WO2021204313A1 - Système de suivi assurant la confidentialité - Google Patents

Système de suivi assurant la confidentialité Download PDF

Info

Publication number
WO2021204313A1
WO2021204313A1 PCT/DE2021/000059 DE2021000059W WO2021204313A1 WO 2021204313 A1 WO2021204313 A1 WO 2021204313A1 DE 2021000059 W DE2021000059 W DE 2021000059W WO 2021204313 A1 WO2021204313 A1 WO 2021204313A1
Authority
WO
WIPO (PCT)
Prior art keywords
tracking system
tracking
data
user
server
Prior art date
Application number
PCT/DE2021/000059
Other languages
German (de)
English (en)
Inventor
Georg Carle
Johann Schlamp
Original Assignee
Georg Carle
Johann Schlamp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Georg Carle, Johann Schlamp filed Critical Georg Carle
Priority to EP21725684.1A priority Critical patent/EP4136860A1/fr
Publication of WO2021204313A1 publication Critical patent/WO2021204313A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/023—Services making use of location information using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16H—HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA
    • G16H50/00—ICT specially adapted for medical diagnosis, medical simulation or medical data mining; ICT specially adapted for detecting, monitoring or modelling epidemics or pandemics
    • G16H50/80—ICT specially adapted for medical diagnosis, medical simulation or medical data mining; ICT specially adapted for detecting, monitoring or modelling epidemics or pandemics for detecting, monitoring or modelling epidemics or pandemics, e.g. flu

