[论文解读] Tracking and Controlling the Spread of a Virus in a Privacy-Preserving Way

Didem Demirağ, Erman Ayday|arXiv (Cornell University)|Mar 29, 2020

Privacy-Preserving Technologies in Data参考文献 11被引用 7

一句话总结

本文提出了一种基于安全私有集合交集（PSI）的隐私保护接触追踪系统，通过比对智能手机本地存储的物理接触历史与集中式已诊断患者身份数据库，实现隐私保护。该方案保护了健康个体与感染者的定位隐私，确保患者身份对他人保密，仅授权人员可接收风险警告信息，且不会向卫生机构暴露敏感数据。

ABSTRACT

Today, tracking and controlling the spread of a virus is a crucial need for almost all countries. Doing this early would save millions of lives and help countries keep a stable economy. The easiest way to control the spread of a virus is to immediately inform the individuals who recently had close contact with the diagnosed patients. However, to achieve this, a centralized authority (e.g., a health authority) needs detailed location information from both healthy individuals and diagnosed patients. Thus, such an approach, although beneficial to control the spread of a virus, results in serious privacy concerns, and hence privacy-preserving solutions are required to solve this problem. Previous works on this topic either (i) compromise privacy (especially privacy of diagnosed patients) to have better efficiency or (ii) provide unscalable solutions. In this work, we propose a technique based on private set intersection between physical contact histories of individuals (that are recorded using smart phones) and a centralized database (run by a health authority) that keeps the identities of the positive diagnosed patients for the disease. Proposed solution protects the location privacy of both healthy individuals and diagnosed patients and it guarantees that the identities of the diagnosed patients remain hidden from other individuals. Notably, proposed scheme allows individuals to receive warning messages indicating their previous contacts with a positive diagnosed patient. Such warning messages will help them realize the risk and isolate themselves from other people. We make sure that the warning messages are only observed by the corresponding individuals and not by the health authority. We also implement the proposed scheme and show its efficiency and scalability via simulations.

研究动机与目标

• 解决通过及时接触追踪控制病毒传播的迫切需求。
• 缓解集中式接触追踪系统中有效疫情控制与隐私侵犯之间的矛盾。
• 防止已诊断患者的个人身份暴露给其他个体及公众。
• 确保仅风险个体接收针对性警告，且不暴露其身份或接触信息。
• 设计一种可扩展且高效的解决方案，避免先前方法存在的性能瓶颈或隐私缺陷。

提出的方法

• 利用安全私有集合交集（PSI）协议，比对智能手机存储的接触历史与集中式已诊断患者标识符数据库。
• 使用密码学技术将物理接触日志本地存储于用户智能手机，以保护定位隐私。
• 确保卫生机构仅能得知用户接触历史与已诊断患者列表之间是否存在匹配，而无法获知匹配用户的身份。
• 仅向其接触历史与已诊断患者身份匹配的个体发送警告信息，并确保这些信息仅对收件人可见。
• 使用密码学原语防止卫生机构查看警告信息内容或将其与特定个体关联。
• 通过仿真实现并评估该方案，以证明其在大规模人群中的效率与横向可扩展性。

实验结果

研究问题

• RQ1 接触追踪系统能否在实现有效疫情预警的同时，保护健康个体与已诊断患者的隐私？
• RQ2 如何以可扩展且高效的方式隐藏患者身份，使其不被其他个体及卫生机构知晓？
• RQ3 私有集合交集在不暴露敏感数据的前提下，能在多大程度上安全匹配接触历史？
• RQ4 系统能否确保仅与高风险个体有接触的用户接收到警告，且警告信息不被卫生机构观测？
• RQ5 在现实仿真条件下，所提方案的性能与可扩展性如何？

主要发现

• 所提方案成功保护了接触追踪过程中健康个体与已诊断患者的定位隐私。
• 已诊断患者的个人身份对除卫生机构外的所有人保持隐藏，且卫生机构亦无法获知与之接触者的身份。
• 警告信息仅发送给曾与已诊断患者密切接触的个体，且仅对收件人可见。
• 卫生机构无法查看警告信息内容，也无法将其与特定用户关联，从而确保端到端隐私。
• 仿真结果表明，该系统具备高效率与良好的横向可扩展性，支持大规模部署。
• 该方案避免了集中式系统的隐私缺陷，也克服了以往隐私保护方法的可扩展性限制。