Corona-Warn-App: Secure from the cloud

In this article you will read about,

• how the Corona-Warn-App is delivered from the cloud, 
• what requirements the cloud platform must meet for this
• and which method accelerated the development process.

Whether to protect their own health or out of social responsibility, since its launch in June 2020, German citizens have downloaded the Corona-Warn-App onto their smartphones more than 47 million times (as of September 21, 2022). In order to combat the coronavirus in an optimal way and to protect themselves and their fellow citizens. Thus, the Corona-Warn-App has become “a successful reference in the fight against the pandemic with smartphone apps in international comparison and nationally," according to the 2021 Activity Report of the Federal Commissioner for Data Protection and Freedom of Information.

However, this positive conclusion and the trust of the German population in the Corona-Warn-App can by no means be taken for granted. After all, there were many challenges to overcome in the run-up to the app launching – and many people in Germany were concerned about the possible processing of personal data and too little data protection.

Both the client, the German Ministry of Health, and the operator of the Corona-Warn-App, the Robert Koch Institute, saw the protection of personal data and compliance with the General Data Protection Regulation (GDPR) as being the highest priority. 

But the other requirements were also demanding. The most important specifications: the technology used had to be based on open standards, be located in data centers in Germany and have important security certifications. The Open Telekom Cloud, the public cloud solution from app development partner Deutsche Telekom, was therefore quickly selected for the technical infrastructure. Provided from highly secure data centers in Magdeburg and Biere, the Open Telekom Cloud is based on the open standard OpenStack. It also meets the C5 requirements of the German Federal Office for Information Security (BSI), which certifies that cloud providers meet the highest level of security.

And how does the app work in practice? If a person has tested positive for the coronavirus and reports their infection via the Corona-Warn-App, their smartphone exchanges randomly generated keys with other nearby devices via Bluetooth. The keys are matched via verification servers provided from the Open Telekom Cloud. If there are large clusters of infections, in which a lot of data has to be synchronized, the cloud resources can be increased within a very short time and shut down just as quickly.    

In addition to the high requirements for protecting the privacy of users, the time constraints set by the client were particularly ambitious. 
The goal: The Corona-Warn-App should be available in 50 days. The developers and project managers of the participating companies therefore decided on the DevOps agile development approach. The advantage: DevOps enables faster results without compromising the quality of the software. To achieve this, the individual development steps are broken down into small parts and assigned to defined teams. Early involvement of the operations team in the development process prevents unpleasant surprises during operation. All those involved are constantly in close communication and share important information. In this way, the software is continuously improved throughout the entire development process. The choice of method was a major factor in ensuring that SAP and Deutsche Telekom were able to meet the ambitious schedule. 

Even after its launch, the Corona-Warn-App has been continuously improved and expanded with additional functions. For example, users can store vaccination, recovery, and test certificates, find out about any upcoming booster vaccinations, view statistics and key figures on infection or view the nearest test centers. Organizers can notify the participants of an event if a person who took part has subsequently tested positive.

The Corona-Warn-App is also linked to numerous other national warning apps via the so-called EU data matching service. The service ensures that the apps also work across national borders and that users only need to install one app.