TraceCORONA – Anonymous contact tracing for pandemic response

TraceCORONA is designed to be not only a tracing app, but a system concept that allows the TraceCORONA tracing component as well as other possible tracing apps to integrate into a secure health platform for private healthcare-related services over a well-defined secure interface.

The new strain of coronavirus causing the respiratory disease COVID-19 spreads rapidly around the globe and became a global pandemic in just 3-4 months from the beginning of its existence (reference). The social distancing and contact tracing became key strategies in slowing down the spread of the virus, and it is likely they will remain primary countermeasures until specific COVID-19 treatment becomes available.

So far, contact tracing is often performed manually and requires significant efforts from public health stuff workers to help infected patients to recall their close social contacts and use this information to build infection chains (reference). While obtained with high efforts, this information may be incomplete or even erroneous; resulting in overestimation extra costs for unnecessary testing and underestimation and missing cases. Hence, new methods for more reliable, precise and cost-effective contact tracing are needed.

Using advanced digital tracing apps on mobile devices can help reduce manual effort and significantly increase tracing accuracy. This has already been successfully demonstrated in Asia (e.g., Singapore, China, Korea). However, Asian tracking technologies do not consider privacy requirements and collect highly sensitive data from individuals, such us their geographical locations and encountered contacts, by centralized servers. However, different counties have different data protection and privacy regulations, and in particular, US and European countries have more restrictive regulations that prohibit collection of privacy-sensitive data in clear form. Hence, in Europe and US scientists and technologists are investing effort in developing tracing apps that can provide an appropriate level of privacy.

Our approach, dubbed TraceCORONA, uses Bluetooth Low Energy and the ECDH key exchange algorithm to exchange tokens, which stay on the users' local devices. The tokens are only distributed among other app users in case of confirmed infection, and even in this case the tokens are disseminated in anonymized form. Only the owners of the original token, which are the two people who originally met, can identify the contact match; figure out when the contact was established for how long it lasted. Hence, the solution is privacy preserving and rules out tracing of users or de-anonymizing infected and endangered users even by the service provider who is collecting and disseminating encounter tokens.

TraceCORONA is developed by an international team of researchers and industry partners spearheaded by the System Security Lab at TU Darmstadt. We are proud to be part of this project.

More information at https://tracecorona.net/

People involved: Prof. A. Dmitrienko, Filipp Roos

Publications

2022[ to top ]

Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges. Thien Duc, Nguyen; Markus, Miettinen; Alexandra, Dmitrienko; Ahmad-Reza, Sadeghi; Ivan, Visconti; in Cryptology ePrint Archive (2022).
- [ BibTeX ]
- [ URL ]
- [ BibSonomy-Post ]
@article{thienduc2022digital, author = {Thien Duc, Nguyen and Markus, Miettinen and Alexandra, Dmitrienko and Ahmad-Reza, Sadeghi and Ivan, Visconti}, journal = {Cryptology ePrint Archive}, keywords = {TraceCORONA}, month = 10, title = {Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges}, year = 2022 }
Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges. Thien Duc, Nguyen; Markus, Miettinen; Alexandra, Dmitrienko; Ahmad-Reza, Sadeghi; Ivan, Visconti; in IEEE Transactions on Emerging Topics in Computing (2022).
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
@article{thienduc2022digital, author = {Thien Duc, Nguyen and Markus, Miettinen and Alexandra, Dmitrienko and Ahmad-Reza, Sadeghi and Ivan, Visconti}, journal = {IEEE Transactions on Emerging Topics in Computing}, keywords = {TraceCORONA}, month = 10, title = {Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges.}, year = 2022 }
Digital contact Tracing solutions: Promises, Pitfalls and Challenges. Thien Duc, Nguyen; Markus, Miettinen; Alexandra, Dmitrienko; Ahmad-Reza, Sadeghi; Ivan, Visconti; in ArXiv I arXiv 2202.06698v2 (October 2022) (2022).
- [ BibTeX ]
- [ URL ]
- [ BibSonomy-Post ]
@article{thienduc2022digital, author = {Thien Duc, Nguyen and Markus, Miettinen and Alexandra, Dmitrienko and Ahmad-Reza, Sadeghi and Ivan, Visconti}, journal = {ArXiv I arXiv 2202.06698v2 (October 2022)}, keywords = {TraceCORONA}, month = 10, title = {Digital contact Tracing solutions: Promises, Pitfalls and Challenges.}, year = 2022 }

