WO2021204313A1

WO2021204313A1 - Privacy-maintaining tracking system

Info

Publication number: WO2021204313A1
Application number: PCT/DE2021/000059
Authority: WO
Inventors: Georg Carle; Johann Schlamp
Original assignee: Georg Carle; Johann Schlamp
Priority date: 2020-04-05
Filing date: 2021-04-04
Publication date: 2021-10-14
Also published as: DE102020002148A1; EP4136860A1

Abstract

The invention relates to a tracking system which enables the collection of information about persons who are present at a specific time at a specific location, which system uses a mobile communication device (e.g. a smartphone), encrypts the presence information and transmits it in a privacy-protecting form to a tracking data provider. The system uses markers (for example QR code markers) which contain a Uniform Resource Locator (URL). Selected locations are provided with markers of a tracking service provider. Users of the tracking system register with their personal contact information (for example a telephone number) and a PIN code or password which they have chosen. The tracking system enables people to read markers in order to log their presence at a location at a specific time and to store encrypted presence information on a server. The tracking system can use different servers (for example a registration server, a marker server and a logging server) which may be operated by different organisations. The encryption of presence information is carried out using different encryption techniques and different cryptographic keys. In order to protect the presence information of users of the tracking system, which information is stored in logs of the system, presence data are encrypted by means of cryptographic keys. For access to presence information and personal data a combination of cryptographic keys of individual persons and authorised organisations is necessary. Due to the privacy-maintaining properties of the tracking system, it can be ensured that an authorisation procedure must be carried out for every contact tracking request to an authorised organisation. The system can be used in order to track chains of infection of an infectious disease by an authorised organisation (for example a health authority). When using the system for tracking chains of infection, an authorised organisation can carry out a digital contact tracking of persons who were present at the same location, or of persons who had direct contact with one another. The encryption system used by the tracking system guarantees the sovereignty of the users over their personal data and presence information. The consent of the user is necessary so that authorised organisations can access these data, and is enforced technically by means of cryptography.

Description

Privacy-preserving tracking system

Technical area

The invention is concerned with the collection of personal data and presence information, which are protected by means of security measures in information technology, in a system consisting of networked computer systems and devices for reading markers. The information is processed in a privacy-preserving manner, but allows contact tracking with the consent of the users of the system. The invention can be used to track chains of infection of an infectious disease.

Classification

Class 706 data processing

Class 726 information security

State of the art

There are several application cases for a data processing system that logs the presence of individual people at locations (reference points) or logs contacts of people over time. An example of the benefit of being able to use a contact tracking data processing system is the need to track contacts of individuals who have contracted an infectious disease in order to contain the further spread of the disease. An effective mitigation strategy to contain the spread of disease is to identify, for each person known to be infected, their previous contacts during the period of time that the person known to be infected may have been infectious. Contacts in this context include other people with whom an infected person has been in contact, but also physical substances (whether in solid, liquid or gaseous aggregate state) with which an infected person has come into contact, and other persons who subsequently come into contact with the contacted persons or physical substances contacted.

A health organization, such as a health authority, may be legally entitled to receive a certain amount of information relating to an infected person and for a certain period of time. In order to suppress or slow down the spread of an infectious disease, a health organization may be entitled to receive personal contact information from contact persons and contact substances with which an infected person has come into contact for a certain period of time. A tracking system can be used by a health organization to collect and access such contact information. At the same time, there are important data protection and information technology security interests of individuals and society as a whole that must be taken into account when designing a tracking system. Information about the presence of a single person in a certain place as well as personal contact data, e.g. a telephone number, are personal information worthy of protection. Individuals in general and other social actors have a considerable interest in ensuring that presence and contact information are effectively protected and that the rules for authorizing access to this data are transparent and technically enforceable. It may be desirable for authorized organizations to have access to personal data only if there are legitimate reasons and the consent of the data subjects to allow the authorized organizations to access their data.

Even if a legitimate organization may have legitimate reasons to obtain information about contacts of an infected person within a certain time window, along with the time of these contacts, including the places where a person has been and the times of these visits, as well as contact information of contacted persons and contacted physical substances of a person during a certain time window, it is also desirable (for various reasons with regard to data security, data protection and privacy) to limit the technical access of the authorized organization to the necessary information. This means that the well-known “knowledge only if necessary” principle can be applied in such use cases.