Definitions

  • the invention is concerned with the collection of personal data and presence information, which are protected by means of security measures in information technology, in a system consisting of networked computer systems and devices for reading markers.
  • the information is processed in a privacy-preserving manner, but allows contact tracking with the consent of the users of the system.
  • the invention can be used to track chains of infection of an infectious disease.
  • An effective mitigation strategy to contain the spread of disease is to identify, for each person known to be infected, their previous contacts during the period of time that the person known to be infected may have been infectious.
  • Contacts in this context include other people with whom an infected person has been in contact, but also physical substances (whether in solid, liquid or gaseous aggregate state) with which an infected person has come into contact, and other persons who subsequently come into contact with the contacted persons or physical substances contacted.
  • a health organization such as a health authority, may be legally entitled to receive a certain amount of information relating to an infected person and for a certain period of time.
  • a health organization may be entitled to receive personal contact information from contact persons and contact substances with which an infected person has come into contact for a certain period of time.
  • a tracking system can be used by a health organization to collect and access such contact information.
  • Information about the presence of a single person in a certain place as well as personal contact data, e.g. a telephone number, are personal information worthy of protection.
  • the European General Data Protection Regulation is an EU law for data protection and privacy that regulates control over their personal data for individuals.
  • An important goal in providing a data processing system for contact tracking is that such a system is compliant with the GDPR and at the same time fulfills other technical goals, e.g. that the system requires only a small amount of technical resources and has good scalability properties with regard to the number of people who use the tracking system, the number of reference points and the number of interactions between them.
  • Relevant technical resources of the individual components of the tracking system include in particular CPU, memory, communication data rate and volume and energy.
  • a data processing system is to be provided for contact tracking, it is also important that the system has favorable technical properties such as a short response time for all input interfaces of the system, including user interfaces via which a user can enter inputs into the system, and that the system is robust is against attacks.
  • Possible attacks include actors who have or can gain access to the computer systems of the tracking system. This includes computer systems owned by individuals using the tracking system, the tracking service provider, or an authorized organization with a legitimate mandate to access tracking information. Unauthorized access to computer systems can include extracting or tampering with tracking data.
  • a tracking system that ensures data protection and the privacy of the users of the tracking system is robust against attacks if the compromise of any of the computer systems involved does not allow the attacker access to all or part of the tracking data.
  • the highest level of security for users of the tracking system is achieved if data protection and privacy are guaranteed, as long as any actor involved in the tracking system, including this person himself, is not compromised. Even if it may not be feasible to prevent improper use of the tracking system, e.g. by having attackers log invalid presence information for themselves, it must be impossible for any user of the tracking system to violate the integrity of existing data by manipulating valid tracking data or incorrect tracking data for generate other users of the tracking system.
  • the tracking system does not provide access to personal contact information and presence information of people who make full use of the tracking system.
  • Authorized organizations e.g. a health authority
  • can request access to individual tracking data with the consent of a data subject e.g. a person infected with an infectious disease.
  • the tracking service provider can only make tracking data of a data subject available to an authorized organization if this has been expressly authorized by the data subject, e.g. by receiving a cryptographic key in order to decrypt the tracking data.
  • the tracking system comprises the following components:
  • One or more unique tracking tokens which can be analog or digital tokens that are unique identifiers for people, objects, or places and that can be read by humans or machines.
  • One or more marker readers that can be used to read unique markers. The function as a marker reading device can be provided by humans or computer systems, e.g. mobile communication devices or special hardware. The reading results of the markers can be recorded in computer systems and transferred to other computer systems via computer networks, e.g. the Internet.
  • One or more servers of the tracking system that can perform methods of receiving, processing, analyzing and providing tracking data. Tracking data may include users' personal contact information and their presence information generated by reading unique markers.
  • the tracking system supports the following actors: 1. One or more users of the tracking system who can create or read unique markers. 2. One or more tracking service providers that can operate tracking system servers. 3. One or more authorized organizations that can request access to and receive tracking data.
  • the tracking system has the following properties: 1. Objects or locations at a fixed point (eg rooms) or in motion (eg trains) can be provided with unique markers. Objects or locations can be equipped with several versions of the same marker (e.g. to enable simultaneous reading) or with several different unique markers (e.g. to identify separately handled contact zones). 2. People whose presence at objects or locations or whose contacts with other people are recorded by the tracking system can be provided with a clear tracking marker. 3. Individuals equipped with a marker reader can read unique markers from the tracking system and communicate their own unique identifier and the identifier of the marker read to the tracking system servers to confirm a contact. Individuals equipped with a marker reader can also read several unique follow-up markers to confirm contact between them.
  • People equipped with a computer system can use a web browser or a specific application (app) to transmit contact information to servers of the tracking system. 4.
  • a web browser or a specific application (app) to transmit contact information to servers of the tracking system. 4.
  • received identifiers of unique markers of an object, place or person can be used to record the presence of the person who used the marker reading device at a certain object, place or in direct contact with another person .
