Goal: As the Coronavirus Pandemic of 2019/2020 unfolds, a COVID-19 ‘Immunity Passport’ has been mooted as a way to enable individuals to return back to work. While the quality of antibody testing, the availability of vaccines, and the likelihood of even attaining COVID-19 immunity continue to be researched, we address the issues involved in providing tamper-proof and privacy-preserving certification for test results and vaccinations. Methods: We developed a prototype mobile phone app and requisite decentralized server architecture that facilitates instant verification of tamper-proof test results. Personally identifiable information is only stored at the user's discretion, and the app allows the end-user selectively to present only the specific test result with no other personal information revealed. The architecture, designed for scalability, relies upon (a) the 2019 World Wide Web Consortium standard called ‘Verifiable Credentials’, (b) Tim Berners-Lee's decentralized personal data platform ‘Solid’, and (c) a Consortium Ethereum-based blockchain. Result s: Our mobile phone app and decentralized server architecture enable the mixture of verifiability and privacy in a manner derived from public/private key pairs and digital signatures, generalized to avoid restrictive ownership of sensitive digital keys and/or data. Benchmark performance tests show it to scale linearly in the worst case, as significant processing is done locally on each app. For the test certificate Holder, Issuer (e.g. healthcare staff, pharmacy) and Verifier (e.g. employer), it is ‘just another app’ which takes only minutes to use. Conclusions: The app and decentralized server architecture offer a prototype proof of concept that is readily scalable, applicable generically, and in effect ‘waiting in the wings’ for the biological issues, plus key ethical issues raised in the discussion section, to be resolved.

中文翻译：

---

COVID-19抗体测试/疫苗接种证明：有一个专用的应用程序

目标：随着2019/2020年冠状病毒大流行的发展，已经提出了COVID-19``免疫护照''作为一种使个人重返工作岗位的方式。在继续研究抗体测试的质量，疫苗的可用性以及甚至获得COVID-19免疫力的可能性的同时，我们解决了涉及为测试结果和疫苗提供防篡改和隐私保护证书的问题。方法：我们开发了原型手机应用程序和必要的分散服务器架构，以促进即时验证防篡改测试结果。个人识别信息仅由用户自行决定是否存储，并且该应用允许最终用户选择性地仅显示特定的测试结果，而不会泄露其他个人信息。为实现可扩展性而设计的架构依赖于（a）2019年称为``可验证凭据''的万维网联盟标准，（b）Tim Berners-Lee的去中心化个人数据平台``Solid''，以及（c）基于以太坊联盟的区块链。结果 s：我们的移动电话应用程序和分散的服务器体系结构以可从公用/专用密钥对和数字签名派生的方式实现了可验证性和隐私性的混合，一般是为了避免对敏感数字密钥和/或数据的限制性所有权。基准性能测试表明，在最坏的情况下它可以线性扩展，因为每个应用程序都在本地进行大量处理。对于测试证书持有者，发行者（例如医护人员，药房）和验证者（例如雇主），它只是“另一个应用程序”，仅需几分钟即可使用。结论： 该应用程序和去中心化服务器架构提供了概念上的原型证明，该概念易于扩展，可以普遍应用，并且实际上可以“等待”生物问题以及讨论部分中提出的关键伦理问题，以加以解决。