The European General Data Protection Regulation (GDPR) is an EU law for data protection and privacy that regulates control over their personal data for individuals. An important goal in providing a data processing system for contact tracking is that such a system is compliant with the GDPR and at the same time fulfills other technical goals, e.g. that the system requires only a small amount of technical resources and has good scalability properties with regard to the number of people who use the tracking system, the number of reference points and the number of interactions between them. Relevant technical resources of the individual components of the tracking system include in particular CPU, memory, communication data rate and volume and energy. If a data processing system is to be provided for contact tracking, it is also important that the system has favorable technical properties such as a short response time for all input interfaces of the system, including user interfaces via which a user can enter inputs into the system, and that the system is robust is against attacks. Possible attacks include actors who have or can gain access to the computer systems of the tracking system. This includes computer systems owned by individuals using the tracking system, the tracking service provider, or an authorized organization with a legitimate mandate to access tracking information. Unauthorized access to computer systems can include extracting or tampering with tracking data. A tracking system that ensures data protection and the privacy of the users of the tracking system is robust against attacks if the compromise of any of the computer systems involved does not allow the attacker access to all or part of the tracking data. The highest level of security for users of the tracking system is achieved if data protection and privacy are guaranteed, as long as any actor involved in the tracking system, including this person himself, is not compromised. Even if it may not be feasible to prevent improper use of the tracking system, e.g. by having attackers log invalid presence information for themselves, it must be impossible for any user of the tracking system to violate the integrity of existing data by manipulating valid tracking data or incorrect tracking data for generate other users of the tracking system.

Existing tracking systems that collect information about the presence of mobile communication devices in a certain location, or in the vicinity of other technical devices, or by the presence of a marker within the reading range of a marker reader can be used for contact tracking, but may not achieve desirable technical properties. Certain tracking systems may use more resources than necessary or may not achieve acceptable response times. Certain tracking systems cannot capture sufficiently accurate contact information in space or time, or may not be able to register contacts with physical substances. Certain tracking systems cannot provide robustness against attacks or cannot guarantee privacy, data protection, data security and data integrity.

Presentation of the invention

In the following, a novel, privacy-protecting tracking system is presented, which overcomes the shortcomings of existing contact tracking systems. The following goals can be achieved with the tracking system: Effective and precise contact tracking while preserving privacy, decoupling of data acquisition, data processing and data access, consent-based access to personal data and presence information, cryptographically secured data protection on knowledge-only-with- Requirements-based, transparency in the recording process for data tracking, compliance with the EU General Data Protection Regulation.

The tracking system does not provide access to personal contact information and presence information of people who make full use of the tracking system. Authorized organizations (e.g. a health authority) can request access to individual tracking data with the consent of a data subject (e.g. a person infected with an infectious disease). The tracking service provider can only make tracking data of a data subject available to an authorized organization if this has been expressly authorized by the data subject, e.g. by receiving a cryptographic key in order to decrypt the tracking data.

The tracking system comprises the following components:

1. One or more unique tracking tokens, which can be analog or digital tokens that are unique identifiers for people, objects, or places and that can be read by humans or machines. 2. One or more marker readers that can be used to read unique markers. The function as a marker reading device can be provided by humans or computer systems, e.g. mobile communication devices or special hardware. The reading results of the markers can be recorded in computer systems and transferred to other computer systems via computer networks, e.g. the Internet. 3. One or more servers of the tracking system that can perform methods of receiving, processing, analyzing and providing tracking data. Tracking data may include users' personal contact information and their presence information generated by reading unique markers.

The tracking system supports the following actors: 1. One or more users of the tracking system who can create or read unique markers. 2. One or more tracking service providers that can operate tracking system servers. 3. One or more authorized organizations that can request access to and receive tracking data.

The tracking system has the following properties: 1. Objects or locations at a fixed point (eg rooms) or in motion (eg trains) can be provided with unique markers. Objects or locations can be equipped with several versions of the same marker (e.g. to enable simultaneous reading) or with several different unique markers (e.g. to identify separately handled contact zones). 2. People whose presence at objects or locations or whose contacts with other people are recorded by the tracking system can be provided with a clear tracking marker. 3. Individuals equipped with a marker reader can read unique markers from the tracking system and communicate their own unique identifier and the identifier of the marker read to the tracking system servers to confirm a contact. Individuals equipped with a marker reader can also read several unique follow-up markers to confirm contact between them. People equipped with a computer system can use a web browser or a specific application (app) to transmit contact information to servers of the tracking system. 4. At the server of the tracking system, received identifiers of unique markers of an object, place or person can be used to record the presence of the person who used the marker reading device at a certain object, place or in direct contact with another person .