2021[ to top ]

Security and Privacy Aspects of Digital Contact Tracing. Roos, Filipp; Thesis; Master Thesis. (2021, October).
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
I am truly thankful to my advisor, Prof. Dr.-Ing. Alexandra Dmitrienko, for her guidance, support and patience throughout the research project and thesis writing process. Special thanks to Thien Nguyen for the discussions and feedback about the security analysis, as well as the rest of the TraceCORONA research and prototyping team at TU Darmstadt, which I am very grateful to have been a part of: Prof. Dr.-Ing. Ahmad-Reza Sadeghi, Dr.-Ing. Markus Miettinen, Joshua Kühlberg, Anel Muhamedagic and Richard Mitev. Without these people this work would not have been possible. Additionally, I would like to express gratitude to my parents, who have encouraged me to never give up, as well as the friends and family members who have helped with proofreading the thesis.

@mastersthesis{roos2021security, abstract = {I am truly thankful to my advisor, Prof. Dr.-Ing. Alexandra Dmitrienko, for her guidance, support and patience throughout the research project and thesis writing process. Special thanks to Thien Nguyen for the discussions and feedback about the security analysis, as well as the rest of the TraceCORONA research and prototyping team at TU Darmstadt, which I am very grateful to have been a part of: Prof. Dr.-Ing. Ahmad-Reza Sadeghi, Dr.-Ing. Markus Miettinen, Joshua Kühlberg, Anel Muhamedagic and Richard Mitev. Without these people this work would not have been possible. Additionally, I would like to express gratitude to my parents, who have encouraged me to never give up, as well as the friends and family members who have helped with proofreading the thesis.}, author = {Roos, Filipp}, keywords = {security}, month = 10, publisher = {Master Thesis}, school = {University of Würzburg}, title = {Security and Privacy Aspects of Digital Contact Tracing}, year = 2021 }
Security Analysis of UniNow App. Zimmermann, Keven; Thesis; Bachelor Thesis. (2021, June).
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
We performed a security analysis of the UniNow application, focusing on private user data. The application was chosen for its high popularity and amount of sensitive information handled through its new contact tracing functionality. This functionality is used by many universities for mandatory contact tracing against COVID-19. Our analysis concerned the Android mobile application and all web services. After mapping the attack surface using many tools to automate the process, we tested the potential issues in order of impact. We reveal multiple security issues with low to critical severity. Most of these vulnera�bilities threatened private user data directly. In particular, we found multiple disclosed secret keys that were used to encrypt user data on the client side, among others. Fur�thermore, we show how an in-app browser as well as an open redirect vulnerability were easing phishing attacks, and how university access tokens were shared with UniNow. Our more severe findings include how sensitive data was sent automatically to Google servers through backup files, how strict SSL certificate checking was disabled deliberately for many university endpoints, how JavaScript could be injected into the email viewer, and how ap�pointment invitations could be brute forced to get sensitive information about past and future appointments. The two critical security issues concern how user accounts could be taken over by using an account identifier, and how an internal service was accessible by anyone, allowing to change university configurations and potentially make user devices sent their user’s university credentials to the attacker. We performed a responsible disclosure, which serves as a reference to UniNow, enabling them to fix the discovered issues. Our work tangibly improves the security of student data handled by the company.

@mastersthesis{noauthororeditor, abstract = {We performed a security analysis of the UniNow application, focusing on private user data. The application was chosen for its high popularity and amount of sensitive information handled through its new contact tracing functionality. This functionality is used by many universities for mandatory contact tracing against COVID-19. Our analysis concerned the Android mobile application and all web services. After mapping the attack surface using many tools to automate the process, we tested the potential issues in order of impact. We reveal multiple security issues with low to critical severity. Most of these vulnera�bilities threatened private user data directly. In particular, we found multiple disclosed secret keys that were used to encrypt user data on the client side, among others. Fur�thermore, we show how an in-app browser as well as an open redirect vulnerability were easing phishing attacks, and how university access tokens were shared with UniNow. Our more severe findings include how sensitive data was sent automatically to Google servers through backup files, how strict SSL certificate checking was disabled deliberately for many university endpoints, how JavaScript could be injected into the email viewer, and how ap�pointment invitations could be brute forced to get sensitive information about past and future appointments. The two critical security issues concern how user accounts could be taken over by using an account identifier, and how an internal service was accessible by anyone, allowing to change university configurations and potentially make user devices sent their user’s university credentials to the attacker. We performed a responsible disclosure, which serves as a reference to UniNow, enabling them to fix the discovered issues. Our work tangibly improves the security of student data handled by the company.}, author = {Zimmermann, Keven}, keywords = {security}, month = {06}, publisher = {Bachelor Thesis}, school = {University of Würzburg}, title = {Security Analysis of UniNow App}, type = {Bachelor Thesis}, year = 2021 }

