein to send the message to the mobile application to authenticate the mobile application, the zone computer;

stores the at least one calculation function;

determines the same input parameters used to calculate the peripheral mode ID at the mobile application;

computes, by a processor, a locally computed peripheral mode ID based on the stored at least one calculation function and the same input parameters;

compares the received peripheral mode ID with a locally computed peripheral mode ID to invoke authentication of the mobile application; and

in response to the authentication of the mobile application, sends information to the mobile application, wherein the information is associated with the mobile device being at a location of the beacon.

17. The secure beacon-based system of claim 16, wherein at least one of the plurality of beacons is incorporated in the zone computer.