Block Lattice Architecture Or Blockchain? DLT or DAG? Europeans Rally on GDPR-Compliant, Open Source, Cross-Border Framework for Phone Application Development

boss

europe, decentralised, privacy, proximity, tracing, covid19, coronavirus, government, security, health, healthcare

ADVERTISEMENTS

A team of close to 130 people from 17 institutes, organisations and companies in Europe is developing a technology that is intended as an alternative to privacy-invading tracking technologies used in some countries in Asia to combat the COVID-19. Top experts from multiple European nations are working on an open-source Pan-European Privacy-Preserving Proximity Tracing initiative (PEPP-PT) to provide a complete framework and reference implementation to track and stop the transmission of COVID-19 rapidly and effectively by informing potentially exposed people they are carriers and still adhere to the EUโ€™s heavy privacy regulations.

Decentralized Privacy-Preserving Proximity TracingThe core technology will detect users close enough to infect each other by analysing Bluetooth signals between mobile phones.

donate to Blockchain News

โ€œGiven these divergences, the European Data Protection Supervisor calls for a pan-European model COVID-19 mobile application, coordinated at EU level,โ€ stated the head of the EU privacy watchdog, Wojciech Wiewiorowski. โ€œIdeally, coordination with the World Health Organisation should also take place, to ensure data protection by design globally from the start,โ€ he said to Reuters in a statement.

Interestingly there is no evidence at Github at press time, of any code yet and there has been no official statement of integrating Blockchain, Distributed Ledger Technology (DLT), Directed Acyclic Graphs (DAG) or Block Lattice Architecture (BLA) to help with privacy.

The project manifesto is after all โ€œDecentralised Privacy-Preserving Proximity Tracingโ€ gives the impression that itโ€™s highly likely some kind of block-related technology will be used.

There is speculation that blockchain might and should be part of the framework in various places online.

Have you thought about storing the collected data on a blockchain (instead of regional central servers) for better international tracking? (e.g. self-quarantine indicated by the user, laboratory digitally signed positive test result or antibody test result) @marcelsalathe @PeppPt

โ€” Ralph (@Szeta) April 1, 2020

The Github pages have little to offer on the technology yet, with a scant three-page brief, some general information about security and data protection and a White Paper drilling down, in parts, into the cryptographic aspects of a potential solution. It also states the decentralised proximity tracing process requires the participation of infected patientโ€™s smartphones, all other smartphones, the backend, and the health authority. The backend will act solely as a communication platform and does not perform any processing.

This means that they need to manage the data in a distributed, decentralised network.

This, of course, aims to deal with a plethora of potential privacy concerns. But the group states they are aiming at putting privacy first and justly so as the European Union has spent time, effort and money at creating the General Data Protection Regulations (GDPR) for all member states.ย  The GDPR aims primarily to give control to individuals over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

Linus Neumann, the spokesperson of the German Chaos Computer Club, has written a thorough list on what the PEPP-PT should aim to adhere with.

He states:

โ€œNo central entity that needs to be trusted A completely anonymous โ€œcontact tracingโ€ without omniscient central server is technically possible. It is not technically necessary to rely solely on the trustworthiness and competence of an operator of a centralised infrastructure and to sufficiently protect usersโ€™ privacy.โ€

โ€œWe, therefore, reject concepts based on this from the outset as questionable. In addition, the security and trustworthiness of centralised systems โ€“ for example against linking IP addresses with anonymous user IDs โ€“ cannot be effectively checked for the users.โ€

โ€œThe security and confidentiality of the process must therefore only be guaranteed by the encryption and anonymisation concept and the verifiability of the source code.โ€(Translated via Google Translate)

The Chaos Computer Club is Europeโ€™s largest association of hackers with 7700 registered members. Notable members of the CCC regularly function as expert witnesses for the German constitutional court, organise lawsuits and campaigns, or otherwise influence the political process.

Organisers of the pan-European project state that itโ€™s important to note that PEPP-PT is about proximity tracing, not contact or location tracking.

Some of the experts involved, such as Prof. Bart Preneel (Flemish cryptographer and cryptanalyst) from the University of Leuven, Oxford Universityโ€™s Dr. Reuben Binns (on the investigative Decentralised Personal Data team of UK thinktank SOCIAM: The Theory and Practice of Social Machines and the Blockchain & Society Policy Research Lab) as well as and Seda Gรผrses (currently at Delfu TU as well as the Institute for Information Law, at theย University of Amsterdam) support the rumours of some kind of block technology will be used.

In a podcast released last week, Prof. Thomas Wiegand, FG-AI4H Chair, Professor, and Executive Director of Germanyโ€™s Fraunhofer Heinrich Hertz Institute stated:

โ€œWe are making sure that privacy is preserved according to GDPR rules for that. First of all, the big question is can healthย information be, with reasonable efforts, mapped backย to a real person? Thisย must be avoided under all circumstances.

