Proteus: A Practical Framework for Privacy-Preserving Device Logs
2026-03-06 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created Proteus, a system that helps keep personal information safe when device logs are shared for analysis, like in investigations or fraud checks. Proteus hides personal data using special codes and regularly changes encryption keys to stop anyone from matching old and new logs. It also lets users share limited access to parts of the logs without revealing the actual personal details. They tested Proteus on Android devices and found it works quickly with only a small increase in data size.
personally identifiable information (PII)device logspseudonymizationencryptionratcheted keysforward secrecylogcatDICE attestationforensic analysistime-rotating encryption
Authors
Sanket Goutam, Hunter Kippen, Mike Grace, Amir Rahmati
Abstract
Device logs are essential for forensic investigations, enterprise monitoring, and fraud detection; however, they often leak personally identifiable information (PII) when exported for third-party analysis. Existing approaches either fail to minimize PII exposure across all stages of log collection and analysis or sacrifice data fidelity, resulting in less effective analysis. We present Proteus, a privacy-preserving device logging framework that enables forensic analysis without disclosing plaintext PII or compromising fidelity, even when facing adversaries with access to multiple snapshots of the log files. To achieve this, Proteus proposes a two-layer scheme that employs keyed-hash pseudonymization of PII fields and time-rotating encryption with ratcheted ephemeral keys to prevent multi-snapshot correlation. For controlled sharing, clients export ratchet states that grant time-bounded access, permitting decryption of pseudonymized tokens that enable linkage and timeline reconstruction without exposing the underlying PII. Subsequent ratchet rotations ensure forward secrecy, while DICE-based attestation authenticates device provenance. We implement Proteus as a transparent extension to Android's logcat and evaluate it across three generations of hardware. Our results demonstrate a median latency of 0.2 ms per message and an average per-PII-field size overhead of only 97.1 bytes.