  Pandemic and epidemic diseases such as CoVID-19, SARS-CoV2, and Ebola have
spread to multiple countries and infected thousands of people. Such diseases
spread mainly through person-to-person contacts. Health care authorities
recommend contact tracing procedures to prevent the spread to a vast
population. Although several mobile applications have been developed to trace
contacts, they typically require collection of privacy-intrusive information
such as GPS locations, and the logging of privacy-sensitive data on a third
party server, or require additional infrastructure such as WiFi APs with known
locations. In this paper, we introduce CONTAIN, a privacy-oriented mobile
contact tracing application that does not rely on GPS or any other form of
infrastructure-based location sensing, nor the continuous logging of any other
personally identifiable information on a server. The goal of CONTAIN is to
allow users to determine with complete privacy if they have been within a short
distance, specifically, Bluetooth wireless range, of someone that is infected,
and potentially also when. We identify and prove the privacy guarantees
provided by our approach. Our simulation study utilizing an empirical trace
dataset (Asturies) involving 100 mobile devices and around 60000 records shows
that users can maximize their possibility of identifying if they were near an
infected user by turning on the app during active times.

Cryptography and Security