  • the tracking system comprises the following components: 1. Markers of the tracking system can be of different types (a) One possible type of marker is a matrix barcode label. Such a two-dimensional barcode is also referred to as a QR code (Quick Response Code). It often contains data that specifies a web resource in the form of a URL (Uniform Resource Locator) (b) Markers can also be of another type, e.g. barcodes (linear or one-dimensional barcode) or RFID markers (Radio Frequency Identifier Tags) or Bluetooth beacons or Wifi devices that send beacon frames, or based on other means that are suitable for realizing a marker they can represent permanent contact, e.g. for family members, or for constantly visited places or objects that are used continuously.
  • QR code Quadick Response Code
  • a reference point indicates a specific point in the three-dimensional space of a location.
  • a BP can be identified with a location-specific identifier and marked with a marker of the tracking system with which the location-specific identifier can be read.
  • One way of enabling the location-specific identifier to be read is to mark the BP with a QR code that contains the location-specific identifier.
  • a location can be equipped with one or more markers. Each location marker can have a unique location-specific identifier. In this case, different BPs in this location can be distinguished by the tracking system. Alternatively, it is possible that several markers at one location have the same location-specific identifier. In this case, the markers that use the same location-specific identifier are assigned to the same BP.
  • a location-specific identifier of the tracking system can be represented in the form of a binary value of fixed length, a number or a text string.
  • An area code is a numeric or alphanumeric identifier that indicates a geographic area.
  • An area code is a zip code.
  • a place can be assigned to an area code. Due to the fact that many people can be assigned to an area code, statistical information on the people associated with the area code can be published in a data protection manner.
  • PCI personal contact information
  • a telephone number is a number that is formatted according to the E.164 standard, for example, and is assigned to a device, a person, an organization or a service.
  • An email address is an email service address that is assigned to a device, person, organization, or service.
  • RFC 5322 specifies the address format (addr-spec) of SMTP (Simple Mail Transfer Protocol) emails.
  • the common email address can also contain a display name, a comment, or both.
  • There are anonymous email providers who provide users with anonymous email addresses. The tracking system enables users to provide an anonymous email address as personal contact information, which ensures a high level of data protection.
  • Personal contact information can also be of another type, e.g. in the form of an instant messaging user identifier or in the form of other information with which a person can be contacted.
  • a personal identification number is a numeric or alphanumeric password (PW) that is used in the process of authenticating a user accessing a system.
  • PW numeric or alphanumeric password
  • the system enables individuals to choose a PIN or PW to protect their personal data, including their PCI, when processed by components of the tracking system.
  • Users of the tracking system are assigned unique user IDs when a user registration process is carried out.
  • cryptographic hash functions to calculate the user ID based on entered personal data, e.g. personal contact information or PIN or password or a combination thereof, the uniqueness of the user ID is ensured while it is impossible to extract personal data from the user -ID to be reconstructed.
  • the tracking system maintains a log to collect presence and contact information.
  • a presence record is stored in the log for each user who was present at a specific location with a location-specific identifier, and the one has performed an authenticated reading procedure with the unique marker of this location.
  • a contact data record is stored in the log for each user who had contact with a certain object, which was identified by a unique user ID and an object-specific identifier, and who carried out an authenticated reading procedure with the unique marker of this object.
  • a contact data record is stored in the log for each user who had contact with another user who was identified by a unique user ID and a personal identifier and who carried out an authenticated reading process with the unique marker of this user.
  • the protocol collects encrypted data records and thus ensures the data protection properties of the tracking system. Because cryptographic functions are used to encrypt records of presence and contact information, the tracking system's protocol is also known as the crypto-protocol.
  • Presence and contact information which is stored in encrypted form in the log, include PCI, PIN and additional personal attributes such as year of birth, area code of the person and attributes of a location such as area code of the location and location descriptions.
  • the tracking system uses a cryptographic key of the tracking system to encrypt certain parts of the data that are stored in the log, thus preventing unauthorized access to the data.
  • the tracking system uses other specific parts of the data stored in the log, particularly PCI, using an authorized organization's public key, thereby preventing unauthorized access to these parts of the data. This prevents the operators of the tracking server from accessing these parts of the data, and thus ensures a high level of data protection and IT security for the tracking system.
  • the encryption of certain parts of the data stored in the log, including the PCI can be carried out using a public key of an authorized organization within a cryptographic function which is carried out on the mobile communication device of a user of the system.
  • the encryption of certain parts of the data stored in the log, including the PCI can be performed in a web browser of a user's mobile communication device, thereby eliminating the need to install a specific app on that mobile communication device.
  • the tracking system supports the following methods: user registration method, user authentication method, marker creation method, marker reading method, encrypted logging, tracking authorization method Contact transmission method, statistics transmission method.
  • the tracking system servers can support one or more methods of the tracking system.
  • the tracking system consists of several components including one or more servers.
  • Each server of the tracking system can support one or more methods of the set of methods of the tracking system.
  • a server of the tracking system can be assigned to one or more server types, depending on which subset of the methods supported by the server are carried out.
  • One type of server can be a registration server, i.e. a server that supports the procedure for registering and authenticating users, creating markers or authorizing contact tracking.
  • One type of server can be a marker server, i.e. a server that supports the reading process of markers.
  • One type of server can be a logging server, i.e. a server that supports the encrypted logging process, the transfer of contacts or the transfer of statistics.
  • a server of a certain type supports not only one or more methods which are characteristic of this server type, but also an additional subgroup of methods.