The tracking system comprises the following components: 1. Markers of the tracking system can be of different types (a) One possible type of marker is a matrix barcode label. Such a two-dimensional barcode is also referred to as a QR code (Quick Response Code). It often contains data that specifies a web resource in the form of a URL (Uniform Resource Locator) (b) Markers can also be of another type, e.g. barcodes (linear or one-dimensional barcode) or RFID markers (Radio Frequency Identifier Tags) or Bluetooth beacons or Wifi devices that send beacon frames, or based on other means that are suitable for realizing a marker they can represent permanent contact, e.g. for family members, or for constantly visited places or objects that are used continuously.

A reference point (BP) indicates a specific point in the three-dimensional space of a location. A BP can be identified with a location-specific identifier and marked with a marker of the tracking system with which the location-specific identifier can be read. One way of enabling the location-specific identifier to be read is to mark the BP with a QR code that contains the location-specific identifier. A location can be equipped with one or more markers. Each location marker can have a unique location-specific identifier. In this case, different BPs in this location can be distinguished by the tracking system. Alternatively, it is possible that several markers at one location have the same location-specific identifier. In this case, the markers that use the same location-specific identifier are assigned to the same BP. A location-specific identifier of the tracking system can be represented in the form of a binary value of fixed length, a number or a text string.

An area code is a numeric or alphanumeric identifier that indicates a geographic area. One possibility for an area code is a zip code. A place can be assigned to an area code. Due to the fact that many people can be assigned to an area code, statistical information on the people associated with the area code can be published in a data protection manner.

Individuals can be reached via personal contact information (PCI). Possible variants of personal contact information are telephone numbers and e-mail addresses. A telephone number is a number that is formatted according to the E.164 standard, for example, and is assigned to a device, a person, an organization or a service. An email address is an email service address that is assigned to a device, person, organization, or service. RFC 5322 specifies the address format (addr-spec) of SMTP (Simple Mail Transfer Protocol) emails. In addition to the addr-spec, the common email address can also contain a display name, a comment, or both. There are anonymous email providers who provide users with anonymous email addresses. The tracking system enables users to provide an anonymous email address as personal contact information, which ensures a high level of data protection. Personal contact information can also be of another type, e.g. in the form of an instant messaging user identifier or in the form of other information with which a person can be contacted.

A personal identification number (PIN) is a numeric or alphanumeric password (PW) that is used in the process of authenticating a user accessing a system. The system enables individuals to choose a PIN or PW to protect their personal data, including their PCI, when processed by components of the tracking system. Users of the tracking system are assigned unique user IDs when a user registration process is carried out. By using cryptographic hash functions to calculate the user ID based on entered personal data, e.g. personal contact information or PIN or password or a combination thereof, the uniqueness of the user ID is ensured while it is impossible to extract personal data from the user -ID to be reconstructed.

The tracking system maintains a log to collect presence and contact information. A presence record is stored in the log for each user who was present at a specific location with a location-specific identifier, and the one has performed an authenticated reading procedure with the unique marker of this location. A contact data record is stored in the log for each user who had contact with a certain object, which was identified by a unique user ID and an object-specific identifier, and who carried out an authenticated reading procedure with the unique marker of this object. A contact data record is stored in the log for each user who had contact with another user who was identified by a unique user ID and a personal identifier and who carried out an authenticated reading process with the unique marker of this user. The protocol collects encrypted data records and thus ensures the data protection properties of the tracking system. Because cryptographic functions are used to encrypt records of presence and contact information, the tracking system's protocol is also known as the crypto-protocol.

