Cryptographic Pseudonym Mapping Against Collusion Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic pseudonym mapping methods are vulnerable to malicious collusion between data sources and mappers, leading to potential breaches in anonymity, and are susceptible to chosen-plaintext and chosen-ciphertext attacks, while requiring organizational measures that complicate data security management.
Innovation Solution
A cryptographic pseudonym mapping method using an ElGamal-type public key encryption system with homomorphic properties, ensuring pseudonyms are generated without revealing secret keys, and incorporating randomization and homomorphic operations to protect anonymity, even in the presence of malicious collusion, and resist chosen-plaintext attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If a hash function is used to generate pseudonyms from entity identifiers, then trivial discovery of the relationship between identifiers and pseudonyms is prevented, but targeted attacks to crack anonymity can still succeed because any identifier can be mapped to its pseudonym by data sources themselves
Solution Approach 1:
A trusted third party called a 'mapper' is introduced as an intermediary between data sources and the pseudonym generation process. The mapper receives encrypted entity identifiers from data sources, decrypts them using a shared secret key, generates pseudonyms, and re-encrypts them. This mediator prevents data sources from directly mapping identifiers to pseudonyms, thereby blocking targeted attacks while maintaining anonymity.
Solution Approach 2:
The pseudonym generation process is segmented into multiple independent steps performed by different entities: data sources encrypt identifiers, the mapper decrypts and generates pseudonyms, and the process is repeatable for new data. This segmentation ensures that no single entity (including data sources) can perform the complete mapping operation, preventing trivial or targeted attacks.
2Reliability
If secure equality test is applied to compare entity identifiers, then pseudonymisation can be achieved, but each data source can discover which other data sources possess data on the same entities, revealing extra information
Solution Approach 1:
The mapper acts as an intermediary that performs equality comparisons of entity identifiers without revealing which data sources share the same entities. The mapper decrypts identifiers from multiple data sources, compares them internally, and only reveals the pseudonym mapping result, preventing data sources from discovering relationships between each other while maintaining pseudonymisation.
3Reliability
If secure equality test is used for pseudonymisation, then entity identifiers can be mapped to pseudonyms, but computation time becomes proportional to the number of data records (O(n²)), making processing progressively slower
Solution Approach 1:
Instead of comparing all entity identifiers against each other (O(n²) complexity), the system uses encrypted copies of identifiers that can be processed independently and in parallel. The mapper receives encrypted identifiers, decrypts them individually, generates pseudonyms, and re-encrypts them - a process that scales linearly with the number of records rather than quadratically.
Solution Approach 2:
The system dynamically adapts to new data records by processing them individually through the mapper without requiring re-comparison with existing records. The mapper maintains a current mapping state and can efficiently handle new identifiers without O(n²) complexity, making the processing time independent of the total number of historical records.
4Reliability
If organizational measures are implemented to prevent malicious collusion, then data security can be improved, but data security management becomes more complicated
Solution Approach 1:
The system uses cryptographic mechanisms that automatically prevent malicious collusion without requiring complex organizational measures. The shared secret key between data sources and the mapper, combined with encryption and decryption operations, self-enforces security policies. Malicious actors cannot collude to crack anonymity because the cryptographic primitives mathematically prevent such attacks, eliminating the need for complex management protocols.
Data Source
AI summary
The invention is a cryptographic pseudonym mapping method for an anonymous data sharing system, the method being adapted for generating pseudonymised data from entity data originating from data sources (DSi), wherein the data are identified at the data sources (DSi) by entity identifiers (D) of the respective entities, and wherein the pseudonymised data are identified by pseudonyms assigned to the respective entity identifiers (D) applying a one-to-one mapping. Furthermore, the invention is a computer system implementing the method, and a computer program and a computer-readable medium.