Anonymous and Transferable Electronic Ticketing Scheme Data - - PowerPoint PPT Presentation

▶
anonymous and transferable electronic ticketing scheme
SMART_READER_LITE
LIVE PREVIEW

Anonymous and Transferable Electronic Ticketing Scheme Data - - PowerPoint PPT Presentation

Sep 10, 2022 327 likes •608 views

Anonymous and Transferable Electronic Ticketing Scheme Data Privacy Management, 8th International Workshop Arnau Vives-Guasch 1 a 2 M. Magdalena Payeras-Capell` a Mut-Puigserver 2 a-Roca 1 Maci` Jordi Castell` s Ferrer-Gomila 2

slide-1
SLIDE 1

Anonymous and Transferable Electronic Ticketing Scheme

– Data Privacy Management, 8th International Workshop – Arnau Vives-Guasch1

  • M. Magdalena Payeras-Capell`

a2 Maci` a Mut-Puigserver2 Jordi Castell` a-Roca1 Josep-Llu´ ıs Ferrer-Gomila2

1Universitat Rovira i Virgili. Tarragona (Spain) 2Universitat de les Illes Balears. Mallorca (Spain)

Egham, UK. September 12-13, 2013.

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 1 / 27

slide-2
SLIDE 2

Introduction

Table of Contents

1 Introduction

Contribution

2 Background 3 Description of the system 4 Conclusions & future work

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 2 / 27

slide-3
SLIDE 3

Introduction

Introduction

IT industry: smartphones revolution

Computation power Storage capacity Communication technologies (NFC, Wi-Fi, 4G, etc.) Mobility+flexibility: payment and ticketing schemes

Ticket: representation of the owner’s rights to receive a determined service

At least, the same security requirements have to be fulfilled as in paper format Requirements mainly depend on the service

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 3 / 27

slide-4
SLIDE 4

Introduction Contribution

Contribution

E-ticketing system Group signatures Security requirements:

Anonymity (revocable) Short-term linkability (adaptation from BBS scheme) Transferability

Easily deployable to real scenarios

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 4 / 27

slide-5
SLIDE 5

Background

Table of Contents

1 Introduction 2 Background

Security assumptions Procedures

3 Description of the system 4 Conclusions & future work

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 5 / 27

slide-6
SLIDE 6

Background Security assumptions

Security assumptions

Definition (The q-Strong Diffie-Hellman problem, SDH) Given two cyclic groups G1 and G2 of prime order p, two randomly chosen generators g1 ∈ G1 and g2 ∈ G2 of their respective groups, with an isomorphism ψ : G2 → G1 where g1 = ψ(g2), the q-SDH problem is a hard computational problem where the (q+2)-tuple (g1, g2, gγ

2 , gγ2 2 , ..., gγq 2 ) ∈ G1 × G q+1 2

is the input and the pair (g

1 x+γ

1

, x) ∈ G1 × Zp is the output, for some x ∈ Z∗

p such that x + γ = 0.

Definition (The Decision Linear Diffie-Hellman problem, DLIN) Given a cyclic group G1 of order p, and taking u, v, h, ua, vb, hc ∈ G1 as input, where u, v, h ∈ G1 randomly chosen generators, and random a, b, c ∈ Zp, and output yes if a + b = c and no otherwise.

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 6 / 27

slide-7
SLIDE 7

Background Procedures

Procedures

BBS scheme:

KeyGenG SignG VerifyG OpenG

ZKP of the BBS scheme:

ZKPGCommit ZKPGResponse ZKPGVerify

Own adaptation for short-term linkability:

SignLinkableG VerifyLinkableG

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 7 / 27

slide-8
SLIDE 8

Background Procedures

Procedures: KeyGenG(n)

Generate group of n users and their respective set of keys.

1 select h R

← G1\{1G1}

2 generate gmsk = (ξ1, ξ2) where ξ1, ξ2 R

← Z∗

p 3 set u, v ∈ G1 such that uξ1 = vξ2 = h 4 select γ R

← Z∗

p 5 set w = gγ 2 6 generate ∀Ui, 1 ≤ i ≤ n, an SDH tuple (Ai, xi) by:

select xi

R

← Z∗

p

set Ai ← g 1/(γ+xi)

1

γ is the private master key of the group key issuer

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 8 / 27

slide-9
SLIDE 9

Background Procedures

Procedures: SignG(gpk, gsk[i], M) I

Given gpk = (g1, g2, h, u, v, w), gsk[i] = (Ai, xi) and a message M ∈ {0, 1}∗, output a signature of knowledge σ = (T1, T2, T3, c, sα, sβ, sx, sδ1, sδ2).

