2,101 research outputs found
SpreadMeNot: A Provably Secure and Privacy-Preserving Contact Tracing Protocol
A plethora of contact tracing apps have been developed and deployed in
several countries around the world in the battle against Covid-19. However,
people are rightfully concerned about the security and privacy risks of such
applications. To this end, the contribution of this work is twofold. First, we
present an in-depth analysis of the security and privacy characteristics of the
most prominent contact tracing protocols, under both passive and active
adversaries. The results of our study indicate that all protocols are
vulnerable to a variety of attacks, mainly due to the deterministic nature of
the underlying cryptographic protocols. Our second contribution is the design
and implementation of SpreadMeNot, a novel contact tracing protocol that can
defend against most passive and active attacks, thus providing strong
(provable) security and privacy guarantees that are necessary for such a
sensitive application. Our detailed analysis, both formal and experimental,
shows that SpreadMeNot satisfies security, privacy, and performance
requirements, hence being an ideal candidate for building a contact tracing
solution that can be adopted by the majority of the general public, as well as
to serve as an open-source reference for further developments in the field
Privately Connecting Mobility to Infectious Diseases via Applied Cryptography
Human mobility is undisputedly one of the critical factors in infectious
disease dynamics. Until a few years ago, researchers had to rely on static data
to model human mobility, which was then combined with a transmission model of a
particular disease resulting in an epidemiological model. Recent works have
consistently been showing that substituting the static mobility data with
mobile phone data leads to significantly more accurate models. While prior
studies have exclusively relied on a mobile network operator's subscribers'
aggregated data, it may be preferable to contemplate aggregated mobility data
of infected individuals only. Clearly, naively linking mobile phone data with
infected individuals would massively intrude privacy. This research aims to
develop a solution that reports the aggregated mobile phone location data of
infected individuals while still maintaining compliance with privacy
expectations. To achieve privacy, we use homomorphic encryption, zero-knowledge
proof techniques, and differential privacy. Our protocol's open-source
implementation can process eight million subscribers in one and a half hours.
Additionally, we provide a legal analysis of our solution with regards to the
EU General Data Protection Regulation.Comment: Added differentlial privacy experiments and new benchmark
- …