Presence and contact information, which is stored in encrypted form in the log, include PCI, PIN and additional personal attributes such as year of birth, area code of the person and attributes of a location such as area code of the location and location descriptions. The tracking system uses a cryptographic key of the tracking system to encrypt certain parts of the data that are stored in the log, thus preventing unauthorized access to the data. The tracking system uses other specific parts of the data stored in the log, particularly PCI, using an authorized organization's public key, thereby preventing unauthorized access to these parts of the data. This prevents the operators of the tracking server from accessing these parts of the data, and thus ensures a high level of data protection and IT security for the tracking system. The encryption of certain parts of the data stored in the log, including the PCI, can be carried out using a public key of an authorized organization within a cryptographic function which is carried out on the mobile communication device of a user of the system. The encryption of certain parts of the data stored in the log, including the PCI, can be performed in a web browser of a user's mobile communication device, thereby eliminating the need to install a specific app on that mobile communication device.

The tracking system supports the following methods: user registration method, user authentication method, marker creation method, marker reading method, encrypted logging, tracking authorization method Contact transmission method, statistics transmission method. The tracking system servers can support one or more methods of the tracking system.

The tracking system consists of several components including one or more servers. Each server of the tracking system can support one or more methods of the set of methods of the tracking system. A server of the tracking system can be assigned to one or more server types, depending on which subset of the methods supported by the server are carried out. One type of server can be a registration server, i.e. a server that supports the procedure for registering and authenticating users, creating markers or authorizing contact tracking. One type of server can be a marker server, i.e. a server that supports the reading process of markers. One type of server can be a logging server, i.e. a server that supports the encrypted logging process, the transfer of contacts or the transfer of statistics. It is possible that a server of a certain type supports not only one or more methods which are characteristic of this server type, but also an additional subgroup of methods. For example, it is possible that a registration server also supports the encrypted logging method. A characteristic of the tracking system is that not every type of server and not every particular server has to support all of the methods of the tracking system. This property enables the separation of data and functions of the tracking system, as well as the access rights of administrators between different servers. This improves data protection, IT security and privacy.

Servers of the tracking system are operated by one or more operators. Different servers of the tracking system can be operated by different operators, e.g. to share or separate responsibilities. One operator of a tracking server can operate one type of server and another operator can operate another type of server, thereby restricting the access rights of the administrators of each operator to a certain subset of server types. This property can further improve data protection, IT security and privacy of the tracking system.

The tracking systems can grant authorized organizations access to tracking data: Certain organizations can have authorization. Organizations can receive authorization if they are authorized to handle specific personal data. Specific personal data can contain sensitive health information. Organizations dealing with health information include health care providers and health authorities. A healthcare provider provides health services to people and is authorized to handle sensitive health information from users in accordance with health care laws and regulations. A health authority acts on behalf of the government in accordance with applicable law (e.g. the Infection Protection Act).

To limit the spread of an infectious disease, a health organization can track previous contacts that person has when a person tests positive for an infectious disease. To implement the knowledge-only-when-needed principle for health organizations, the tracking service provider only provides the health organization with the part of the log data authorized in accordance with a contact tracking authorization procedure. Carrying out this procedure enables the needs of the specific case to be taken into account, thereby fulfilling the knowledge-only-when-needed requirements. This property of the tracking system avoids the need for a public health agency to have access to all attendance and contact information logged by a tracking system in order to conduct contact tracking for which it is legally authorized. The knowledge-only-when-required requirements specify the time window in which the health organization is given access to the encrypted log data relating to the presence and contact of an infected person. The presence and contact information of an infected person contains locations along with the time of the presence of an infected person, as well as time and location information of their contacts, personal contact information of the contact persons and other information about physical substances with which an infected person has been in contact.

The tracking system can provide certain data to an authorized organization. The provision of access rights of an authorized organization to specific data requires that the procedure for authorization of the contact tracing has been carried out successfully. Cryptographic functions are used to ensure that the authorized organization only has access to the specific data for which it has been successfully authorized. A feature of the tracking system is that the authorized organization uses a cryptographic key to access the specific tracking system information for which it is authorized.