  • a registration server also supports the encrypted logging method.
  • a characteristic of the tracking system is that not every type of server and not every particular server has to support all of the methods of the tracking system. This property enables the separation of data and functions of the tracking system, as well as the access rights of administrators between different servers. This improves data protection, IT security and privacy.
  • Servers of the tracking system are operated by one or more operators. Different servers of the tracking system can be operated by different operators, e.g. to share or separate responsibilities. One operator of a tracking server can operate one type of server and another operator can operate another type of server, thereby restricting the access rights of the administrators of each operator to a certain subset of server types. This property can further improve data protection, IT security and privacy of the tracking system.
  • the tracking systems can grant authorized organizations access to tracking data: Certain organizations can have authorization. Organizations can receive authorization if they are authorized to handle specific personal data. Specific personal data can contain sensitive health information. Organizations dealing with health information include health care providers and health authorities. A healthcare provider provides health services to people and is authorized to handle sensitive health information from users in accordance with health care laws and regulations. A health authority acts on behalf of the government in accordance with applicable law (e.g. the Infection Protection Act).
  • a health organization can track previous contacts that person has when a person tests positive for an infectious disease.
  • the tracking service provider only provides the health organization with the part of the log data authorized in accordance with a contact tracking authorization procedure. Carrying out this procedure enables the needs of the specific case to be taken into account, thereby fulfilling the knowledge-only-when-needed requirements.
  • This property of the tracking system avoids the need for a public health agency to have access to all attendance and contact information logged by a tracking system in order to conduct contact tracking for which it is legally authorized.
  • the knowledge-only-when-required requirements specify the time window in which the health organization is given access to the encrypted log data relating to the presence and contact of an infected person.
  • the presence and contact information of an infected person contains locations along with the time of the presence of an infected person, as well as time and location information of their contacts, personal contact information of the contact persons and other information about physical substances with which an infected person has been in contact.
  • the tracking system can provide certain data to an authorized organization.
  • the provision of access rights of an authorized organization to specific data requires that the procedure for authorization of the contact tracing has been carried out successfully.
  • Cryptographic functions are used to ensure that the authorized organization only has access to the specific data for which it has been successfully authorized.
  • a feature of the tracking system is that the authorized organization uses a cryptographic key to access the specific tracking system information for which it is authorized.
  • FIG. 1 shows a mobile communication device of a user of the tracking system, the user interface of which displays different information.
  • FIG. 2 shows the distributed system architecture of the tracking system, with mobile communication devices using load balancing servers with registration servers, marker servers and logging servers that communicate with privacy-maintaining processing servers of the tracking system that communicate with servers of authorized persons organizations.
  • FIG. 3 shows details of the tracking system with a mobile communication device that can communicate with marker servers, registration servers and logging servers.
  • FIG. 4 shows components of the tracking system that are involved in user registration.
  • FIG. 5 shows components of the tracking system which carry out part of the user registration.
  • FIG. 6 shows components of the tracking system which carry out another part of the user registration.
  • Figure 7 shows components of the tracking system involved in the marker reading process.
  • Figure 8 shows components of the tracking system that perform part of the marker reading process.
  • Figure 9 shows components of the tracking system that perform another part of the reading process.
  • FIG. 10 shows components of the tracking system which carry out the encrypted logging method.
  • the tracking system uses an asymmetric cryptographic scheme with a public key + k, a private key -k, an encryption function enc and a decryption function dec.
  • the tracking system uses public keys from the tracking service provider to encrypt certain data.
  • the tracking system uses public keys of authorized organizations + k_eo to encrypt certain data that only the authorized organization should be able to access.
  • the authorized organization only has access to this subset of the specific information that has been encrypted with one of its public keys if a procedure for authorizing contact tracing has been successfully carried out.
  • RFC 4880 specifies data formats for transmitting encrypted information.
  • the specified packet formats include Public-Key Encrypted Session Key Packeis (Day 1).
  • RFC 8017 specifies PKCS # 1, RSA Cryptography Specifications Version 2.2, specifies RSA cryptographic primitives, encryption schemes and ASN.l syntax for the representation of keys and to identify the schemes.
  • the encryption schemes specified in RFC 8017 include RSAES-OAEP, a scheme that combines the RSA encryption primitive (RSAEP), the RSA decryption primitive (RSADP), and the EME-OAEP encoding method, which is based on the optimal asymmetric encryption scheme by Bellare and Rogaway .
  • Users of the system can be people who visit locations and possibly have contact with other people at these locations, or people who are assigned to a location that is equipped with a marker.
  • Figure 3 shows relevant components of the tracking system:
  • Figure 3 shows a mobile communication device 601 that can communicate with multiple servers of a tracking system, including a registration server 603, a MarkerMarker server 602 and a logging server 607.
  • the mobile communication device 601 can transfer data to Protection of privacy using a public key of the tracking system + k_ts 612 and encrypting using a public key of an authorized organization + k_eo 613.
  • the mobile communication device 601 has a local memory 604 that contains a user ID that was received from a server of the tracking system and a user key that results from a cryptographic hash function on the user device and thus produces a hash value that Contains personal contact information and password.
  • the local storage 604 also contains a data element C-contact which is the result of a method executed on the user device that generates an encrypted data element using the cryptographic function of / for a public key and which, as the public key, is the public key of an authorized person Organization and personal contact information used as input data.
