I am building a system to collect a unique identifier (MAC addresses from 802.11 probe requests). The system will have several collection points over a large area, submitting to a central database. I want to do traffic analysis without allowing a known MAC address to be mapped to the points where it was seen.
- Anonymize the MAC addresses the same way for each device, to allow tracking of an anonymous device over time, regardless of which collection point sees the device.
- Anonymize in such a way that an attacker with a user's MAC address and a copy of the database can't trace the user's movements.
- Ideally, the addresses are secret from shortly after the moment of collection and unknown even to me (I can be considered an attacker, especially by the users being collected).
It's like I'm designing a web service where the username and password are the same. Anywhere I store instructions for generating the hashed MAC address (either a per-address salt or a general hashing instruction) I'm providing an attacker with the means to de-anonymize users.
Could I encrypt the MAC addresses using a public key for which I don't have the private key? That's really just a fancy way of hashing, and considering there are only 334 billion addresses in the registered IEEE namespace (considerably fewer for common manufacturers like Samsung and Apple), it's only partly resistant to attack.
I'm just not sure where to go from here, except to start making security tradeoffs.