Proteus: A Practical Framework for Privacy-Preserving Device Logs

TL;DR

Proteus is a practical framework that enables privacy-preserving device logs, allowing forensic analysis without exposing PII, using a two-layer scheme with pseudonymization, encryption, and controlled sharing, validated on Android devices.

Contribution

Proteus introduces a novel two-layer privacy-preserving logging scheme with multi-snapshot protection and controlled access, enhancing data privacy without sacrificing log fidelity.

Findings

Median latency of 0.2 ms per message

Average overhead of 97.1 bytes per PII field

Effective privacy preservation on Android devices

Abstract

Device logs are essential for forensic investigations, enterprise monitoring, and fraud detection; however, they often leak personally identifiable information (PII) when exported for third-party analysis. Existing approaches either fail to minimize PII exposure across all stages of log collection and analysis or sacrifice data fidelity, resulting in less effective analysis. We present Proteus, a privacy-preserving device logging framework that enables forensic analysis without disclosing plaintext PII or compromising fidelity, even when facing adversaries with access to multiple snapshots of the log files. To achieve this, Proteus proposes a two-layer scheme that employs keyed-hash pseudonymization of PII fields and time-rotating encryption with ratcheted ephemeral keys to prevent multi-snapshot correlation. For controlled sharing, clients export ratchet states that grant time-bounded access, permitting decryption of pseudonymized tokens that enable linkage and timeline reconstruction without exposing the underlying PII. Subsequent ratchet rotations ensure forward secrecy, while DICE-based attestation authenticates device provenance. We implement Proteus as a transparent extension to Android's logcat and evaluate it across three generations of hardware. Our results demonstrate a median latency of 0.2 ms per message and an average per-PII-field size overhead of only 97.1 bytes.