2020[ to top ]

Contact Tracing by Giant Data Collectors: Opening Pandora’s Box of Threats to Privacy, Sovereignty and National Security. Boutet, Antoine; Castelluccia, Claude; Cunche, Mathieu; Dmitrienko, Alexandra; Iovino, Vincenzo; Miettinen, Markus; Nguyen, Thien Duc; Roca, Vincent; Sadeghi, Ahmad-Reza; Vaudenay, Serge; Visconti, Ivan; Vuagnoux, Martin; (2020).
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ Download ]
- [ BibSonomy-Post ]
Many countries have introduced digital contact tracing apps to fight the COVID-19 pandemic. Such apps help to identify contacts between potentially infectious persons automatically and thus bear the promise of reducing the burden on manual contact tracers and increase tracing accuracy in situations in which people have difficulties identifying with whom they have been in contact. A number of different proposals for digital contact tracing systems have been made or deployed, ranging from heavily centralized to completely decentralized approaches, each with its own advantages and disadvantages in terms of tracing effectiveness and impact on user privacy. During the phase of highly dynamic evolution of these approaches, surprisingly, Google and Apple established an unprecedented friendship and agreed on a very special scheme for contact tracing, realizing this in the form of an API called GAEN that they quickly integrated into their mobile operating systems. A multitude of nationally rolled out tracing apps are now based on the GAEN approach. In this paper, we revisit such apps and the GAEN API on which they are built. In particular, we point out a number of very problematic aspects and threats that the GAEN approach creates through its security and privacy weaknesses but also through the threats that it poses on technological sovereignty and the public health system.

@techreport{boutet2020contact, abstract = {Many countries have introduced digital contact tracing apps to fight the COVID-19 pandemic. Such apps help to identify contacts between potentially infectious persons automatically and thus bear the promise of reducing the burden on manual contact tracers and increase tracing accuracy in situations in which people have difficulties identifying with whom they have been in contact. A number of different proposals for digital contact tracing systems have been made or deployed, ranging from heavily centralized to completely decentralized approaches, each with its own advantages and disadvantages in terms of tracing effectiveness and impact on user privacy. During the phase of highly dynamic evolution of these approaches, surprisingly, Google and Apple established an unprecedented friendship and agreed on a very special scheme for contact tracing, realizing this in the form of an API called GAEN that they quickly integrated into their mobile operating systems. A multitude of nationally rolled out tracing apps are now based on the GAEN approach. In this paper, we revisit such apps and the GAEN API on which they are built. In particular, we point out a number of very problematic aspects and threats that the GAEN approach creates through its security and privacy weaknesses but also through the threats that it poses on technological sovereignty and the public health system.}, author = {Boutet, Antoine and Castelluccia, Claude and Cunche, Mathieu and Dmitrienko, Alexandra and Iovino, Vincenzo and Miettinen, Markus and Nguyen, Thien Duc and Roca, Vincent and Sadeghi, Ahmad-Reza and Vaudenay, Serge and Visconti, Ivan and Vuagnoux, Martin}, institution = {{EPFL, Switzerland ; Inria, France ; JMU W{\"u}rzburg, Germany ; University of Salerno, Italy ; base23, Geneva, Switzerland ; Technical University of Darmstadt, Germany}}, keywords = {collector}, month = 12, title = {Contact Tracing by Giant Data Collectors: Opening Pandora’s Box of Threats to Privacy, Sovereignty and National Security.}, type = {University works}, year = 2020 }
Mind the GAP: Security & Privacy Risks of Contact Tracing Apps. Baumgärtner, Lars; Dmitrienko, Alexandra; Freisleben, Bernd; Höchst, Jonas; Kühlberg, Joshua; Mezini, Mira; Miettinen, Markus; Muhamedagic, Anel; Nguyen, Thien Duc; Penning, Alvar; Pustelnik, Dermot Frederik; Roos, Filipp; Sadeghi, Ahmad-Reza; Schwarz, Michael; Uhl, Christian; in TrustCom, Security Track (2020).
- [ Abstract ]
- [ BibTeX ]
- [ Download ]
- [ BibSonomy-Post ]
Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts with the potential of affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can easily be used on mobile phones or Raspberry Pis (e.g., Bluetooth sniffers). The goal of our work is to perform a reality check towards possibly providing empirical real-world evidence for these two privacy and security risks. We hope that our findings provide valuable input for developing secure and privacy-preserving digital contact tracing systems.

