Epidemics such as H1N1, SARS, Ebola, and the recent coronavirus have impacted millions of people worldwide, resulting in a large death toll. The World Health Organization (WHO) has issued several advisories and courses for action to limit the spread of COVID-19 [1] infection by tracing infected individuals. The tracing process requires infected individuals to share information with governments and local medical agencies, which are tasked with tracking and quarantining individuals who may have been in close contact with infected victims, and the subsequent collection of further information about the infected victims. Tracking involves acquiring the personal information of each infected individual, including their travel history, locations visited, recent contacts, and their health details [2]. While most individuals may be comfortable with sharing this information for their own and the nation’s benefit, privacy-aware individuals may not be so willing. This can hinder the contact tracing process, even as the virus continues to spread at alarming rates [3]. Secure and privacy-aware contact tracing methods can inspire everyone, infected or not, of all ages to join the contact tracing, with an assurance of the data being processed confidentially and with no malicious intent. Globally, various contact tracing applications, such as mobile apps and global positioning systems (GPS), are being used. The infected individual is expected to self-test and self-report health details using mobile applications and location data [4]. However, the sharing of data depends on local infrastructure and networks, which rely on unsecured external technologies such as wireless access points, GPS, data networks, or even those involved in the deployment and maintenance of the application itself. The government of Singapore has launched a contact tracing app called “Trace Together.” The Indian government’s contact tracing app, which is called Aarogya Setu, performs real-time tracking, as illustrated in Fig. 1.

This study proposes the use of a mobile application with Bluetooth connectivity to perform real-time contact tracing. The authors propose the use of mobile devices to send anonymous beacons of encrypted random code messages via Bluetooth. This allows for foolproof data privacy, and individuals remain anonymous. No collection of privacy-sensitive data is involved or dependent on external third-party IT infrastructure. The major highlights of this research are privacy-aware contact-tracing mobile applications with the following features.

The proposed contact tracing application does not involve any public wireless or network infrastructure.

This technology process helps to monitor infected individuals as well as reduce the medical costs involved during quarantine measures. The focus is on testing a framework that ensures complete privacy. To evaluate the contact-tracing framework, T-test and regression analysis were used to validate datasets from real scenarios.

The remainder of this paper is organized as follows: Section 1 describes in detail contact tracing and privacy issues, and Section 2 presents the literature survey regarding the different contact-tracing methods employed by various researchers. The proposed Contact Tracking Framework (CTF) algorithm is illustrated in Section 3. Section 4 discusses the experimental results obtained and presents the T-test validation of the dataset reviewed.

During the 2014 EBOLA outbreak, the WHO expounded on the significance of contact tracing and even proposed protocols for tracing infected individuals. However, no mobile application or data-gathering technologies were deployed. The WHO has proposed recommendations for medical staff and those on the front line to improve the safety of using contact tracing applications. With COVID-19, several countries have mandated the use of mobile-based contact tracing, thus gathering data and making use of data obtained from mobile applications. Monitoring and regulating interactions are vital for preventing the spread of this disease. Internet-and mobile-based technologies have aided in terms of surveillance, modeling of infection, remote sensing, etc., to predict and control the disease spread [5]. This tactic of using new-age technology to deal with global epidemics is classified as digital epidemiology under a new domain, as described by Chancay-García et al. [6]. Recently, several researchers have assessed the categorization of mobile call data records. Dede et al. [7] and Christak et al. [8] tracked user mobility patterns to model and evaluate epidemic sickness. Tizooni et al. [9] explored the use of proxy systems for individual users. The authors evaluated the mobility flow to predict the spread of epidemics. The accuracy of the predictive analysis, which was performed using mobility data sources, varied with the epidemic rate of propagation and timing of data results gathered.

Salathe et al. [10] discussed the use of wireless technologies, such as the ZigBee protocol and Bluetooth, to detect and trace infected people. The authors obtained detailed data on the social contacts of infected persons during the infection period. Then, the authors recreated the social networks of potentially infected users. To evaluate the spread, diffusion, and impact, the authors also proposed the SEIR model based on features such as susceptible, exposed, infectious, and recovered. Mastrandrea et al. [11] presented a prototype of wearable sensors for determining contacts amongst individuals and students. The authors matched the results with contacts from personal records, and associated the spread of an epidemic using sensors and diaries with a notable difference in dynamics. Interest in contact-tracing strategies has increased in recent times, and different methods have been used to estimate the impact and rate of spread before and during the plagues, as well as the efficiency of measures against contiguous epidemics. In many outbreaks, contact tracing is the only feasible option to identify infected individuals, as presented by Lima et al. [12], Rubrichi et al. [13], and Fraser et al. [14], who also tested reasons that aid in controlling an outbreak.

