Privacy-preserving large-scale location monitoring

A method for monitoring locations of a plurality of peripheral devices by a location-monitoring system, an individual peripheral device being configured to broadcast an advertising signal containing a broadcasting address indicative to an identity resolving key (IRK) that represents a status of the individual peripheral device, the system comprising a plurality of monitoring hosts and a server communicable with the monitoring hosts, each of the monitoring hosts being configured to scan the advertising signal broadcast from the individual peripheral device, the method comprising:

• when the individual peripheral device registers itself to the system, setting up a bond between the individual peripheral device and an interfacing host selected from the monitoring hosts;
• retrieving, by the interfacing host, one or more pre-selected IRKs of the individual peripheral device, wherein the one or more pre-selected IRKs include a device-specific IRK and a group IRK, the device-specific IRK being uniquely used by the individual peripheral device, the group IRK being shared by a group of peripheral devices including the aforesaid individual peripheral device;
• sending, by the interfacing host, the one or more pre-selected IRKs to the server, so as to register the one or more pre-selected IRKs of the individual peripheral device to the server, whereby registration of the one or more pre-selected IRKs to the server enables the system to track the location of the individual peripheral device;
• propagating, by the server, the one or more pre-selected IRKs received from the interfacing host to all the monitoring hosts other than the interfacing host;
• and
• configuring the individual peripheral device such that:
• when the individual peripheral device allows the location and an identity thereof to be detected by the system, the IRK corresponding to the broadcasting address in the advertising signal broadcast by the individual peripheral device is the device-specific IRK, whereby in detecting the location of the individual peripheral device, the device-specific IRK being uniquely used by the individual peripheral device enables the system to determine the identity of the individual peripheral device as well;
• and
• when the individual peripheral device allows the location thereof to be detected by the system but disallows the identity of the individual peripheral device to be revealed to the system, the IRK corresponding to the broadcasting address in the advertising signal broadcast by the individual peripheral device is the group IRK, whereby in detecting the location of the individual peripheral device, the group IRK being shared by the group of peripheral devices prevents the system to uniquely determine the identity of the individual peripheral device.