[论文解读] WeTrace -- A Privacy-preserving Mobile COVID-19 Tracing Approach and Application

A. De Carli, Muriel Figueredo Franco+6 more|arXiv (Cornell University)|Apr 19, 2020

Bluetooth and Wireless Communication Technologies参考文献 9被引用 29

一句话总结

WeTrace 提出了一种使用蓝牙低功耗（BLE）和非对称密码学的隐私保护型移动接触追踪系统，实现安全、去中心化的暴露记录。它确保接收者能够验证消息是发给自己的，而不会暴露发送者的身份，从而抵抗去匿名化攻击和暴力破解攻击——提供了一个完全分布式、开源的解决方案，在保护用户隐私的同时支持疫情防控。

ABSTRACT

For the protection of people and society against harm and health threats -- especially for the COVID-19 pandemic -- a variety of different disciplines needs to be involved. The data collection of very basic and health-related data of individuals in today's highly mobile society does help to plan, protect, and identify next steps health authorities and governments can, shall, or need to plan for or even implement. Thus, every individual, every human, and every inhabitant of the world is the key player -- very different to many past crises'. And since the individual is involved -- all individuals -- his/her (a) health and (b) privacy shall be considered in a very carefully crafted balance, not overruling one aspect with another one or even prioritizing certain aspects. Privacy remains the key. Thus, the solution of the current pandemic's data collection can be based on a fully privacy-preserving application, which can be used by individuals on their mobile devices, such as smartphones, while maintaining at the same time their privacy. Additionally, respective data collected in such a fully distributed setting does help to confine the pandemic and can be achieved in a democratic and very open, but still and especially privacy-protecting world. Therefore, the WeTrace approach and application as described in this paper utilizes the Bluetooth Low Energy (BTE) communication channel, many modern mobile devices offer, where asymmetric cryptography is being applied to allows for the decyphering of a message for that destination it had been intended for. Since literally every other potential participant only listens to random data, even a brute force attack will not succeed. WeTrace and its Open Source implementation is the only known approach so far, which ensures that any receiver of a message knows that this is for him/her, but does not know who the original sender was.

研究动机与目标

• 开发一种在新冠疫情背景下维护用户隐私而不损害公共卫生有效性的接触追踪解决方案。
• 解决在移动去中心化系统中平衡个人健康数据收集与严格隐私保护这一关键挑战。
• 设计一种系统，使接收者能够验证消息的真实性，而无需暴露发送者的身份，即使在对抗性条件下亦如此。
• 创建一种完全去中心化、开源的应用程序，可在标准移动设备上运行，无需依赖集中式数据存储。
• 通过利用能够隐藏发送者身份的密码技术，确保系统对去匿名化攻击（包括暴力破解）具有抵抗力。

提出的方法

• 使用蓝牙低功耗（BLE）作为移动设备之间近距离检测的主要通信通道。
• 采用非对称密码学加密消息，使得只有预期的接收者才能解密，从而确保消息机密性。
• 设计协议，使每个消息接收者能够验证消息是发给自己的，但无法确定发送者的身份。
• 确保即使攻击者截获消息，也无法通过密码学手段将消息与发送者关联起来。
• 实施完全去中心化的架构，无中央服务器存储用户数据或日志，从而保护数据本地性并最小化攻击面。
• 利用开源实现，确保系统设计与执行的透明性、可审计性以及社区驱动的信任。

实验结果

研究问题

• RQ1 如何在不依赖集中式数据收集的情况下，以去中心化、隐私保护的方式实现接触追踪？
• RQ2 哪些密码机制可以确保只有预期接收者能解密消息，同时保持发送者身份匿名？
• RQ3 是否可以设计一种系统，即使在被动监听或暴力破解攻击下，发送者身份仍无法被追踪？
• RQ4 如何有效利用蓝牙低功耗（BLE）进行近距离检测，同时保持强大的隐私保障？
• RQ5 完全去中心化、开源的移动应用程序在多大程度上能同时实现公共卫生效用和强大的用户隐私？

主要发现

• WeTrace 成功实现了接触追踪系统，确保接收者身份可验证，而发送者身份完全匿名。
• 结合 BLE 使用非对称密码学，确保即使消息被截获，也无法将其与原始发送者关联。
• 由于消息仅针对特定接收者加密，且未经授权方无法解密，系统对暴力破解攻击具有抵抗力。
• 该架构完全去中心化，无需中央机构存储或处理用户数据。
• 开源实现确保了透明性与可审计性，增强了对系统隐私保障的信任。
• WeTrace 是迄今为止唯一已知能够通过确保任何参与者（包括接收者）都无法追溯消息来源来实现端到端隐私保护的接触追踪方法。