1 select α, β R

← Zp

2 compute the linear encryption of A: (T1, T2, T3) ← (uα, vβ, Ahα+β) 3 compute δ1 ← xα and δ2 ← xβ; 4 select rα, rβ, rx, rδ1, rδ2 R

← Zp

5 compute:

R1 ← urα R2 ← v rβ R3 ← e(T3, g2)rx · e(h, w)−rα−rβ · e(h, g2)−rδ1−rδ2 R4 ← T rx

1 · u−rδ1

R5 ← T rx

2 · v −rδ2

6 compute: c ← H(M, T1, T2, T3, R1, R2, R3, R4, R5)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 9 / 27

slide-10
SLIDE 10

Background Procedures

Procedures: SignG(gpk, gsk[i], M) II

7 generate:

sα ← rα + cα sβ ← rβ + cβ sx ← rx + cx sδ1 ← rδ1 + cδ1 sδ2 ← rδ2 + cδ2

8 output σ ← (T1, T2, T3, c, sα, sβ, sx, sδ1, sδ2).

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 10 / 27

slide-11
SLIDE 11

Background Procedures

Procedures: VerifyG(gpk, M, σ)

Given gpk = (g1, g2, h, u, v, w), a message M and σ = (T1, T2, T3, c, sα, sβ, sx, sδ1, sδ2), verify that σ is a valid signature of the message

1 re-derive R1, R2, R3, R4, R5:

˜ R1 ← usα/T c

1

˜ R2 ← v sβ/T c

2

˜ R3 ← e(T3, g2)sx ·e(h, w)−sα−sβ ·e(h, g2)−sδ1−sδ2 ·(e(T3, w)/e(g1, g2))c ˜ R4 ← T sx

1 /usδ1

˜ R5 ← T sx

2 /v sδ2

2 verify c ?

= H(M, T1, T2, T3, ˜ R1, ˜ R2, ˜ R3, ˜ R4, ˜ R5)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 11 / 27

slide-12
SLIDE 12

Background Procedures

Procedures: OpenG(gpk, gmsk, M, σ)

Trace a signature to a concrete signer inside the group MG holds gmsk master key and knows all (Ai, xi) pairs Given gpk = (g1, g2, h, u, v, w), gmsk = (ξ1, ξ2), a message M and σ = (T1, T2, T3, c, sα, sβ, sx, sδ1, sδ2):

1 Recover user’s identity: A ← T3/(T ξ1

1 · T ξ2 2 )

2 If elements {Ai} of the gsk[i] are given to MG, look up the user index

for A recovered from the signature

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 12 / 27

slide-13
SLIDE 13

Background Procedures

Procedures: SignLinkableG(gpk, gsk[i], M)

Given gpk, gsk[i], a new message M′, a previous signature σ, and the values α, β used for that signature, compute and output a signature σ′ First use: standard SignG(gpk, gsk[i], M). Obtains σ with (α, β) Further uses: SignLinkableG(gpk, gsk[i], M′, σ, α, β):

1 use the same pair (α, β) producing the same linear encryption of A:

(T1, T2, T3) = (uα, v β, Ahα+β)

2 given a message M′, sign the message:

σ′ ← (T1, T2, T3, c′, s′

α, s′ β, s′ x, s′ δ1, s′ δ2) where

c′ ← H(M′, T1, T2, T3, R′

1, R′ 2, R′ 3, R′ 4, R′ 5) ∈ Zp

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 13 / 27

slide-14
SLIDE 14

Background Procedures

Procedures: VerifyLinkableG(σ, σ′)

This algorithm takes two signatures σ and σ′ as input and outputs true or false depending on whether the signatures have been produced by the same signer’s pseudonym: T1

?

= T1′ T2

?

= T2′ T3

?

= T3′

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 14 / 27

slide-15
SLIDE 15

Description of the system

Table of Contents

1 Introduction 2 Background 3 Description of the system

Requirements Participants Phases

4 Conclusions & future work

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 15 / 27

slide-16
SLIDE 16

Description of the system Requirements

Requirements

Authenticity Non-repudiation Integrity Revocable anonymity Short-term linkability Non-overspending Transferability

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 16 / 27

slide-17
SLIDE 17

Description of the system Participants

Participants

User (U) Issuer (I) Service provider (P) Group Manager (MG)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 17 / 27

slide-18
SLIDE 18

Description of the system Phases

Phases

Ticket issue Ticket transfer

1st time (from original) Further times (from already transferred)

Ticket verification

Standard (original) Transferred

Revocation of anonymity (MG)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 18 / 27

slide-19
SLIDE 19

Description of the system Phases

Phases: Ticket issue

User (U) Issuer (I) nα

R

← Zp

nα

← − − − − − −

selects Sv V = SignG(Sv, nα, flag issue)

V

− − − − − − →

VerifyG(V) T = SignI(Sn, Sv, Tc, V, ...)