Brief description of the drawings

FIG. 1 shows a mobile communication device of a user of the tracking system, the user interface of which displays different information. FIG. 2 shows the distributed system architecture of the tracking system, with mobile communication devices using load balancing servers with registration servers, marker servers and logging servers that communicate with privacy-maintaining processing servers of the tracking system that communicate with servers of authorized persons organizations. FIG. 3 shows details of the tracking system with a mobile communication device that can communicate with marker servers, registration servers and logging servers. FIG. 4 shows components of the tracking system that are involved in user registration. FIG. 5 shows components of the tracking system which carry out part of the user registration. FIG. 6 shows components of the tracking system which carry out another part of the user registration. Figure 7 shows components of the tracking system involved in the marker reading process. Figure 8 shows components of the tracking system that perform part of the marker reading process. Figure 9 shows components of the tracking system that perform another part of the reading process. FIG. 10 shows components of the tracking system which carry out the encrypted logging method.

Ways of Carrying Out the Invention

Details of the cryptographic functions of the tracking system are explained below: The tracking system uses an asymmetric cryptographic scheme with a public key + k, a private key -k, an encryption function enc and a decryption function dec. For each data object m, each entity that knows the public key can generate a cipher text c = enc (+ k, m) using the public key + k. Only the owner of the private key -k can decrypt the ciphertext to obtain the data object: m = dec (-k, c).

The tracking system uses public keys from the tracking service provider to encrypt certain data. The tracking system uses public keys of authorized organizations + k_eo to encrypt certain data that only the authorized organization should be able to access. At the same time, the authorized organization only has access to this subset of the specific information that has been encrypted with one of its public keys if a procedure for authorizing contact tracing has been successfully carried out.

One cryptographic algorithm that can be used to generate encrypted data from the public key and the data object is OpenPGP, which was specified in RFC 4880 by the OpenPGP working group of the Internet Engineering Task Force (IETF). RFC 4880 specifies data formats for transmitting encrypted information. The specified packet formats include Public-Key Encrypted Session Key Packeis (Day 1). RFC 8017 specifies PKCS # 1, RSA Cryptography Specifications Version 2.2, specifies RSA cryptographic primitives, encryption schemes and ASN.l syntax for the representation of keys and to identify the schemes. The encryption schemes specified in RFC 8017 include RSAES-OAEP, a scheme that combines the RSA encryption primitive (RSAEP), the RSA decryption primitive (RSADP), and the EME-OAEP encoding method, which is based on the optimal asymmetric encryption scheme by Bellare and Rogaway .

Users of the system can be people who visit locations and possibly have contact with other people at these locations, or people who are assigned to a location that is equipped with a marker.

Figure 3 shows relevant components of the tracking system: Figure 3 shows a mobile communication device 601 that can communicate with multiple servers of a tracking system, including a registration server 603, a MarkerMarker server 602 and a logging server 607. The mobile communication device 601 can transfer data to Protection of privacy using a public key of the tracking system + k_ts 612 and encrypting using a public key of an authorized organization + k_eo 613. The mobile communication device 601 has a local memory 604 that contains a user ID that was received from a server of the tracking system and a user key that results from a cryptographic hash function on the user device and thus produces a hash value that Contains personal contact information and password. The local storage 604 also contains a data element C-contact which is the result of a method executed on the user device that generates an encrypted data element using the cryptographic function of / for a public key and which, as the public key, is the public key of an authorized person Organization and personal contact information used as input data.

With these components, the tracking system supports the following methods: user registration method, user authentication method, marker creation method, marker reading method, encrypted logging method, tracking authorization method, contact transmission method, statistics transmission method.

In the following, the methods of the tracking system are described in further detail. Users can perform a user registration process with the tracking system. When registering a person, a user of the tracking system enters personal contact information, a PIN or a password, and attributes of the person such as area code and age. The user device and a server of the tracking system perform a registration protocol that uses cryptographic methods including encryption and cryptographic hash functions with cryptographic keys of the tracking system and the authorized organization. After the registration process is complete, the

1 i User device set up a local data structure with a user ID and the tracking system in the registration log an entry that is a registration data record. The registration data record can contain a user ID, a user-specific key (referred to as a userkey) and encrypted data with attributes of the person (such as area code and age).

