[PDF] DESIRE: A Third Way for a European Exposure Notification System

View - Download DESIRE: A Third Way for a European Exposure Notification System

Previous PDF

Next PDF

DESIRE: A Third Way for a European Exposure

Notication System

Leveraging the best of centralized and decentralized systems

Claude Castelluccia

Nataliia Bielova

Antoine Boutet

Mathieu Cunche

Cedric Lauradoux

Daniel Le Metayer

Vincent Roca

PRIVATICS Team

y, Inria, France desire-contact@inria.fr

May 9, 2020

v1.0 ROBERT

DESIRE

ROBERT

Private Encounter Tokens

DESIRE

PETs PETs

ROBERT

Claude Castelluccia is the contact author. The other co-authors are listed in alphabetical order. y

The authors would like to thank Karthikeyan Bhargavan, Bruno Blanchet, and David Pointcheval for their comments and

suggestions about this paper.

1Available athttps://github:com/ROBERT-proximity-tracing/documents

Contents

1. Introduction3

2. DESIRE Protocol Description

6

RTLETL

3. Risk Analysis11

4. Towards a State-less DESIRE

12

Appendix A. Authorization Token Generation

14

Appendix B. Towards Probabilistic Notications

15

Appendix C. Bluetooth communications

15 scan response

1. Introduction

1.1. DESIRE: Leveraging the best of centralized and decentralized systems

DESIRE

DESIRE

PET PET PET

1.2. Private Encounter Tokens (PETs)

Private Encounter TokensPETs Ephemeral Bluetooth IdentiersEBID

EBIDsPETs unlinkable

PET secret

Non-Interactive Key Exchange NIKE

PET p g i

A EBID g X A

Curveg

EBIDg B A g

g PETHg H

B g g

PETHg

PET Hg XY

AB 2 Epochs are synchronized with the device address randomisation periods. 4

As we will see later, each node actually maintains 2 lists to prevent linkability between the PETs that are used to query

the server and the PETs that are uploaded if the node is diagnosed positive.

PET EBID

It is noteworthy thatPETtokens are not specic toDESIREand could benet to other existing proximity-tracing proposals.

1.3. Protocol Overview

DESIREApp

Initialization:

App App

IDTable

IDTable

Proximity Discovery: A

{ EBID { EBID {EBIDs

PET EBIDs

PET

Infected User Declaration:

diagnosed PET

EList PET

Exposure Status Request:App

PET

App EList

App 5 As described in Section2.2, the device actually uses 2 lists.

Time-related Assumptions:DESIRE

epochdurationsec

Roaming Considerations:

NameDescription

App DESIREApp

UAT UBLE CT EBID EBID U iEK U

IDTableEList

epochdurationsec ERS

UESRREQ App ESRREP

ETL App U ID

U IDTable

LEPM

U IDTablePET

RTL App

U SRE

U

IDTableESRmin ESRREQ

UN U UN IDTable1.4. Risk Scoring and Notication Considerations 6 7

This value of 15 minutes is the rotation period of random address recommended in the Bluetooth v5.1 specication [10,

Vol 3, Part C, App. A]).

8Bluetoothdevice addressis sometime calledMAC address

2. DESIRE Protocol Description

2.1. Application Initialization

U AppU authorization token generation user registration

Authorization Token Generation

User Registration U AT

U AT

ID

IDTable

-ID(\Permanent IDentier for A"): -UN(\User A Notied"): -SRE(\Status Request Epoch"): U -LEPM(\List of Exposed PET Metadata") 9

The need to adjust the algorithm to re

ect policy changes is also stressed in [9]: \It is to be expected that the optimal solution will likely involve a number of successive scenarios to re ect an early need to capture as many infections as

possible and a later need to avoid quarantining of too many people as the epidemic declines and re-introductions are

monitored." 10

Just to take an example, in a decentralized approach, where the risk calculation algorithm is computed on users' devices,

the health authority is not aware of the number of exposed people. This information is essential both for statistical

purposes and to easily adjust the risk calculation algorithm. 11

This table could be extended to include additional information useful to improve the risk scoring function or necessary for

the epidemiologists. -ERS(\Exposure Risk Score") U EK IDEKU

EK IDTableID ID

EK AT

2.2. Encounter discovery

AEBIDg BEBIDg A

PETHjg PETHjg PETRTLPETETL

BPETHjg PETHjg PETETL

PETRTL

2.2.1. Protocol description

A Exposure Token ListETL Request Token ListRTL

At each epochiof dayday, nodeA

AEBID

A EBIDg

EBID

RTLETL

CT CT

At eachencounterwith nodeB, nodeA(see Figure 2):

