Privacy-Preserving Authorization via Blinded Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control solutions in pervasive computing environments fail to adequately protect user privacy, as they often reveal the identity of the credential owner, and existing solutions like blind signatures lack flexibility and security in commercial scenarios.
Innovation Solution
A method using partially blind signatures and authenticated encryption schemes to generate a user access signature that is verifiable with service constraints, allowing users to access services anonymously while maintaining accountability and security, with the option to reuse authorisation credentials for subsequent access requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control schemes using pre-established trust relationships and security credentials are used, then service access control is achieved, but user privacy is compromised as the real identity of the user is revealed
Solution Approach 1:
The credential is segmented into two distinct parts: a blinded portion containing the user identity that prevents identification, and a clear portion containing service-specific constraints that enable access control. This segmentation allows the system to simultaneously protect user privacy while maintaining reliable service access control through the verifiable constraints portion.
Solution Approach 2:
A blinded credential acts as an intermediary between the user and service provider, allowing the service provider to verify access rights without learning the user's real identity. The blinded portion serves as a mediator that preserves privacy while the clear constraints portion enables the service provider to enforce access policies.
2Loss of information
If blind signature schemes are used to prevent identification, then user privacy is protected, but flexibility and security are reduced in commercial scenarios
Solution Approach 1:
Different portions of the credential have different qualities: the blinded portion provides strong privacy protection suitable for personal identification, while the clear constraints portion provides the flexibility and verifiability needed for commercial scenarios. This local differentiation of quality allows the credential to satisfy both privacy requirements and commercial flexibility requirements simultaneously.
Solution Approach 2:
The credential structure is asymmetric, with the blinded portion being opaque and the clear constraints portion being transparent and verifiable. This asymmetry enables the system to provide both strong privacy protection (through the blinded portion) and commercial flexibility (through the verifiable constraints that can be checked by service providers and billing authorities).
3Reliability
If per-service pre-established trust with unique credentials is used, then service-specific access control is achieved, but user convenience is reduced
Solution Approach 1:
The credential is designed as a universal multi-functional object that can be used across multiple services. The clear constraints portion can be verified by any service provider to determine access rights, eliminating the need for users to manage separate credentials for each service while maintaining service-specific access control through the verifiable constraints.
4Ease of operation
If a separate service-independent authentication server is used, then user convenience is improved, but privacy is reduced due to linkability
Solution Approach 1:
The credential is segmented into a blinded identity portion and a clear constraints portion. When the authentication server verifies the credential, it can check the constraints against service requirements without learning the user's real identity from the blinded portion. This segmentation allows the server to provide convenient centralized authentication while preventing linkability to user identities.
Data Source
AI summary
A method for preserving privacy during authorization in pervasive environments is described. The method includes an authorization phase in which the user is provided with a reusable credential associated with verifiable constraints, and an operation phase where the service provider verifies the reusable credential before authorizing the user. Third parties cannot link plural uses of the credential to each other, and the service provider cannot link plural uses of said credential to each other.