0

I'm developing an app for alert people if they encounter covid-19 positive person. I'm very much concern about user's privacy. So I need to make a user completely anonymous.

What is want is as follows.

Suppose there are devices A, B, C,

A, B, and C should broadcast the their own UUID via bluetooth When A, B, and C is near to each other A will have B, C UUID's and B will get A, C's UUID and vise versa.

Lets suppose A's find out that A is positive for Covid-19. A will upload its UUID to a central server B and C also checks for UUID's with the server. When B, C gets UUID list of infected person's apps B, C will check if they match any of UUID downloaded from the server against locally saved UUID.

But in my case I don't want the server to find out UUID of A. But somehow I need to send A's UUID to other devices as well. Whats will be the best approach.

My Solution.

All the devices will generate public, private key pairs of their own. Each app will encrypt their UUID with the public key they have generated and broadcast to the other devices encrypted UUID + public key.

Once particular user find him positive for covid-19 he will upload his private key to the server. All the apps will download all the private keys from all the covid positive devices. and check if app's themselves can decrypt their messages with the private key's they have.

Will this be possible ? or what will be the best approach.

Its stupid to disclose the private key. And also it will be chaos to find appropriate public key which matches with the private key also.. But yet this was the only thing that I could think of.

| improve this question | | | | |
  • The private key in asymmetric cryto is supposed to be kept private. When you send the private key to the server, you lose that confidentiality. – bhorkarg Apr 6 at 19:55
2

Once particular user find him positive for covid-19 he will upload his private key to the server.

A private key is supposed to be kept private and uploading it to a server will defeat this requirement.

I'm very much concern about user's privacy. So I need to make a user completely anonymous. in my case I don't want the server to find out UUID of A. But somehow I need to send A's UUID to other devices as well. Whats will be the best approach.

Based on the above parts of the question, what you should look at is Data Anonymization. You can use a hash function to anonymize data (as long as you don't link the hashed value to other personally identifiable information).

In your case you can simply hash the UUID and send the hashed value to the server. When you receive the broadcast of a device on another, just hash it and compare it with the hash from the server. I suppose an MD5 hash function should be sufficient in this case.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.