Blockchain Technology Can Be Used to Protect Personal Information From Disclosure

During the period of COVID-19, the largest personal information collection in China is being launched. Where do you come from, where do you go, what is your temperature, where do you live... Such fine-grained information, coupled with a population base of 1.4 billion, may be the largest "population survey" ever conducted by mankind.

The chaos of personal information collection also appears at the same time, and personal information leakage has become a new problem.

On February 9, the office of the central network security and Information Technology Commission (hereinafter referred to as the "network information office") issued the notice on doing a good job in personal information protection and using big data to support joint prevention and control. The purpose of the notice is to "protect the personal information in the joint prevention and control of New Coronavirus infection," and "use big data including personal information to support joint prevention and control work".

The notice of the Internet Information Office has played a deterrent role to individuals and institutions trying to disclose personal information, but it is difficult to eliminate information leakage. If blockchain technology is used in the process of information collection, the worry of the office will not be enough.

Chaotic personal information collection

Since the "closure of Wuhan City", the author has been required to fill in various information collection forms, including community property management, community neighborhood committees, work units, children's schools, etc. the author has identified their entities, as well as unconfirmed entities such as "municipal government", "Public Security Bureau" and "Health Commission" spread in the community.

There are various ways to fill in, including H5 format, wechat applet and word document. For example, hundreds of related small programs are running when wechat searches for keywords such as "epidemic situation", "anti epidemic", "epidemic prevention", "new crown" and "virus registration".

There are many kinds of information collection tools, including individuals, outsourcing companies and large Internet companies, which means that the servers storing this information are different and the security is questionable.

From the collection of personal information, it involves a lot of privacy issues, including the ID number, telephone number, family detailed residence and family member's detailed list.

With these contents, you can do many illegal things: including being taken by other people's ID card and telephone number for various member registration and handling various membership cards; The ID number and mobile phone number can be copied to the same mobile phone number, resulting in loss of property in the bank card. Have very accurate identity information, sell it to advertisers and be harassed by advertising; Reselling information to fraud companies can make it easier for fraud companies to make up stories that people believe.

In fact, personal information leakage has occurred before the epidemic is over. Guangzhou Nanhai District has just investigated and dealt with a case. A passenger in Nanhai took a cruise ship, and there was an epidemic on the cruise ship. The passenger's Avatar, identity and other information were spread.

This is why the online information office should send a document to protect personal information.

According to the notice of the Internet Information Office, the personal information collected for epidemic prevention and control and disease prevention and control shall not be used for other purposes. No unit or individual may, without the consent of the collector, disclose personal information such as name, age, ID number, telephone number, home address, etc., except for the need for joint prevention and control and desensitization. The notice also points out that institutions that collect or master personal information should be responsible for the security protection of personal information and take strict management and technical protection measures to prevent theft and disclosure.

From the perspective of the main body of information collection and technical service companies, it is not easy to meet the requirements of network information office. Luo Xiao, CEO of Yulian technology, said to the pulse of mutual chain: "there are indeed many links in the form of H5 on Web pages to obtain citizen information. Moreover, due to the limited technical ability of some technology companies, it is extremely easy to cause the disclosure of citizen privacy information regardless of experience."

Blockchain technology is being used to collect personal information for epidemic prevention because it can protect users' privacy. For example, the "access" developed by Yulian technology is deployed on the Yulian cloud based on blockchain technology to encrypt and protect the collected citizen information, which can ensure the security of data. Luo Xiao said: "even Yulian technology can't see the user information, and after the epidemic, it will publicly destroy the deployment of this product."

Blockchain and use of private data

It is worth noting that in the notice of the Internet Information Office, it not only requires the protection of personal information, but also puts forward two requirements.

First, the health department has the right to call. The notice stipulates that except for the institutions authorized by the health department of the State Council in accordance with the network security law of the people's Republic of China, the law of the people's Republic of China on the prevention and control of infectious diseases and the regulations on emergency response to public health emergencies, no other units or individuals shall collect and use personal information without the consent of the recipient on the grounds of epidemic prevention and control and disease prevention.

Second, collect information differently. The notice stipulates that the collection of personal information necessary for joint prevention and control shall refer to the national standard personal information security code, adhere to the principle of minimum scope, and the collection object shall be limited to key groups such as diagnosed persons, suspected persons and close contacts. Generally, it does not target all groups in a specific area to prevent de facto discrimination against people in a specific area.

However, the current personal information collection methods are difficult to meet the requirements of notification. For example, if the health department invokes data, its operators can certainly obtain this data; At present, we would rather collect all the information than miss one person.

However, blockchain has given solutions on both points.

For example, on July 30 last year, Lai Xin, chief engineer of Xunlei chain, released the new technology of Xunlei chain - traceable privacy protection technology at the 4th China Network and information security conference. This technology is to solve the pain point that it is difficult to achieve both data privacy protection and information traceability on the chain. It is reported that this technology encrypts and hides data through encryption algorithms such as ring signature and zero knowledge proof, so as to protect user privacy, meet the needs of organizations or institutions with information control authority through cryptography technology, and minimize risks. In this way, the problem that the health department invokes information but others are invisible is met.

Previously, Xunlei chain's "chain data regulatory privacy scheme" has been applied in medical scenarios. This scheme can also be applied to the collection of epidemic prevention personal information. For example, relevant collected objects can upload data encryption to the chain through supervised privacy encryption technology to protect the privacy of the data uploaded to the chain. Regulators with data access authority, such as provincial and municipal CDCs, can view the ciphertext data on the chain through the regulatory key, so as to ensure the timely and effective data and achieve security and controllability.