全球COVID-19联络追踪应用经验评估 (An Empirical Assessment of Global COVID-19 Contact Tracing Applications)

The rapid spread of COVID-19 has made manual contact tracing difficult. Thus, various public health authorities have experimented with automatic contact tracing using mobile applications (or "apps"). These apps, however, have raised security and privacy concerns. In this paper, we propose an automated security and privacy assessment tool, COVIDGUARDIAN, which combines identification and analysis of Personal Identification Information (PII), static program analysis and data flow analysis, to determine security and privacy weaknesses. Furthermore, in light of our findings, we undertake a user study to investigate concerns regarding contact tracing apps. We hope that COVIDGUARDIAN, and the issues raised through responsible disclosure to vendors, can contribute to the safe deployment of mobile contact tracing. As part of this, we offer concrete guidelines, and highlight gaps between user requirements and app performance.

翻译：由于COVID-19的迅速推广,难以进行人工联系追踪,因此,各公共卫生当局已尝试使用移动应用程序(或“应用程序”)进行自动联系追踪,但这些应用程序引起了安全和隐私方面的关切。在本文件中,我们提议采用自动安全和隐私评估工具COVIDGUARDIAN,将个人身份资料的识别和分析、静态方案分析和数据流分析结合起来,以确定安全和隐私方面的弱点。此外,根据我们的调查结果,我们开展了一项用户研究,以调查对联系追踪应用程序的关切。我们希望,COVIDGUARDIAN和通过向供应商负责披露而提出的问题,能够有助于安全部署移动联系追踪。作为这项工作的一部分,我们提供了具体的指导方针,并突出了用户要求与应用程序性能之间的差距。