The user registration process can include the following technical functions: It can receive input data, including personal contact information (PCI) and a PIN code or password (PW) as well as a country and / or area code and optional personal attributes such as age. It can generate an encrypted data element (called c-contact) that contains personal contact information (PCI) and can be decrypted by an authorized organization. It can generate a local structure for personal data that contains personal attributes such as age and area code of residence, as well as the encrypted data element with personal contact information. It can generate a user-specific key (called a userkey). One possibility of generating the user key is that a method is carried out on the user device that generates a hash value using a cryptographic hash function and uses input data from the local structure of personal data. It can generate an additional encrypted data element with attributes (abbreviated c-attributes). Attributes of a person can include the area code of the place of residence and age. The attributes are encrypted so that they can be decrypted by the tracking system. The data element with the encrypted area code is called the c-area code. The data element with the encrypted age is called c-age. It can compose a registration message using a data structure that contains the user-specific key (userkey) and personal attributes (c-attributes) that can be decrypted by the tracking service provider and sends the registration message to the tracking system's registration server. It can receive a unique user ID (called a userid) from the tracking system. One way of generating the user key is for the registration server to carry out a method that uses a cryptographic hash function to generate a hash value and uses input data from the registration message. It can complete the registration process on the user device by updating the local structure of the personal data, which contains the following data elements: userkey, userid, c-contact and c-attributes (with c-area-code and c-age). Figures 4, 5 and 6 show details of a possible instantiation of the user registration process. FIG. 4 shows the components of the tracking system that are involved in user registration: the mobile communication device 601 and the registration server 603 with its DNS name 606 Generate data element userkey (user key) of the local memory 604 by using the following data elements as input of the cryptographic hash function SHA256: the telephone number 0170/123456789 as personal contact information and the character string Mypassword as password PW. The generated cryptographic hash value is a 256-bit long binary value with the character representation chpwdXYZ 605. Figure 5 shows a first message 700 that is sent in the user registration from the mobile communication device 601 to the registration server 603, which contains the user key 701 as a plain text file and which has a data structure 702 with encrypted attributes contains, in this example with two encrypted data elements, in this example c-area-code and c-age. The first encrypted data element c-area-code is generated on the user's mobile communication device by a cryptographic function of the tracking system with a public key + k_ts and the area code. The second encrypted data element c-age is generated on the user's mobile communication device by a cryptographic function with a public key of the tracking system + k_ts and the age of the user. FIG. 6 shows a second message 703 which is sent in the user registration from the registration server to the mobile communication device and contains a user ID which is then stored in the local memory of the mobile communication device.

Users of the tracking system can perform user authentication in order to gain access to additional methods for registered users. The tracking system can perform user authentication by checking whether a particular person knows both the personal contact information and the password. When performing user authentication, a user must enter both information elements, the personal contact information and the password, into his mobile communication device, whereupon a user-specific key (userkey) is generated there. One possibility of generating the user key is to generate a hash value from personal contact information and the password on the user device using a cryptographic hash function. The resulting cryptographic hash with the user-specific key (userkey) is transmitted to a server in the tracking system, where it can be compared with a stored user key. If the keys match each other, the user authentication was successful, which implies that the authentic user performed the user authentication. The tracking system is able to carry out user authentication with any number of messages that a mobile communication device sends to a server of the tracking system by inserting a user-specific key (userkey) into these messages. User authentication with any number of messages can be performed if these messages are a Data element is attached that contains the user-specific key (userkey) in the form of an HTTP cookie, as specified in RFC 6265.

Locations can be registered in the tracking system by performing a location registration. Technically, there does not have to be a difference in the registration process of people and places. There is a difference in the content of the attributes. Attributes of a location can contain one or more location descriptions, while attributes of a person can contain personal information such as age. When registering a location, a user of the tracking system enters the contact information of a person or organization associated with the location, a PIN or a password, as well as location attributes such as the area code and a location description. As with user registration, the user device and a server of the tracking system perform a registration protocol that uses cryptographic functions including encryption and cryptographic hash functions with cryptographic keys of the tracking system and the authorized organization. As in the case of the registration process for persons, after the registration process has been completed, the user device has set up a local data structure with a user ID and the tracking system has entered a registration data record in its registration log. The registration data record can contain a user ID, a user-specific key (userkey) and encrypted data with attributes of the location (such as area code and location description).

The method for location registration can include the same technical functions as the method for person registration. A notable difference between the technical functions of location registration and person registration is that the encrypted data element with attributes (abbreviated c-attributes) can contain different attributes (location-specific attributes instead of personal attributes). Attributes of a location can contain one or more location descriptions. Data elements with encrypted location descriptions are called c-loc-des. After completion of the location registration process, the user device has a local location data structure that contains the following data elements: userid, userkey, c-contact and c-attributes (with c-area-code and c-loc-des).