  • the tracking system supports the following methods: user registration method, user authentication method, marker creation method, marker reading method, encrypted logging method, tracking authorization method, contact transmission method, statistics transmission method.
  • Users can perform a user registration process with the tracking system.
  • a user of the tracking system When registering a person, a user of the tracking system enters personal contact information, a PIN or a password, and attributes of the person such as area code and age.
  • the user device and a server of the tracking system perform a registration protocol that uses cryptographic methods including encryption and cryptographic hash functions with cryptographic keys of the tracking system and the authorized organization. After the registration process is complete, the
  • the registration data record can contain a user ID, a user-specific key (referred to as a userkey) and encrypted data with attributes of the person (such as area code and age).
  • the user registration process can include the following technical functions: It can receive input data, including personal contact information (PCI) and a PIN code or password (PW) as well as a country and / or area code and optional personal attributes such as age. It can generate an encrypted data element (called c-contact) that contains personal contact information (PCI) and can be decrypted by an authorized organization. It can generate a local structure for personal data that contains personal attributes such as age and area code of residence, as well as the encrypted data element with personal contact information. It can generate a user-specific key (called a userkey).
  • One possibility of generating the user key is that a method is carried out on the user device that generates a hash value using a cryptographic hash function and uses input data from the local structure of personal data.
  • Attributes of a person can include the area code of the place of residence and age.
  • the attributes are encrypted so that they can be decrypted by the tracking system.
  • the data element with the encrypted area code is called the c-area code.
  • the data element with the encrypted age is called c-age.
  • It can compose a registration message using a data structure that contains the user-specific key (userkey) and personal attributes (c-attributes) that can be decrypted by the tracking service provider and sends the registration message to the tracking system's registration server. It can receive a unique user ID (called a userid) from the tracking system.
  • One way of generating the user key is for the registration server to carry out a method that uses a cryptographic hash function to generate a hash value and uses input data from the registration message. It can complete the registration process on the user device by updating the local structure of the personal data, which contains the following data elements: userkey, userid, c-contact and c-attributes (with c-area-code and c-age).
  • Figures 4, 5 and 6 show details of a possible instantiation of the user registration process.
  • the generated cryptographic hash value is a 256-bit long binary value with the character representation chpwdXYZ 605.
  • Figure 5 shows a first message 700 that is sent in the user registration from the mobile communication device 601 to the registration server 603, which contains the user key 701 as a plain text file and which has a data structure 702 with encrypted attributes contains, in this example with two encrypted data elements, in this example c-area-code and c-age.
  • the first encrypted data element c-area-code is generated on the user's mobile communication device by a cryptographic function of the tracking system with a public key + k_ts and the area code.
  • the second encrypted data element c-age is generated on the user's mobile communication device by a cryptographic function with a public key of the tracking system + k_ts and the age of the user.
  • FIG. 6 shows a second message 703 which is sent in the user registration from the registration server to the mobile communication device and contains a user ID which is then stored in the local memory of the mobile communication device.
  • Users of the tracking system can perform user authentication in order to gain access to additional methods for registered users.
  • the tracking system can perform user authentication by checking whether a particular person knows both the personal contact information and the password.
  • a user When performing user authentication, a user must enter both information elements, the personal contact information and the password, into his mobile communication device, whereupon a user-specific key (userkey) is generated there.
  • a user-specific key (userkey)
  • One possibility of generating the user key is to generate a hash value from personal contact information and the password on the user device using a cryptographic hash function.
  • the resulting cryptographic hash with the user-specific key (userkey) is transmitted to a server in the tracking system, where it can be compared with a stored user key. If the keys match each other, the user authentication was successful, which implies that the authentic user performed the user authentication.
  • the tracking system is able to carry out user authentication with any number of messages that a mobile communication device sends to a server of the tracking system by inserting a user-specific key (userkey) into these messages.
  • User authentication with any number of messages can be performed if these messages are a Data element is attached that contains the user-specific key (userkey) in the form of an HTTP cookie, as specified in RFC 6265.
  • Locations can be registered in the tracking system by performing a location registration. Technically, there does not have to be a difference in the registration process of people and places. There is a difference in the content of the attributes. Attributes of a location can contain one or more location descriptions, while attributes of a person can contain personal information such as age.
  • a user of the tracking system enters the contact information of a person or organization associated with the location, a PIN or a password, as well as location attributes such as the area code and a location description.
  • the user device and a server of the tracking system perform a registration protocol that uses cryptographic functions including encryption and cryptographic hash functions with cryptographic keys of the tracking system and the authorized organization.
  • the user device has set up a local data structure with a user ID and the tracking system has entered a registration data record in its registration log.
  • the registration data record can contain a user ID, a user-specific key (userkey) and encrypted data with attributes of the location (such as area code and location description).
  • the method for location registration can include the same technical functions as the method for person registration.
  • a notable difference between the technical functions of location registration and person registration is that the encrypted data element with attributes (abbreviated c-attributes) can contain different attributes (location-specific attributes instead of personal attributes). Attributes of a location can contain one or more location descriptions. Data elements with encrypted location descriptions are called c-loc-des.