@inproceedings{baumgartner2020security, abstract = {Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts with the potential of affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can easily be used on mobile phones or Raspberry Pis (e.g., Bluetooth sniffers). The goal of our work is to perform a reality check towards possibly providing empirical real-world evidence for these two privacy and security risks. We hope that our findings provide valuable input for developing secure and privacy-preserving digital contact tracing systems.}, author = {Baumgärtner, Lars and Dmitrienko, Alexandra and Freisleben, Bernd and Höchst, Jonas and Kühlberg, Joshua and Mezini, Mira and Miettinen, Markus and Muhamedagic, Anel and Nguyen, Thien Duc and Penning, Alvar and Pustelnik, Dermot Frederik and Roos, Filipp and Sadeghi, Ahmad-Reza and Schwarz, Michael and Uhl, Christian}, booktitle = {TrustCom, Security Track}, keywords = {TraceCORONA}, month = {09}, title = {Mind the GAP: Security & Privacy Risks of Contact Tracing Apps}, year = 2020 }
Mind the GAP: Security & Privacy Risks of Contact Tracing Apps. Baumgärtner, Lars; Dmitrienko, Alexandra; Freisleben, Bernd; Gruler, Alexander; Höchst, Jonas; Kühlberg, Joshua; Mezini, Mira; Mitev, Richard; Miettinen, Markus; Muhamedagic, Anel; Nguyen, Thien Duc; Penning, Alvar; Pustelnik, Dermot Frederik; Roos, Filipp; Sadeghi, Ahmad-Reza; Schwarz, Michael; Uhl, Christian; in ArXiv | arXiv:2006.05914v2 (2020).
- [ Abstract ]
- [ BibTeX ]
- [ URL ]
- [ BibSonomy-Post ]
Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts with the potential of affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can easily be used on mobile phones or Raspberry Pis (e.g., Bluetooth sniffers). The goal of our work is to perform a reality check towards possibly providing empirical real-world evidence for these two privacy and security risks. We hope that our findings provide valuable input for developing secure and privacy-preserving digital contact tracing systems.

@article{mindthegap, abstract = {Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts with the potential of affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can easily be used on mobile phones or Raspberry Pis (e.g., Bluetooth sniffers). The goal of our work is to perform a reality check towards possibly providing empirical real-world evidence for these two privacy and security risks. We hope that our findings provide valuable input for developing secure and privacy-preserving digital contact tracing systems.}, author = {Baumgärtner, Lars and Dmitrienko, Alexandra and Freisleben, Bernd and Gruler, Alexander and Höchst, Jonas and Kühlberg, Joshua and Mezini, Mira and Mitev, Richard and Miettinen, Markus and Muhamedagic, Anel and Nguyen, Thien Duc and Penning, Alvar and Pustelnik, Dermot Frederik and Roos, Filipp and Sadeghi, Ahmad-Reza and Schwarz, Michael and Uhl, Christian}, journal = {ArXiv | arXiv:2006.05914v2}, keywords = {TraceCORONA}, month = {06}, title = {Mind the GAP: Security & Privacy Risks of Contact Tracing Apps}, year = 2020 }

Hubland Süd, Geb. M2

TraceCORONA – Anonymous contact tracing for pandemic response

TraceCORONA is designed to be not only a tracing app, but a system concept that allows the TraceCORONA tracing component as well as other possible tracing apps to integrate into a secure health platform for private healthcare-related services over a well-defined secure interface.

Publications

Data privacy protection

Data privacy protection

Picture credits