Self-Sovereign Identity and User Control for Privacy-Preserving Contact Tracing

Abstract

Contact tracing apps use mobile devices to keep track of and promptly identify those who come in contact with an individual who tests positive for COVID-19. However, privacy is a major obstacle to the wide-spread use of such apps since users are concerned about sharing their contact and diagnosis data. This research overcomes multiple challenges facing contact tracing apps: (1) As researchers have pointed out, there is a need to balance contact tracing effectiveness with the amount of user identity and diagnosis information shared. (2) No matter what information the user chooses to share, the app should safeguard the privacy of user information. (3) On the other hand, some essential test result information must be shared for the contact tracing app to work. While contact tracing apps have done a good job maintaining contact information on the user’s device, most such apps publish positive COVID-19 test results to a central server which have some risks for compromise. We address these challenges by (1) giving the user the right to choose how much information to share about their diagnosis and their identity, (2) building our novel contact tracing app on top of Self-Sovereign Identity (SSI) to assure privacy preserving user authentication with verifiable credentials, and (3) decentralizing the storage of COVID-19 test results. We, in collaboration with Verizon, have implemented our Privacy-preserving Contact Tracing (PpCT) app, leveraging SSI advances based on the blockchain for their 5G network.