EBIDg B12

We recommend the use of an authenticated encryption scheme. 13

In practice the server can generate authorization tokens that are only valid for a certain number of days (by changing his

Public/Private key pair regularly), which would reduce the storage load on the server. A t PETs PET Hjg PET Hjg g g

PETRTL PET;t;day ETL

APETRTL PET;t;day ETL

g

2.2.2. Why using two lists,RTLandETL?A B PETsPETPET

ETLRTL

A PET

A ESRREQ

EList A A

B PET

PET AB ESRREQ

PET ETL

2.2.3. PET Generation Synchronization

A EBID B EBID

t PET

A EBIDEBID t

A

EBID t

B EBID A

A PET tt tt

PET

PET A B

AB PET14

Conditions could be based on the encounter duration, number of receivedEBIDs, signal strength, etc. - to be dened

with epidemiologists. 15

This test can be generalized.AandBonly need to implement a total ordering function that given 2 inputsI1andI2

known by A and B outputs an order between A and B. 16

Note that this tuple could be extended dynamically, upon request from the server, with information, such as reception

signal strength, that could be useful to the health authority compute the risk score.

17NodeBdoes the inverse, i.e. it storesPET2iinRTLBand (PET1A;i;tA;B;day) tuple inRTLB.

18NodeBstoresPET1iinRTLBand (PET2A;i;tA;B;day) tuple inRTLB).

19

To avoid generating and storingPETtokens that are very brief, it might be reasonable to only generate aPETtoken if

its encounter duration is larger than a certain value (for example, 2-3 minutes).

PET PET DESIRE A

PET EBID EBID

B A

EBID B B A g

T B Tt Ttt A EBID

A PETHg

t Ttt B g

PETHg t

2.3. Infected node declaration

U ETL App U EBIDs ETL

ETL ETL

ETL Mixnet

ETL ETL ETLs 20

One possible solution is that the user obtains an authorization code from the hospital or the medical oce when it is

diagnosed COVID-positive. The User can then use this code to obtainNanonymous authorization tokens, whereNis

the number of elements inUA'sETLlist (see Appendix A).UAcan then used these tokens to upload each ofETLA's

element one by one. 21

Since all mobile telecom operators are using NAT, it should be studied when the use of a Mixnet or proxy is really needed.

ETLs

EList token;day;t

2.4. Exposure Status Request

U

CT App ESRREQ

ID ESRREP

A ESRREQ

IDEK PET RTL

IDTableID EK

iSRE i

ESRmin U

ESRREP

IDTableID EK EK

UN UNtrue ESRREP

IDTableID

EK EK

PET RTL token;day;t

EList EList day;t

LEPM IDTableID

U IDTableID ERS

UN true ESRREP

ESRREP

IDTableID EK

EK

ESRREP

U App

A PET ETL

RTL RTL

T RTL

N TA TN N TA

T RTL RTL

22

The queries are sent regularly and at most everyESRminepochs. If a user is allowed to performNqueries per day,

ESRminis dened asT= 86400=(Nepochdurationsec).

23

Note that it is good practice for an application whose user is already notied "at risk" to keep on sendingESRREQ

queries and receiveESRREQmessages to make this application trac indistinguishable to any other application when

observing the generated network trac. 24

Note that server could also store theRTLtokens generated in the lastCTinIDTable. That would save some bandwidth

(since a node would only need to send it daily token in itsESRREQqueries). In addtion, this would improve security

on the phone that would only store the daily tokens locally.

2.5. Notied node management UN IDTable

ESRREQ ESRREP

ESRREQ

{ ETL ID ETL

PET ID

ID UN EBID PET ETL

3. Risk Analysis

Server Data Breaches:

quotesdbs_dbs33.pdfusesText_39

[PDF] les poètes maudits baudelaire

[PDF] est-ce refuser le monde tel qu'il est ?

[PDF] les poetes maudits verlaine rimbaud baudelaire

[PDF] approche participative dans les projets de développement

[PDF] poètes maudits noms

[PDF] approche participative communautaire

[PDF] maryam mirzakhani phd thesis

[PDF] approche participative définition pdf

[PDF] les poètes maudits mouvement

[PDF] maryam mirzakhani thesis pdf

[PDF] approche participative en sociologie

[PDF] pascendi dominici gregis pdf

[PDF] poètes maudits mouvement littéraire

[PDF] parenté entre l'egypte et le sénégal pdf

[PDF] pascendi pdf