The rapid spread of COVID-19 has made traditional manual contact tracing to identify persons in close physical proximity to a known infected person challenging. Hence, various public health authorities have experimented with automating contact tracing with mobile apps. However, these apps have raised security and privacy concerns. In this paper, we propose an automated security and privacy assessment tool - COVIDGuard - which combines identification and analysis of Personal Identification Information (PII), static program analysis, and data flow analysis, to determine security weaknesses and potential private information leakage in contact tracing apps. Furthermore, in light of our findings, we undertake a user study to investigate user concerns regarding contact tracing apps. We hope, COVIDGuard and the issues raised through responsible disclosure to vendors, the concrete guidelines provided, as well as the identified gaps between user requirements and app performance we found, can contribute to the development and deployment of mobile apps against COVID-19 and help us build secure and effective digital contact tracing solutions.
翻译：COVID-19的迅速推广使得传统的手工接触追踪工作具有挑战性,以识别与已知受感染者相近的人,因此,各公共卫生当局已经试验了与移动应用程序进行自动接触追踪,然而,这些应用程序引起了对安全和隐私的关切,我们在本文件中提议一个自动安全和隐私评估工具COVIDGuard,该工具将识别和分析个人身份信息(PII)、静态程序分析和数据流分析结合起来,以确定联系追踪应用程序中的安全弱点和潜在的私人信息渗漏。此外,根据我们的调查结果,我们开展了一项用户研究,以调查用户对联系追踪应用程序的关切。我们希望,COVIDGuard和通过向供应商负责披露而提出的问题,所提供的具体准则,以及查明的用户要求与我们发现的应用程序性能之间的差距,能够有助于开发和部署针对COVID-19的移动应用程序,帮助我们建立安全和有效的数字联系追踪解决方案。
相关内容
微信扫码咨询专知VIP会员