Contact tracing methods adopt two primary models, namely, population-based and agent-based approaches. Klinkenberget et al. [15] proposed a population-based top-down approach for analyzing system research data from a macroscopic perspective. Then, Kwok et al. [16] and Müller et al. [17] presented an agent-based bottom-up approach, considering every individual as a self-regulating agent entity. Each agent is responsible for its own infection state, movement, and location to estimate unrelated and adaptive activities. The stochastic model introduced by Farrahiet et al. [18] and Keelinget et al. [19] involves grouping the associated measures and fundamental dynamics of epidemics using a deterministic approach. In previous years, contact-tracing models have focused on a generic network of contacts. To improve the precision of such network contact models, Huerta et al. [20] presented a similar model as part of the epidemic regulation tactics. This method helped to estimate the impact of contact tracing and the random tracing of complex contact networks. Yang et al. [21] proved that by tracing the contacts at a low additional cost, the spread of an outbreak may be considerably reduced, and even eradicated. The FluPhone project developed at Cambridge University [22] was one of the first attempts to use mobile apps to determine contacts. Using wireless Bluetooth as a proxy, the application was able to estimate physical contacts. The application promoted users to report symptoms to determine the rate and risk of infection. Similar contact tracing schemes focus on privacy issues, such as the pan-European privacy-preserving proximity tracing (PEPP-PT) [23] and the MIT project Safe Paths [24]. Corporate enterprises such as Apple, Facebook, and Google teamed up to integrate their web portals with handheld and sensor devices to provide similar solutions for Android and iOS mobiles. Isella et al. [25] claimed that the practice of contact tracing and isolation did not prevent the COVID-19 epidemic. The decreasing infection count is primarily due to asymptomatic infected individuals who are undetected, and who it is believed contribute to the spread of the COVID-19 outbreak. Using mobile apps to find previous contacts, we mathematically proved that such epidemic diseases can be checked even when no one uses the mobile application.

A real-time contact tracking framework (CTF) was designed and developed as a secure mobile application using the Android platform, SDK tools, and Java. Instead of using a data network or IT infrastructure such as wireless or office networks, the lightweight application uses Bluetooth with the need for limited computing resources of the individual’s mobile. However, there are unauthorized and malicious privacy impacts from threat vectors. The CTF process is trust-based; individuals own the process, and it is his/her prerogative to join or exit, and further perform regular 15 days self-assessment to determine any infection. The generated logs comprise a unique ID (user’s Bluetooth), timestamp (date and time), and health status code (random salted number) for each application user. The contract tracking framework follows five phases, as shown in Tab. 2.

Entities involved in the CTF process require privacy protection. These include individuals (mobile IMEI and number), location (IP address and geolocation), health data, and command server communication. The proposed CTF application ensures that the data collected is never shared with any of these entities, and keeps the individuals anonymous. The proposed workflow is shown in Fig. 2.

This application was designed for Android mobile devices. The reports are saved locally on the mobile, and are encrypted with a private key in the form of two reports. The first report is a detailed description accessible only to individuals. If the individual is infected, he can share with the medical teams all of the details in full confidence using a private key in order to determine the treatment. The second report is a basic-level code encrypted with a public key and uploaded to the command server. Whenever an individual goes outside, the application scans other mobile devices using Bluetooth. This sends and receives anonymous encrypted beacons to and from other mobile devices. If the application can decrypt the basic report of other individuals, Bluetooth alerts are generated immediately.

The results varied between randomly selected individuals and those infected. Moreover, this research considered different time slots during which users turn ON their Bluetooth to evaluate the effectiveness of our protocols in different scenarios. The validations were repeated to capture the randomness of the simulations for 150 devices.

Initial research focused on the infection rate among individuals depending on the initial infection and contagiousness probability. These datasets were obtained from infections reported by individuals who had installed the contact tracing application, and who were using it.

Subsequent research focused on three scenarios (i1–i3) as follows:

i1: Individuals who randomly turn ON/OFF their Bluetooth anytime

The authors conducted a parametric statistical t-test and regression analysis to ensure that the datasets had no violations of the information presented in random samples from 100,000 records. The use of regression validated the prediction of continuous dependent variables from independent variables in the datasets. The deviations from the linear point line are the errors. The distribution of the sample mean is normal, and the variances of the different parameters are similar. The null hypothesis assumes that if the data violate these assumptions, then it can be safely assumed that the results obtained have committed a Type I error, which is more or less than the alpha probability, and the T-Test validation parameters are interpreted as presented in Tab. 4.

The requirement for performing the T-Test is the use of two independent samples with normally distributed data and samples with the same variance. The authors take the null hypothesis, H0: H1 − H2 = 0, where H1 and H2 are the means for the two datasets. The null hypothesis is that there is no difference between the means of the two datasets, or more formally, that the difference is zero. Tab. 5 presents the T-test validation of the CTF dataset sample.

Considering the datasets for i1 and i2, the authors used a significance level of 0.05 with a two-tailed hypothesis. The difference scores that were calculated are presented in Tabs. 6 and 7 below.

T-Test calculations are performed for validation on datasets, and are presented in Tabs. 8 and 9.

For T-Value Calculation:

T-value is −2.96089 and the P-value is 0.007726 → Result is significant at p < 0.05.

Because the P-value is less than the significance level, alpha 0.05 → Null Hypo (H0) is rejected and the Alternative Hypo (Ha) is accepted.

Further, validating with regression analysis:

Regression Equation = ŷ = bX + a

From the graph shown in Fig. 6 below, individuals who randomly turn on their Bluetooth when going out or in crowded places display better performance and contagiousness probability than those who turn on Bluetooth only when outside their homes or only at certain specific hours of for a set duration.

The presented research work successfully demonstrates the real-time, trust-based contact tracing framework (CTF) as a feasible privacy-aware solution. Nation-states need not use methods or applications that pose privacy-related risks or face issues when an individual’s personal information or health logs can be misused. This study considers the features and entities that are related to protecting the privacy of an individual. The focus is to build a trust-based framework with a lightweight Bluetooth-based mobile application. Using sample datasets, the authors have shown how contact tracing with three options can mitigate the spread of COVID-19. Existing contact tracing applications do not provide open-source software for research or experimentation purposes. In the future, the authors plan to release this research as an open-source software implementation for both Android and iOS devices.