健康碼項目白皮書

1、Contents HYPERLINK l _bookmark0 Overview 3 HYPERLINK l _bookmark1 Definitions 3 HYPERLINK l _bookmark2 Contact Detection Service 3 HYPERLINK l _bookmark3 Advertisement Payload 3 HYPERLINK l _bookmark4 Advertising Behavior 4 HYPERLINK l _bookmark5 Advertising Flow 4 HYPERLINK l _bookmark6 Scanning Be

2、havior 5 HYPERLINK l _bookmark7 Scan Power Considerations 5 HYPERLINK l _bookmark8 Scanning Flow 5 HYPERLINK l _bookmark9 Privacy 6OverviewThis document provides the detailed technical specification for a new privacy-preserving Bluetooth protocol to support Contact Tracing. Contact Tracing makes it

3、possible to combat the spread of the COVID-19 virus by alerting participants of possible exposure to someone who they have recently been in contact with, and who has subsequently been positively diagnosed as having the virus. The Contact Detection Service is the vehicle for implementing contact trac

4、ing and uses the Bluetooth LE (Low Energy) for proximity detection of nearby smartphones, and for the data exchange mechanism.DefinitionsContact Detection Service - The BLE service for detecting device proximity.Tracing Key - A key that is generated once per device.Daily Tracing Key - A key derived

5、from the Tracing Key every 24 hours for privacy consideration.Diagnosis Key - The subset of Daily Tracing Keys which are uploaded when the device owner is diagnosed positive for the COVID-19 virus.Rolling Proximity Identifier - A privacy preserving identifier derived from the Daily Tracing Key and s

6、ent in the bluetooth advertisements. It changes every 15 minutes to prevent wireless tracking of the device.Contact Detection ServiceContact Detection is a BLE service registered with the Bluetooth SIG with 16-bit UUID 0 xFD6F, it is designed to enable proximity sensing of Rolling Proximity Identifi

7、er between devices for the purpose of computing an exposure event.Devices advertise and scan for the Contact Detection Service by way of its 16-bit service UUID. The Service Data type with this service UUID shall contain a 128-bit Rolling Proximity Identifier that changes periodically.Advertisement

8、PayloadThe Contact Detection Service payload shall be ordered as shown below and shall not include other data types. The Contact Detection Service payload has three sections:Flags Section: LE general discoverable mode (bit 1) shall be set to 1.Complete 16-bit Service UUID Section: the UUID is 0 xFD6

9、F, and shall precede the Service Data section.Service Data 16-bit UUID Section: the content of service data payload shall be a 128-bit Rolling Proximity Identifier.Advertising BehaviorAdvertisements are to be non-connectable undirected of type ADV_NONCONN_IND (Section of 5.2 Core Spec).The a

10、dvertiser address type should be Random Non-resolvable.On the platforms supporting Bluetooth Random Private Address with randomized rotation timeout interval, the advertiser address rotation period shall be a random value, greater than 10 minutes and less than 20 minutes.The advertiser address and R

11、olling Proximity Identifier shall be changed synchronously so address and Rolling Proximity Identifier can not be linked.A separate advertising instance should be used, if HW allows, to provide advertising reliability and flexibility in choosing optimal interval.The advertising interval is subject t

12、o change, but is currently recommended to be 200-270 milliseconds.Advertising FlowThe following diagram illustrates the flow of advertisement between devices.Scanning BehaviorDiscovered Contact Detection Service advertisements shall be kept on the device.Scan results shall be timestamped and RSSI-ca

13、ptured per advertisement.Scanning interval and window shall have sufficient coverage to discover nearby Contact Detection Service advertisers within 5 mins.Scanning strategy that works best is opportunistic (leveraging existing wakes and scan windows) and with minimum periodic sampling every 5 mins.

14、Scan Power ConsiderationsPlatforms running the Contact Detection Service should be designed to account for large volume of advertisers in public spaces that shall rotate their Random Non-resolvable address and Rolling Proximity Identifier frequently.Wherever supported by HW and OS, Bluetooth control

15、ler duplicate filters and other HW filters should be used to prevent excessive power drain.Scanning FlowThe following diagram illustrates the flow and behavior of device scanning.PrivacyMaintaining user privacy is an essential requirement in the design of this specification. The protocol does this b

16、y the following means:The Contact Tracing Bluetooth Specification does not require the users location; any use of location is completely optional to the schema. In any case, the user must provide their explicit consent in order for their location to be optionally used.Rolling Proximity Identifiers change on average every 15 minutes, making it unlikely that user location can be tracked via bluetooth over time.Proximity identifiers obtained f