Toward a Secure Crowdsourced Location Tracking System

TL;DR

This paper analyzes security flaws in existing crowdsourced Bluetooth tracking systems and proposes SECrow, a new design that enhances security and privacy while maintaining practicality.

Contribution

It identifies common security flaws in current systems and introduces SECrow, a novel secure design for crowdsourced location tracking.

Findings

SECrow is practical and secure.

Existing systems have significant security flaws.

SECrow effectively protects user privacy.

Abstract

Low-energy Bluetooth devices have become ubiquitous and widely used for different applications. Among these, Bluetooth trackers are becoming popular as they allow users to track the location of their physical objects. To do so, Bluetooth trackers are often built-in within other commercial products connected to a larger crowdsourced tracking system. Such a system, however, can pose a threat to the security and privacy of the users, for instance, by revealing the location of a user's valuable object. In this paper, we introduce a set of security properties and investigate the state of commercial crowdsourced tracking systems, which present common design flaws that make them insecure. Leveraging the results of our investigation, we propose a new design for a secure crowdsourced tracking system (SECrow), which allows devices to leverage the benefits of the crowdsourced model without sacrificing security and privacy. Our preliminary evaluation shows that SECrow is a practical, secure, and effective crowdsourced tracking solution