  • the user device After completion of the location registration process, the user device has a local location data structure that contains the following data elements: userid, userkey, c-contact and c-attributes (with c-area-code and c-loc-des).
  • Authenticated users can carry out a marker creation process. After completing a registration process for a person or a location, the user device has set up a local data structure with a user ID. During marker creation, a person-related or location-specific marker is created that can be read by mobile communication devices that use the tracking system. QR code markers are an important type of marker for the tracking system. A possibility, To create a QR code marker for a person or place, create a URL with the protocol and domain name of a tracking system scan server, followed by a path containing a string representation of the user ID.
  • the protocol is https
  • the domain name of the scan server is tag.qroniton.eu and the path with the character string representation of the userid is 123
  • the result is the tag URL: https://tag.qroniton.eu/123 .
  • the resulting QR code containing this URL is specific to a person or place.
  • Authenticated users can perform a marker reading process.
  • a marker reading device of a user of the tracking system In order to carry out a marker reading process, a marker reading device of a user of the tracking system must read out the information from a marker. The marker reading device then contacts a server of the tracking system using the information it has read from the marker. To establish contact with a server of the tracking system, a marker reading device derives a URL from the information read out by the marker, which URL specifies a specific resource of a server of the tracking system. If the URL read by the marker is an Internet resource that is accessible on the server of the tracking system, the marker reader can use the HTTP protocol to communicate with the server of the tracking system.
  • the marker reader sets up a TLS (Transport Layer Security session) session before exchanging HTTP messages with the server of the tracking system.
  • TLS Transaction Layer Security session
  • the mobile communication device can use an app that can decode the QR code and extract the URL.
  • the marker reader is configured so that an app that can decode a QR code and extract a URL from the QR code, the decoded URL is forwarded to the web browser of the mobile communication device.
  • the device's web browser establishes a session with the tracking system's web server and accesses the web resource on the web server specified in the QR code.
  • the web browser of the marker reading device can carry out this access to a web resource in the form of an HTTP GET request on a server that is specified by the DNS name of the URL and the path specified in the path section of the URL. If the local memory of the mobile communication device contains the data that were created during user registration and user authentication, the marker reading device transmits user-specific data to the contacted server of the tracking system. This data record contains a user-specific identifier (userid). The marker reader can transmit a data element that contains the user-specific identifier (userid) in the form of an HTTP cookie, as specified in RFC 6265.
  • the contacted server of the tracking system After accessing the tracking server resource indicated by the marker url and the When the data record containing a user-specific identifier (userid) is transmitted, the contacted server of the tracking system can recognize that it has been contacted by a marker reading device that has carried out user registration and user authentication. If a marker reading device contacts the server of the tracking system and does not transmit a data structure with a user-specific identifier (userid) obtained from the user registration, the contacted server can transmit data to the marker reading device, which informs about the need for user registration. The server of the tracking system can directly initiate that the marker reading device displays a user interface of the user registration process.
  • FIG. 7 shows the components involved in the tracking system: a marker 801 in the form of a QR code which contains a URL 802 as information, a mobile communication device 601 with a local memory 604 which contains a data structure that contains the data elements for userid, userkey and c- contact contains, a scan server 602 with a DNS name 607 and a registration server 603 with a DNS name 606.
  • the mobile communication device 601 reads the information from the marker 801, which has the URL https: / /tag.qroniton.eu/123 contains.
  • FIG. 7 shows the components involved in the tracking system: a marker 801 in the form of a QR code which contains a URL 802 as information, a mobile communication device 601 with a local memory 604 which contains a data structure that contains the data elements for userid, userkey and c- contact contains, a scan server 602 with a DNS name 607 and a registration server 603 with a DNS name 606.
  • the mobile communication device 601 reads the information
  • FIG. 8 shows a first message of the marker reading method in which the mobile communication device contacts the marker server with the DNS name tag.qroniton.eu with an http-get request on the path 123.
  • FIG. 9 shows a second message of the marker reading method in which the marker server with the DNS name tag.qroniton.eu replies with a message 804 with the data structure 805 which contains two data elements, a first data element being the userid of the marker is (in this example with the string representation 123) and a second data element, which is sitekey, is a unique key that is specific to that location in the particular time window.
  • the mobile communication device can then store both data elements in its local memory 604.
  • Authorized users can carry out an encrypted logging process.
  • the encrypted logging process is carried out by the mobile communication device with the intention of transmitting encrypted presence or contact information to the logging server of the tracking system, which maintains a cryptographic protocol.
  • the cryptographic protocol contains data records that are encrypted in such a way that contact tracking can only be carried out in those cases in which a user has authorized the tracking system to carry out contact tracking.
  • FIG. 10 shows details of a possible instantiation of the encrypted logging method.
  • Figure 10 shows the mobile communication device 601 that a message with a data structure 807 to the logging server 608 with the DNS name log.qroniton.eu 609.
  • the data structure 807 can contain multiple data elements which are then stored in the cryptographic protocol of the logging server.
  • the data structure 807 contains the following data elements:
  • the data structure 807 contains the useridl of the marker that was read in the marker reading process that was carried out directly before the encrypted logging process, and transmits the information that the mobile communication device is connected the location marked with marker 801.