โ€œAnd so in order to make sure that thatโ€™s not the case, we have basically two mechanisms. One is that we do not use any personalised information in the system whatsoever nothing, no location, no phone number, no name, no Mac ID no geolocation, nothing.โ€

โ€œAnother mechanism is that all communication is obfuscated.โ€

โ€œSo, if you want to send a message to 200 people, you are actually sending a message to 200,000. And basically, within that, also the infinite traffic, you will not be able to determine whether the traffic (if somebody sniffsย the traffic)ย that thereโ€™s (specific) health-related information being transmitted.โ€

โ€œWhat we have built into the system is aย randomised country codeโ€ฆ basically it containsย a country code where the uploads of the data from the fall of infected personsย goย to a Trust service.โ€

โ€œAnd this Trust serviceย can decrypt this randomise IDs to the extent that one byte contains the category records and the rest remains encrypted soย the server would basically know which country to send the randomised data.โ€

โ€œSo, itโ€™s a bit like mobile phone networks on the first GSM network where you would basically have the feature of roamingโ€ฆ so we haveย roaming-like capability inย the system which is, I guess, a very fundamental European idea.โ€

โ€œWeโ€™re currently doing field tests with an army barracks here in Berlin with 50 soldiers are basically going through certain normal societalย scenarios and are measuringย different positions of the phones with different types of phones,ย working on calibrating various phone types against each other.โ€

โ€œWe hope that we will have a system available that would be shipping in the second week of Easter.โ€ (edited from rough transcript)

From the USA, associate professor at the New Jersey Institute of Technology Kurt Rohloff and CTO and co-founder of Duality Technologies (another co-founder is Shafi Goldwasser who co-invented โ€˜zero knowledge proofsโ€™, a cryptographic feature which enables someone to prove a fact as true without revealing any information about that fact) was also on the podcast to reveal some of the work being done in the USA.ย 

His company, Duality Technologies, aims to take โ€œhomomorphic encryptionโ€ mainstream.

He stated:

โ€œThis, in some sense, this captures an article from the New Yorker magazine.โ€

โ€œIโ€™ve started to look at how one could run security analytics using privacy technologies such as homomorphic encryption and how we might use these technologies to do with privacy-protected contact tracing.โ€

โ€œAnd we see the fear and want to protect privacy to make sure only people that need information get access to it and are approved and at the same time, we want to make sure that the people who actually need access do actually get access at the same time.โ€

โ€œThe initial product and capability that weโ€™ve been focusing on is been driven by our team in Israel, but our team is international and split between the eastern coast of the US and Tel Aviv.โ€

During an online slide presentation he prepared in the podcast he added:

โ€œAnd this is actually an article graphic from the CDC about the need for contact tracing this is finding everyone who came into contact with an infectious individual and going back and tracing through who has access and who hasnโ€™t.โ€

CEC, tracing, mobile, graphic, tracking, track, coronavirusโ€œThis basically includes everyone in COVID-19, who was in close proximity for the last 14 days. We have seen a number of countries that have been looking at this, and in our collective thinking is that contact tracing provides a much more quick and effective response than potentially locking down a country if done early enough, and effectively enough.โ€

โ€œAnother technology differential is dealing with privacy by generating aggregated data and then randomly generating noise, therefore limiting each partyโ€™s ability to reverse engineer individuals inputs. This is basically adding a level of statistical noise to a data set which allows for aggregated data analytics where individual precise results are not needed.โ€

โ€œFor example, in census data here in the US, differential privacy is sometimes problematic for medical applications because it lacks clinical precision. For some applications, meaning that results arenโ€™t directionally correct but not necessarily precise. And a limited number and type of computations can be run due to added noise. The one that weโ€™ll be focusing on particular is this notion of homomorphic encryption. For those of you that arenโ€™t familiar with it, it provides an ability to take data, encrypt that data, run analytics on that data while encrypted without sharing keys while enabling end to end encryption and analytics.โ€

โ€œOne of the drawbacks of cryptography it canโ€™t necessarily be used for line speed type computations, but itโ€™s quite good for batch computations. In our proof-of-concept our notion of competent computing of encrypted data is that a data owner will encrypt their sensitive data using a public key and once encrypted send it to a cloud environment.โ€

โ€œFor example, run the data into a computation service like a generic cloud, and then run computations on that data while it is encrypted, then encrypt the results. The computation is run without sharing any decryption keys and the encrypted result is returned, then decrypted. Weโ€™ve been looking at how to use this for contact tracing in a privacy-protected manner, with the goal being to identify individuals exposed to COVID-19 based on location and time without exposing personally identifiable information. Using homomorphic encryption will also enable organisations to run analytics as well as the data is still encrypted.โ€

โ€œThe schematic of the data flow is to take a query, which has information about a perceived infectious individual, send that the individualโ€™s information, encrypt individuals information, send it to up to a data location provider, run analytic on the encrypted computation to identify who is co-located and return information to a health agency, which could then decrypt results and identify individuals who have been exposed.โ€

โ€œWe have this running currently at scale with several hundred thousand participants and it will be available for municipal-level interactions.โ€

โ€œThe contract tracing capability that we have right now is developed has a secure plus query capability which can provide privacy-protected contact tracing that will enable both sharing and viewing information pertaining to the exposure of individuals.โ€