Authenticated users can carry out a marker creation process. After completing a registration process for a person or a location, the user device has set up a local data structure with a user ID. During marker creation, a person-related or location-specific marker is created that can be read by mobile communication devices that use the tracking system. QR code markers are an important type of marker for the tracking system. A possibility, To create a QR code marker for a person or place, create a URL with the protocol and domain name of a tracking system scan server, followed by a path containing a string representation of the user ID. If in this example the protocol is https, the domain name of the scan server is tag.qroniton.eu and the path with the character string representation of the userid is 123, the result is the tag URL: https://tag.qroniton.eu/123 . The resulting QR code containing this URL is specific to a person or place.

Authenticated users can perform a marker reading process. In order to carry out a marker reading process, a marker reading device of a user of the tracking system must read out the information from a marker. The marker reading device then contacts a server of the tracking system using the information it has read from the marker. To establish contact with a server of the tracking system, a marker reading device derives a URL from the information read out by the marker, which URL specifies a specific resource of a server of the tracking system. If the URL read by the marker is an Internet resource that is accessible on the server of the tracking system, the marker reader can use the HTTP protocol to communicate with the server of the tracking system. If the URL read from the marker is an Internet resource with the HTTPS protocol, the marker reader sets up a TLS (Transport Layer Security session) session before exchanging HTTP messages with the server of the tracking system. If the marker is a QR code, the mobile communication device can use an app that can decode the QR code and extract the URL. If the marker reader is configured so that an app that can decode a QR code and extract a URL from the QR code, the decoded URL is forwarded to the web browser of the mobile communication device. The device's web browser establishes a session with the tracking system's web server and accesses the web resource on the web server specified in the QR code. The web browser of the marker reading device can carry out this access to a web resource in the form of an HTTP GET request on a server that is specified by the DNS name of the URL and the path specified in the path section of the URL. If the local memory of the mobile communication device contains the data that were created during user registration and user authentication, the marker reading device transmits user-specific data to the contacted server of the tracking system. This data record contains a user-specific identifier (userid). The marker reader can transmit a data element that contains the user-specific identifier (userid) in the form of an HTTP cookie, as specified in RFC 6265. After accessing the tracking server resource indicated by the marker url and the When the data record containing a user-specific identifier (userid) is transmitted, the contacted server of the tracking system can recognize that it has been contacted by a marker reading device that has carried out user registration and user authentication. If a marker reading device contacts the server of the tracking system and does not transmit a data structure with a user-specific identifier (userid) obtained from the user registration, the contacted server can transmit data to the marker reading device, which informs about the need for user registration. The server of the tracking system can directly initiate that the marker reading device displays a user interface of the user registration process.

Figures 7, 8 and 9 show details of a possible instantiation of the marker reading method. FIG. 7 shows the components involved in the tracking system: a marker 801 in the form of a QR code which contains a URL 802 as information, a mobile communication device 601 with a local memory 604 which contains a data structure that contains the data elements for userid, userkey and c- contact contains, a scan server 602 with a DNS name 607 and a registration server 603 with a DNS name 606. In the example shown in FIG. 7, the mobile communication device 601 reads the information from the marker 801, which has the URL https: / /tag.qroniton.eu/123 contains. FIG. 8 shows a first message of the marker reading method in which the mobile communication device contacts the marker server with the DNS name tag.qroniton.eu with an http-get request on the path 123. FIG. 9 shows a second message of the marker reading method in which the marker server with the DNS name tag.qroniton.eu replies with a message 804 with the data structure 805 which contains two data elements, a first data element being the userid of the marker is (in this example with the string representation 123) and a second data element, which is sitekey, is a unique key that is specific to that location in the particular time window. The mobile communication device can then store both data elements in its local memory 604.

Authorized users can carry out an encrypted logging process. After the marker reading process has been carried out, the encrypted logging process is carried out by the mobile communication device with the intention of transmitting encrypted presence or contact information to the logging server of the tracking system, which maintains a cryptographic protocol. The cryptographic protocol contains data records that are encrypted in such a way that contact tracking can only be carried out in those cases in which a user has authorized the tracking system to carry out contact tracking.

