Tech —

Google’s Eddystone beacons offer a privacy-focused way to track your stuff

Google's bluetooth beacon hopes to bring the Internet of Things to all your things.

Google’s Eddystone beacons offer a privacy-focused way to track your stuff
Google

About a year ago, Google announced "Eddystone," an open source, cross-platform Bluetooth LE beacon format. The Internet of Things initiative is a competitor to Apple's iBeacon, but it ups the ante by working on both Android and iOS and offering a wider selection of data payloads. Eddystone has been primarily focused on business and the enterprise, but today Google is providing more details on the secure beacon mode that it hopes will find its way into consumer goods.

Eddystone has four different frame types. Like iBeacon, there's the Universally Unique Identifier (UUID) payload, a 128-bit value that uniquely identifies every beacon in the world. The value itself isn't of much value unless you have an app from the beacon owner that knows to look for that specific beacon and do something with it. Imagine a Starbucks beacon that gets picked up by the Starbucks app and identifies itself as being at that specific store location.

For something a little more independent, there's the URL payload. The beacon beams a URL to every device in earshot that users can tap on to load a webpage. This is great for "one time" transactions where using an app would cause too much friction, like viewing a bus stop schedule or beaming money to a vending machine from your phone.

For companies that need to manage tons of beacons, there's a "telemetry data" mode, which beams battery levels and other diagnostic data to the owner. This can all be merged into a big dashboard app, making beacon deployment and upkeep easier.

The final mode, the one Google is detailing today, is the Ephemeral Identifiers (EIDs) mode. An EID is a secure beacon format that is meant to only talk to the owner without leaking any identifiable or traceable information to the outside world. The first three formats are public broadcasts geared toward business transactions, dispersing information, advertising, and enterprise use, but EIDs are targeted at consumer usage thanks to the security and access controls.

One use for EIDs is as Bluetooth trackers for your stuff. Toss a bluetooth tracker on your keys or suitcase and you'll know when it's in range. This use would compete with other devices like a Motorola Keylink or Tile. Most of the existing trackers on the market are just Bluetooth devices with a primary objective of "advertise and pair with something" which could allow a third-party to track or log your movement via the signal. EIDs are designed to only be trackable by the people with permission.

The "Ephemeral" part of "Ephemeral Identifiers" refers to the AES-encrypted, eight-byte identifier that changes pseudo-randomly. The developer sets roughly how often the beacon's ID changes—anywhere from every second to once every nine hours. When the Beacon is provisioned, a key is shared with the owner and the beacon, which is used to generate the changing ID. Even if a third party receives a single encrypted identifier, there's no way to turn them into useful information since the identifier changes all the time. This is all open source, so if you're looking for extremely detailed technical specifications, head over to the Eddystone GitHub page.

Google

Understanding the signal means signing up with a "resolution service" like the Google Cloud Platform's Proximity Beacon API. This cloud-based service synchronizes your client and the beacon, making sure everyone changes IDs at the right time and sets up rules about who can access what. If you don't want to use Google's cloud service, it's also entirely possible to come up with your own resolution service and configure Eddystone beacons to use it.

With this security in place, Eddystone-EIDs allow for the exchange of information. The other frame types are one-way broadcasts, but EIDs can receive information from the user, too. In a "car key locator" use case, this could be something like causing a signal to start beeping so you can find your keys.

With Eddystone, Google is only offering integrators the beacon technology. It's leaving branding up to the companies selling the products, which could make identifying Eddystone devices on the market a challenge. Apps are also up to the companies selling the devices, so you would need separate apps for your suitcase, your car keys, your bike, and whatever else you buy with Eddystone embedded.

Google has a couple of companies as launch partners. Samsonite has an Eddystone suitcase that allows users to securely keep track of their luggage. The Washington Wizards and Capitals use Eddystone beacons to deliver customer rewards. Standalone beacons are also available from several manufacturers.

Channel Ars Technica