Secret Handshake Credential Revocation via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secret handshake protocols lack an effective mechanism for credential revocation, which compromises user anonymity and allows unauthorized users to impersonate legitimate users, leading to malicious activities.
Innovation Solution
A method and system for verifying associations through secret handshake protocols using reusable identification handles and credentials, where information is stored and managed by trusted third parties, allowing for secure transmission and comparison with revocation lists to determine valid credentials, ensuring anonymity and untraceability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are exchanged in encrypted and randomized form to assure confidentiality and anonymity, then user anonymity is protected, but the ability to revoke credentials is compromised
Solution Approach 1:
The credential system is segmented into multiple components: public credentials for authentication, private credentials for revocation verification, and revocation lists maintained by trusted authorities. This segmentation allows the system to maintain anonymity through encrypted credential exchange while enabling revocation through separate verification mechanisms that check against published revocation lists without exposing user identities.
2Adaptability or versatility
If credentials are uniquely labeled to enable revocation, then credential revocation becomes possible, but user anonymity is compromised
Solution Approach 1:
Trusted third-party authorities act as intermediaries between credential issuance and revocation verification. These authorities maintain revocation lists and provide verification services without learning user identities. The intermediary structure enables credential revocation through labeled credentials while preserving user anonymity by ensuring that the labeling and verification processes are mediated through trusted entities that do not compromise privacy.
3Reliability
If a revocation mechanism is implemented in secret handshake protocols, then unauthorized access can be prevented, but the complexity of the protocol increases
Solution Approach 1:
Revocation lists are prepared and published in advance by trusted authorities before credential verification is needed. Users can pre-load these revocation lists into their devices, allowing them to independently verify credential validity without requiring real-time communication with authorities during the secret handshake protocol. This preliminary action reduces protocol complexity by eliminating the need for complex real-time verification mechanisms.
Data Source
AI summary
According to a general aspect, a computer-implemented method for a first user to verify an association with a second user through a secret handshake protocol includes maintaining information about a reusable identification handle for the first user, where the information about the reusable identification handle is provided by a trusted third party, maintaining information about a reusable credential for the first user, where the information about the reusable credential is provided by a trusted third party, and maintaining information about a matching reference for verifying an association with another user, where the information about the matching reference is provided by a trusted third party. Information based on the reusable identification handle and based on the reusable credential is transmitted to a potential peer. First information based on a reusable identification handle for the second user is received, and second information based on a reusable credential for the second user is received. A first comparison of a combination of the first information and the second information is performed with the matching reference to determine whether the second user's credentials match the first users matching reference. A second comparison of the first information with information published on a revocation list is performed to determine whether the second user's credentials have been revoked from usage. Based on the first comparison and the second comparison, a determination is made whether or not to verify the association of second user with the first user.