T

← − − − − − −

VerifyI(T)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 19 / 27

slide-20
SLIDE 20

Description of the system Phases

Phases: Ticket transfer (1st time)

User sender (U1) User receiver (U2) mβ0 = ZKPG Commit(T) mβ0,T

− − − − − − − − →

VerifyI(T) VerifyG (T.V) nλ0

R

← Zp cβ0 = H(nλ0, k = 0, price, flag transfer) cβ0

← − − − − − − −

sβ0 = ZKPG Response(mβ0, cβ0) nβ0

R

← Zp sβ0,nβ0

− − − − − − − − − →

ZKPG Verify(mβ0, cβ0, sβ0) W0 = SignG (nβ0, T∗, flag transfer); W0

← − − − − − − −

VerifyG (W0) X0 = SignLinkableG (W0) X0

− − − − − − →

VerifyG (X0) VerifyLinkableG (T.V, X0)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 20 / 27

slide-21
SLIDE 21

Description of the system Phases

Phases: Ticket transfer (further times)

User sender (U1) User receiver (U2) mβk = ZKPG Commit(Xk−1) mβk ,Xk−1

− − − − − − − − − − →

VerifyI(T∗) VerifyG (T.V) VerifyLinkableG (X0, T.V) ∀i ∈ [0, k) : { VerifyG (Xi) VerifyG (Wi) if (∃Wi−1) VerifyLinkableG (Xi, Wi−1) } nλk

R

← Zp cβk = H(nλk , k, price, flag transfer) cβk

← − − − − − − −

nβk

R

← Zp sβk = ZKPG Response(mβk , cβk ) sβk ,nβk

− − − − − − − − − →

ZKPG Verify(mβk , cβk , sβk ) Wk = SignG (nβk , Xk−1, flag transfer) Wk

← − − − − − − −

VerifyG (Wk) Xk = SignLinkableG (Wk, Wk−1) Xk

− − − − − − →

VerifyG (Xk) VerifyLinkableG (Xk, Wk−1)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 21 / 27

slide-22
SLIDE 22

Description of the system Phases

Phases: Ticket verification (standard)

User (U) Provider (P)

T∗

− − − − − − →

VerifyI(T∗) VerifyG(T.V) nγ

R

← Zp

nγ

← − − − − − −

Y = SignLinkableG(nγ, T.Sn, flag spend standard)

Y

− − − − − − →

VerifyG(Y) VerifyLinkableG(T.V, Y)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 22 / 27

slide-23
SLIDE 23

Description of the system Phases

Phases: Ticket verification (transferred)

User (U) Provider (P) Xk

− − − − − − →

VerifyI(T∗) VerifyG (T.V) VerifyLinkableG (X0, T.V) ∀i ∈ [0, k] : { VerifyG (Xi) VerifyG (Wi) if (∃Wi−1) VerifyLinkableG (Xi, Wi−1) } nγ

R

← Zp nγ

← − − − − − −

Y = SignLinkableG (nγ, T.Sn, flag spend transferred) Y

− − − − − − →

VerifyG (Y) VerifyLinkableG (Wk, Y)

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 23 / 27

slide-24
SLIDE 24

Description of the system Phases

Phases: Revocation of anonymity

In case of controversy (e.g. overspending), MG could revoke the anonymity of the misbehaver by calling OpenG procedure

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 24 / 27

slide-25
SLIDE 25

Conclusions & future work

Table of Contents

1 Introduction 2 Background 3 Description of the system 4 Conclusions & future work

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 25 / 27

slide-26
SLIDE 26

Conclusions & future work

Conclusions & future work

Proposal for e-ticketing system

Revocable anonymity Short-term linkability Transferability

Adaptation of group signature scheme for partial linkability Security analysis Future work:

Automated validation tools for the proposal Performance analysis of current proposal in real scenario (mobile devices) Atomic verification (chain of signatures) Comparison of performance results

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 26 / 27

slide-27
SLIDE 27

Conclusions & future work

Anonymous and Transferable Electronic Ticketing Scheme

– Data Privacy Management, 8th International Workshop – Arnau Vives-Guasch1

  • M. Magdalena Payeras-Capell`

a2 Maci` a Mut-Puigserver2 Jordi Castell` a-Roca1 Josep-Llu´ ıs Ferrer-Gomila2

1Universitat Rovira i Virgili. Tarragona (Spain) 2Universitat de les Illes Balears. Mallorca (Spain)

Egham, UK. September 12-13, 2013.

  • A. Vives-Guasch et al. (URV-UIB)

Anonymous & Transferable e-Ticketing DPM 2013 27 / 27