  • the data structure 807 contains the userid2 of the user of the mobile communication device, which shows that the person associated with the mobile communication device was present at the location identified by the marker 801.
  • the data structure 807 also contains the data element of the siteid, which was generated on the mobile communication device by executing a cryptographic hash function, with the data input of the sitekey, which the mobile communication device received from the marker reading process.
  • the data structure 807 also contains the encrypted data element contact that was generated by a symmetric cryptographic function, AES in the example of FIG. 10, with a cryptographic key, the sitekey, which was obtained from the marker reading process, and the encrypted data element c- contact from local storage.
  • AES symmetric cryptographic function
  • Users can perform a tracking authorization process.
  • a tracking authorization process In cases where a user wishes to indicate that their contact and presence information stored by a logging server of the tracking system can be used to carry out contact tracking, the user enters his password when prompted to do contact tracking to authorize.
  • One possibility to authorize the contact tracking is that the user reads a certain marker for the authorization of the contact tracking with his mobile communication device and then enters his personal contact information and his password.
  • Users can perform a contact transfer method. Users can express that the information about their contacts will be transferred to an authorized organization by entering their personal contact information and password when asked to authorize the contact transfer.
  • Users can perform a method for transmitting statistics.
  • a user can use his mobile communication device to initiate methods for the transmission of statistics.
  • One way of starting this method is for the user device to have a reads certain marker created for this purpose.
  • Another possibility for initiating the method for transmitting statistics is that a user visits a statistics website of the tracking system with his mobile communication device and carries out a user authentication.
  • the result of the method for transmitting statistics can include that the user interface of the mobile communication device displays user-specific statistics, as is shown in elements 14 and 15 of FIG.
  • the architecture of the tracking system has several features that improve data protection, IT security and privacy. Not all functions of all methods of the tracking system need to be performed by servers of an operator of tracking servers. Alternatively, certain functions and methods of the tracking system can be executed by certain apps on the mobile communication device of a user.
  • One possibility for an app that can implement a method of the tracking system on the mobile communication device of a user is an app that carries out the marker reading method.
  • Another possibility for an app that can implement a method of the tracking system on the mobile communication device of a user is an app that carries out the encrypted logging method.
  • these apps must support functions for the authorization process of the tracking system so that the data stored by the app can be made accessible to an authorized organization in order to track contact and presence information of a specific person in an authorized case.
  • the architecture of the tracking system enables a further improvement in terms of data protection, IT security and privacy by allowing multiple independent tracking service providers to operate multiple tracking systems in parallel, thereby limiting the amount of data that each tracking system collects. If several tracking systems are operated in parallel, a single authorized organization, e.g. a specific health authority, can carry out an authorization procedure with all relevant tracking service providers in order to implement the contact tracking of a specific case. This enables the authorized organization to receive all relevant presence and contact information for this case from all relevant tracking service providers.
  • this property of the architecture of the tracking system enables the parallel operation of several tracking systems, which strengthens data protection, IT security and privacy from the point of view of individual users and from the point of view of society as a whole.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention porte sur un système de suivi qui permet la collecte d'informations concernant des personnes qui sont présentes à un moment spécifique à un emplacement spécifique, lequel système utilise un dispositif de communication mobile (par exemple, un téléphone intelligent), chiffre les informations de présence et les transmet dans une forme de protection de la confidentialité à un fournisseur de données de suivi. Le système utilise des marqueurs (par exemple, des marqueurs de code QR) qui contiennent un localisateur uniforme de ressources (URL). Des emplacements sélectionnés sont fournis avec des marqueurs d'un fournisseur de services de suivi. Les utilisateurs du système de suivi enregistrent leurs informations de contact personnelles (par exemple, un numéro de téléphone) et un code PIN ou un mot de passe qu'ils ont choisi. Le système de suivi permet à des personnes de lire des marqueurs afin d'enregistrer leur présence à un emplacement à un moment spécifique et de stocker des informations de présence chiffrées sur un serveur. Le système de suivi peut utiliser différents serveurs (par exemple, un serveur d'enregistrement, un serveur de marqueur et un serveur de journalisation) qui peuvent être actionnés par différentes organisations. Le chiffrement d'informations de présence est réalisé à l'aide de différentes techniques de chiffrement et de différentes clés cryptographiques. Afin de protéger les informations de présence d'utilisateurs du système de suivi, lesdites informations sont stockées dans des journaux du système, des données de présence sont chiffrées au moyen de clés cryptographiques. Pour accéder à des informations de présence et des données personnelles, une combinaison de clés cryptographiques de personnes individuelles et d'organisations autorisées est nécessaire. En raison des propriétés assurant la confidentialité du système de suivi, il peut être garanti qu'une procédure d'autorisation doit être effectuée pour chaque demande de suivi de contact à une organisation autorisée. Le système peut être utilisé pour suivre des chaînes d'infection d'une maladie infectieuse par une organisation autorisée (par exemple, une autorité de santé). Lors de l'utilisation du système pour suivre des chaînes d'infection, une organisation autorisée peut effectuer un suivi de contact numérique de personnes qui ont été présentes au même emplacement, ou de personnes qui avaient un contact direct l'une avec l'autre. Le système de chiffrement utilisé par le système de suivi garantit la souveraineté des utilisateurs sur leurs données personnelles et des informations de présence. Le consentement de l'utilisateur est nécessaire de telle sorte que des organisations autorisées peuvent accéder auxdites données, et est mis en œuvre techniquement par cryptographie.
PCT/DE2021/000059 2020-04-05 2021-04-04 Système de suivi assurant la confidentialité WO2021204313A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21725684.1A EP4136860A1 (fr) 2020-04-05 2021-04-04 Système de suivi assurant la confidentialité

