Device logs are essential for forensic investigations, enterprise monitoring, and fraud detection; however, they often leak personally identifiable information (PII) when exported for third-party analysis. Existing approaches either fail to minimize PII exposure across all stages of log collection and analysis or sacrifice data fidelity, resulting in less effective analysis. We present Proteus, a privacy-preserving device logging framework that enables forensic analysis without disclosing plaintext PII or compromising fidelity, even when facing adversaries with access to multiple snapshots of the log files. To achieve this, Proteus proposes a two-layer scheme that employs keyed-hash pseudonymization of PII fields and time-rotating encryption with ratcheted ephemeral keys to prevent multi-snapshot correlation. For controlled sharing, clients export ratchet states that grant time-bounded access, permitting decryption of pseudonymized tokens that enable linkage and timeline reconstruction without exposing the underlying PII. Subsequent ratchet rotations ensure forward secrecy, while DICE-based attestation authenticates device provenance. We implement Proteus as a transparent extension to Android's logcat and evaluate it across three generations of hardware. Our results demonstrate a median latency of 0.2 ms per message and an average per-PII-field size overhead of only 97.1 bytes.

翻译：设备日志对于取证调查、企业监控和欺诈检测至关重要；然而，当这些日志被导出供第三方分析时，常常会泄露个人可识别信息（PII）。现有方法要么未能最小化日志收集与分析所有阶段的PII暴露，要么牺牲了数据保真度，导致分析效果降低。本文提出Proteus，一种隐私保护设备日志框架，它能够在即使面对能够访问日志文件多个快照的对手时，也支持在不披露明文PII或不损害保真度的情况下进行取证分析。为实现此目标，Proteus提出了一种双层方案：该方案对PII字段采用带密钥的哈希伪名化处理，并采用基于时间轮转的加密与棘轮式临时密钥来防止多快照关联。为实现受控共享，客户端导出授予时间限定访问权限的棘轮状态，允许解密伪名化令牌，这些令牌支持在不暴露底层PII的情况下实现关联和时间线重建。后续的棘轮轮转确保了前向保密性，而基于DICE的证明则对设备来源进行了认证。我们将Proteus实现为Android logcat的透明扩展，并在三代硬件上进行了评估。结果表明，每条消息的中位延迟为0.2毫秒，每个PII字段的平均大小开销仅为97.1字节。