Architecture
Everything converges, and nothing is retained
The matching happens on the anchor, locally and offline. No server is told where anybody was, because no server is ever sent a position.
The design problem is to let a fixed installation establish that an enrolled device is present without learning which device, and without any server accumulating a movement history for anyone. The cryptographic shape has been deployed at national scale before [19]. One bit of it has to be inverted, and that inversion is the whole design.
What changed on this page
An earlier version described the matching happening on a device in the child's pocket, against a list of keys published openly each day so that any receiver could check them offline. That design worked, and it created a proximity oracle available to anybody who cared to build a receiver - a problem set out in the threat model. Under the anchored model the matching moves to the anchor, the distributed set expires in minutes rather than days, and it goes to contracted installations rather than to the public.
The flow
The dashed red line is the point of the whole architecture: it is a path that does not exist. No component in this flow accumulates where anybody has been. A guardian, an officer, an operator, and an attacker who takes the entire service all learn the same thing about a child's movements, which is nothing - not because access to the history is controlled, but because the history was never written.
The scheme
A key a day, an identifier every ten minutes
Neither one carries a name, and yesterday's identifiers cannot be linked to today's without the key that generated them.
The key hierarchy
DEK 32 bytes, generated at enrollment inside the wearable's
secure element. Never exported. Its PUBLIC half is deposited
with an independent key custodian, organizationally separate
from BOTH the operator and the supervising agency.
DBK_i < HKDF-SHA256( DEK, salt = day_i, info = "AZP-DBK", 16 )
RPI_i,j < AES-128( DBK_i, pad( "AZP-RPI" || interval_j ) )
rotated every 10 minutes, in lockstep with BLE MAC
randomization, so the radio address and the payload
identifier never rotate at different timesRotating the identifier and the radio address together is not a detail. An identifier that rotates while the underlying hardware address stays put is not rotating at all - the address carries the linkage the identifier was rotated to break. They change on the same edge, or the scheme is decorative.
The departure from exposure notification
Exposure notification is retrospective by construction, and deliberately so. Matching there requires the counterparty's key, which is published only after that person voluntarily declares, and the match runs as a batch job over a rolling buffer of the past fortnight. There is no point anywhere in that protocol at which a device learns, at the moment of encounter, that a counterparty is nearby. Destroying exactly that property is what the protocol was designed to do.
This design inverts one bit of it. An anchor holds a current-interval enrollment set: the identifiers valid for the present ten-minute window across all enrolled devices, pushed hourly, containing no identities and no history. An anchor can therefore determine that an observed identifier belongs to an enrolled device immediately, locally and offline - without learning which device, and without contacting any server.
Design decision D-2
Set membership is local and real-time. Identity is remote, authorized and logged.
That is the whole architecture in one sentence, and it is the honest version of "tokenized so nobody can zero in on a certain individual". The alarm can fire, and a guardian can be notified, while the system still does not know who was detected. Learning which person an identifier belongs to requires both a judicial order and the independent key custodian - the operator holds observations without keys, the custodian holds keys without observations, and neither, acting alone, can produce a name.
What it costs is worth stating in the same breath. The set reveals how many devices are enrolled. Publishing any long-window key retroactively links every identifier derived from it. And an anchor operator who watches a person while capturing their identifier has bound the two together by direct observation, which no cryptography prevents [28]. This is a pseudonymous system with a trusted matching party. It is not an anonymous one, and it should not borrow the vocabulary of one.
Key derivation
HKDF-SHA256 and AES-128, computed by your browser's WebCryptoThe derivation above is the real one, run by your browser: HKDF-SHA256 for the daily broadcast key and a single AES-128 block for the rotating identifier, exactly as the key hierarchy specifies. The enrollment key in the control is a stand-in - in a fielded device it is generated inside a secure element and cannot be typed in or read out, which is the entire point of it. Change the day and the broadcast key changes completely, which is what makes yesterday's broadcasts unlinkable to today's. Change the interval and the identifier changes while the key stays the same: an anchor holding the set still matches it, and an observer cannot follow one identifier to the next. The size of the interval set is what decides whether this is practical, and it is small - an anchor holds the identifiers valid right now, not a fortnight of history.
Retention
| Record | Where it lives | How long | Who can read it |
|---|---|---|---|
| T0 observations | The anchor, locally | 72 hours, rolling | Nobody. Not transmitted, not synced, not backed up |
| Current-interval enrollment set | The anchor, locally | The present 10-minute interval, refreshed hourly | The contracted anchor operator - no identities and no history are in it |
| T1 queue entries | Supervising agency | Per supervision record rules | The supervising officer; no identity resolved |
| T2 notifications | Guardian device | 90 days | Guardian; no identity, ever |
| T3 encounter record | Case system | Per jurisdiction's evidence rules | Officer, subject, subject's counsel - every read logged |
| Identity resolution | Immutable audit log | Beyond the life of the program | Independent reviewers - who asked, under what authority, what was disclosed, what came of it |
What the supervision authority never receives
Not a position, not a track, not a heat map, not a count of encounters that did not escalate. It receives enrollment status changes and the tiers the ladder actually raised. If the authority wants aggregate statistics it has to ask for them as a deliberate, separately authorized collection - not harvest them as a side effect of the alerting system. There is a real cost to that, and it should be planned for rather than discovered: a privacy-preserving protocol is hard to evaluate precisely because it holds nothing, and the same property was identified as an obstacle to measuring whether exposure-notification apps worked at all. Instrument for measurability deliberately, or lose the ability to know whether the system does anything.
How this works
1:12 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | The problem | The problem is to let a fixed anchor establish that an enrolled device is present, without learning which device, and without any server building a movement history for anyone. |
| 0:13 | The scheme | A key a day, an identifier every ten minutes. The daily key comes from an enrollment key that never leaves the wearable, and the identifier rotates in step with the radio address. |
| 0:24 | Matched locally | The anchor holds the identifiers valid for the present ten minutes, pushed hourly, carrying no names and no history. It matches them locally and offline. It learns that, never who. |
| 0:36 | What never happens | No position ever reaches a server. A guardian, an officer, an operator, and an attacker holding the whole service learn the same thing about a child's movements. Nothing. |
| 0:47 | The honest cost | It is pseudonymous, not anonymous. The set reveals how many devices are enrolled, and an operator who watches a person while capturing their identifier has bound the two by eye. |
| 0:58 | It runs here | The derivation runs on this page with real WebCrypto. Change the day and the key changes completely. Change the interval and the identifier changes while the key stays put. |