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102020002148.4 2020-04-05
DE102020002148.4A DE102020002148A1 (de) 2020-04-05 2020-04-05 Privatsphäre-erhaltendes Nachverfolgungssystem

Publications (1)

Publication Number Publication Date
WO2021204313A1 true WO2021204313A1 (fr) 2021-10-14

Family

ID=75919166

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/DE2021/000059 WO2021204313A1 (fr) 2020-04-05 2021-04-04 Système de suivi assurant la confidentialité

Country Status (3)

Country Link
EP (1) EP4136860A1 (fr)
DE (1) DE102020002148A1 (fr)
WO (1) WO2021204313A1 (fr)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180052970A1 (en) * 2016-08-16 2018-02-22 International Business Machines Corporation Tracking pathogen exposure

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180052970A1 (en) * 2016-08-16 2018-02-22 International Business Machines Corporation Tracking pathogen exposure

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ALTUWAIYAN THAMER ET AL: "EPIC: Efficient Privacy-Preserving Contact Tracing for Infection Detection", 2018 IEEE INTERNATIONAL CONFERENCE ON COMMUNICATIONS (ICC), IEEE, 20 May 2018 (2018-05-20), pages 1 - 6, XP033378868, DOI: 10.1109/ICC.2018.8422886 *
DIDEM DEMIRAG ET AL: "Tracking and Controlling the Spread of a Virus in a Privacy-Preserving Way", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 29 March 2020 (2020-03-29), XP081631268 *

Also Published As

Publication number Publication date
EP4136860A1 (fr) 2023-02-22
DE102020002148A1 (de) 2021-10-07

Similar Documents

Publication Publication Date Title
EP3447667B1 (fr) Sécurité cryptographique pour un stockage de données réparti
DE60028778T2 (de) Verfahren zur erhaltung und verteilung von individuellen sicherungseinrichtungen
DE60114986T2 (de) Verfahren zur herausgabe einer elektronischen identität
EP3033855B1 (fr) Assistance à un déchiffrement de données chiffrées
DE60211841T2 (de) Vorrichtung zur Aktualisierung und zum Entzug der Gültigkeit einer Marke in einer Infrastruktur mit öffentlichen Schlüsseln
DE112018005628T5 (de) Datenbereinigungssystem für eine öffentliche Host-Plattform
EP3031226B1 (fr) Assistance pour l'utilisation d'une clé secrète
EP2289016B1 (fr) Utilisation d'un appareil de télécommunication mobile comme carte de santé électronique
DE102010053651B3 (de) Verfahren und Verwendung eines Systems zur ortsbeschränkten Anzeige lesbarer Inhalte auf einem mobilen Lesegerät
DE10065667A1 (de) Verfahren und Vorrichtung zur Gemeinschaftsverwaltung bei einem Vornehmen von Diensten bei entfernten Systemen
AT512289A4 (de) Kryptographisches authentifizierungs- und identifikationsverfahren für mobile telefon- und kommunikationsgeräte mit realzeitverschlüsselung während der aktionsperiode
DE60309216T2 (de) Verfahren und vorrichtungen zur bereitstellung eines datenzugriffs
DE112018001616T5 (de) Sichere systeme und verfahren für abtastbare codes
DE102021205259A1 (de) Erstellung von beschränkten mobilen konten
EP3672142B1 (fr) Procédé et système de transmission sécurisée d'un ensemble de données
AT519025B1 (de) Verfahren zum Austausch von Datenfeldern von zertifizierten Dokumenten
EP3319003B1 (fr) Procédé et système d'authentification d'un appareil de télécommunication mobile sur un système informatique de service et appareil de télécommunication mobile
EP3248324B1 (fr) Des operations decentralisés sur un produit en utilisant des données chiffrées dans un storage central
Helm Distributed Internet voting architecture: A thin client approach to Internet voting
EP4136860A1 (fr) Système de suivi assurant la confidentialité
DE202020005623U1 (de) Privatsphäre-erhaltendes Nachverfolgungssystem
Friedman et al. The need for digital identity in cyberspace operations
EP1571591B1 (fr) Utilisation d'étiquettes RFID pour accéder à une page hypertexte depuis un appareil mobile
DE102012220774B4 (de) Verfahren zur Durchführung von Transaktionen
EP1248432B1 (fr) Méthode et système d'interrogation de données de certificat utilisant des références de certificat dynamiques

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21725684

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021725684

Country of ref document: EP

Effective date: 20221107