Bluetooth Smart (also known as Bluetooth Low Energy) beacons broadcast their
presence in order to enable proximity-based applications by observer devices. This
results in a privacy and security exposure: broadcast devices are typically
susceptible to tracking and spoofing based on the IDs used by the beacons. We
introduce a scheme consisting of cloud-based Ephemeral Identifiers (EID) which
allows only authorized parties to properly identify the beacons broadcast; it
mitigates the basic tracking and security threats while keeping high utility. We
outline a formal model of privacy which is obtained with our scheme, present its
implementation, and discuss possible extensions. The proposal outlined here is the
basis for Google’s Eddystone standard, supported by some thirty industry partners.
We supply an open source implementation for all the components of the system.