FIG. 10 shows details of a possible instantiation of the encrypted logging method. Figure 10 shows the mobile communication device 601 that a message with a data structure 807 to the logging server 608 with the DNS name log.qroniton.eu 609. The data structure 807 can contain multiple data elements which are then stored in the cryptographic protocol of the logging server. In the example of FIG. 10, the data structure 807 contains the following data elements: The data structure 807 contains the useridl of the marker that was read in the marker reading process that was carried out directly before the encrypted logging process, and transmits the information that the mobile communication device is connected the location marked with marker 801. The data structure 807 contains the userid2 of the user of the mobile communication device, which shows that the person associated with the mobile communication device was present at the location identified by the marker 801. The data structure 807 also contains the data element of the siteid, which was generated on the mobile communication device by executing a cryptographic hash function, with the data input of the sitekey, which the mobile communication device received from the marker reading process. The data structure 807 also contains the encrypted data element sitekey, which was generated by a symmetric cryptographic function, AES in the example of FIG. 10, the cryptographic key having generated the cryptographic hash value userkey = chpwdXYZ from the password and the sitekey as data input. The data structure 807 also contains the encrypted data element contact that was generated by a symmetric cryptographic function, AES in the example of FIG. 10, with a cryptographic key, the sitekey, which was obtained from the marker reading process, and the encrypted data element c- contact from local storage.

Users can perform a tracking authorization process. In cases where a user wishes to indicate that their contact and presence information stored by a logging server of the tracking system can be used to carry out contact tracking, the user enters his password when prompted to do contact tracking to authorize. One possibility to authorize the contact tracking is that the user reads a certain marker for the authorization of the contact tracking with his mobile communication device and then enters his personal contact information and his password.

Users can perform a contact transfer method. Users can express that the information about their contacts will be transferred to an authorized organization by entering their personal contact information and password when asked to authorize the contact transfer.

Users can perform a method for transmitting statistics. A user can use his mobile communication device to initiate methods for the transmission of statistics. One way of starting this method is for the user device to have a reads certain marker created for this purpose. Another possibility for initiating the method for transmitting statistics is that a user visits a statistics website of the tracking system with his mobile communication device and carries out a user authentication. The result of the method for transmitting statistics can include that the user interface of the mobile communication device displays user-specific statistics, as is shown in elements 14 and 15 of FIG.

The architecture of the tracking system has several features that improve data protection, IT security and privacy. Not all functions of all methods of the tracking system need to be performed by servers of an operator of tracking servers. Alternatively, certain functions and methods of the tracking system can be executed by certain apps on the mobile communication device of a user. One possibility for an app that can implement a method of the tracking system on the mobile communication device of a user is an app that carries out the marker reading method. Another possibility for an app that can implement a method of the tracking system on the mobile communication device of a user is an app that carries out the encrypted logging method. In both cases, these apps must support functions for the authorization process of the tracking system so that the data stored by the app can be made accessible to an authorized organization in order to track contact and presence information of a specific person in an authorized case. The architecture of the tracking system enables a further improvement in terms of data protection, IT security and privacy by allowing multiple independent tracking service providers to operate multiple tracking systems in parallel, thereby limiting the amount of data that each tracking system collects. If several tracking systems are operated in parallel, a single authorized organization, e.g. a specific health authority, can carry out an authorization procedure with all relevant tracking service providers in order to implement the contact tracking of a specific case. This enables the authorized organization to receive all relevant presence and contact information for this case from all relevant tracking service providers. At the same time, this property of the architecture of the tracking system enables the parallel operation of several tracking systems, which strengthens data protection, IT security and privacy from the point of view of individual users and from the point of view of society as a whole.

Claims

Expectations

1. A networked computer system in which a person equipped with a mobile communication device carries out a registration process, characterized in that: A user of the tracking system carried out a registration process with his mobile communication device and entered personal contact information and a password. The mobile communication device with which the user carried out a user registration process reads out a marker with an identifier specific to this location. The mobile communication device with which the user carried out a user registration process transmits encrypted log information to a logging server.

2. The networked computer system of claim 1, wherein the transmitted data structure comprises personal contact information encrypted using a public key of an authorized organization.

The networked computer system of claim 1, wherein the transmitted data structure comprises personal contact information encrypted using a public key of an authorized organization including additional information encrypted using a public key of a tracking service provider.