โ€œFor example, we can run this through a multiple query where the first query input is a unique identifier such as a phone number email of an identified infected individual and the date range of when they might have been infectious from getting tested and then identify who has been affected, then trying to identify how long they had been infectious, whether itโ€™s for five days or 14 days before.โ€

โ€œFrom the results of that query, get location information, date and date ranges and time ranges where the mobile device that the individual possessed, was located etc.โ€

โ€œThe privacy part of this, when the query is sent to, for example, the mobile phone carrier, the mobile phone carrier does not receive any information any medical information about who was infectious or not. But the health agencies get information about the location, back-tracing capability, location data, of the affected individuals.โ€

โ€œThe first concept is we start up with a screen that allows a generic interface for health workers to enter information about individuals, which can then be sent off for a query type operations with a data provider and then get these results which are decrypted locally with various timestamp information about where the individualโ€™s location had been.โ€

โ€œAnd then run a similar set of operations for the second where the healthcare agency can then follow up with the information to provide perfect and proper protection to society.โ€

โ€œThe underlying technology is based on the Palisade Homomorphic Encryption Library. It is a general purpose open source library built from a consortium of contributors including duality MIT, Raytheon, Lucent government systems, Intel and a few more and was heavily funded by DARPA and other parts of the R&D infrastructure of the US government.โ€

It is open source and released on the two-clause BSD license.

We feel itโ€™s very, very important to use standard schemes, not proprietary cryptography. It is important to use open source implementations of cryptography which have been vetted by third parties, which is particularly why we like the palisade homomorphic encryption library.

โ€œIโ€™m heavily involved with it, but I encourage other people to look at it also. In another engagement with ITT weโ€™ve been looking at privacy standards associated homomorphic encryption to define an industry standards consortium body to analyse the security and trustworthiness of the underlying schemes. I encourage you to get involved through homomorphic encryption dot org.โ€

โ€œWe see this notion of secure collaborationโ€ฆ of privacy technology being driven by trust. What we found is that when people decide whether to adopt a privacy technology or not, it is really driven by a trust argument, and which is one of the reasons that we are such strong advocates for only using open academic results of that have gone through the peer-review process in terms of cryptography schemes and why we advocate only the use of open source technologies, so they could be open and exposed and validated.โ€

โ€œWe are also very supportive of international standardisation processes for privacy security settings either other kinds of activities which allow for collaboration, interoperability, and a short notion of trust during collaboration, which is, of course, required for collaboration.โ€

โ€œThis has been a big thrust for us in the homomorphic encryption community to build this international consortium and engage with major organisations, both businesses, academics, international bodies, such as the ITU. I know that other privacy technologies also have similar ideas such as the zero knowledge proofs community, the secure multi-party community, and I believe there are othersโ€ฆ and weโ€™re starting to see broader uptake up-take of these technologies, specifically because of the engagement of them.โ€

โ€œWhat weโ€™re seeing right now is that there is a very healthy commercial ecosystem being built up around these technologies. I personally am a fan of that because it takes open source technologies and of course, helps to broaden this deployment in use and then fostering of open source and part and parcel of that is the adoption of these technologies by government and by enterprises.โ€

โ€œYou know we are very happy with the way things are going and see that the number of competitors in the market, both from startups and from large businesses โ€“ that have their own solutions. I believe that if you basically went to every one of the major tech firms, and even some of the smaller companies, every single one of them has a group thatโ€™s either building using or investigating privacy-enhancing technologies. My internet intuition is that itโ€™s pretty widely deployed across the tech firms right now.โ€ (edited from transcript)

If you have a similar project and you believe it would be beneficial to collaborate or exchange ideas drop an email here:ย dp3t@groupes.epfl.ch. You can also follow them on Twitter.

The following people are behind the initial design of PEPP-PT:

  • EPFL: Prof. Carmela Troncoso, Prof. Mathias Payer, Prof. Jean-Pierre Hubaux, Prof. Marcel
  • Salathรฉ, Prof. James Larus, Prof. Edouard Bugnion, Dr. Wouter Lueks, Theresa Stadler,
  • Dr. Apostolos Pyrgelis, Dr. Daniele Antonioli, Ludovic Barman, Sylvain Chatel
  • ETHZ: Prof. Kenneth Paterson, Prof. Srdjan Capkun, Prof. David Basin, Dennis Jackson
  • KU Leuven: Prof. Bart Preneel, Prof. Nigel Smart, Dr. Dave Singelee, Dr. Aysajan Abidin
  • TU Delft: Prof. Seda Gรผrses
  • University College London: Dr. Michael Veale
  • CISPA: Prof. Cas Cremers
  • University of Oxford: Dr. Reuben Binns
  • TU Berlin / Fraunhofer HHI: Prof. Thomas Wiegand
  • University of Torino / ISI Foundation: Prof. Ciro Cattuto

View All Articles


Also published on Medium.

advertisementsBlockchain Education
Blockchain Expo North America 2020

blocktv

LIVE!

BLOCKTV is the premier televised news source for the blockchain and cryptocurrency community. They are a live, 24/7, TV news channel dedicated to premium reporting on the blockchain and cryptocurrency markets.



Source link

Spread the love

Related posts

Leave a Comment