The Phantom Tollbooth: Privacy-Preserving Toll Collection in the - - PowerPoint PPT Presentation

▶
the phantom tollbooth privacy preserving toll collection
SMART_READER_LITE
LIVE PREVIEW

The Phantom Tollbooth: Privacy-Preserving Toll Collection in the - - PowerPoint PPT Presentation

Aug 20, 2023 554 likes •2.01k views

The Phantom Tollbooth: Privacy-Preserving Toll Collection in the Presence of Driver Collusion Sarah Meiklejohn (UC San Diego) Keaton Mowery (UC San Diego) Stephen Checkoway (UC San Diego) Hovav Shacham (UC San Diego) 1 Motivation: how tolling

slide-1
SLIDE 1

The Phantom Tollbooth: Privacy-Preserving Toll Collection in the Presence of Driver Collusion

Sarah Meiklejohn (UC San Diego) Keaton Mowery (UC San Diego) Stephen Checkoway (UC San Diego) Hovav Shacham (UC San Diego)

1

slide-2
SLIDE 2

Motivation: how tolling works today

2

slide-3
SLIDE 3

Motivation: how tolling works today

2

slide-4
SLIDE 4

Motivation: how tolling works today

2

slide-5
SLIDE 5

Motivation: how tolling works today

2

This process leaves a lot to be desired in terms of flexibility:

slide-6
SLIDE 6

Motivation: how tolling works today

2

This process leaves a lot to be desired in terms of flexibility:

  • How do we charge more according to the time of day?
slide-7
SLIDE 7

Motivation: how tolling works today

2

This process leaves a lot to be desired in terms of flexibility:

  • How do we charge more according to the time of day?
  • Or as drivers enter city centers?
slide-8
SLIDE 8

Motivation: how tolling works today

3

slide-9
SLIDE 9

Motivation: how tolling works today

3

slide-10
SLIDE 10

Motivation: how tolling works today

3

slide-11
SLIDE 11

Motivation: how tolling works today

3

Core tension between privacy and desire for more flexible toll pricing

slide-12
SLIDE 12

Motivation: how tolling works today

3

Core tension between privacy and desire for more flexible toll pricing

  • In this talk we’ll see our system, Milo, which allows for fine-grained pricing

policies without sacrificing drivers’ privacy

slide-13
SLIDE 13

Motivation: how tolling works today

3

Core tension between privacy and desire for more flexible toll pricing

  • In this talk we’ll see our system, Milo, which allows for fine-grained pricing

policies without sacrificing drivers’ privacy

  • In the process, we strongly guarantee that drivers remain honest
slide-14
SLIDE 14

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

slide-15
SLIDE 15

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

slide-16
SLIDE 16

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

  • Fine-grained policy: uses small road segments (where,when)
slide-17
SLIDE 17

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

  • Fine-grained policy: uses small road segments (where,when)
  • Privacy: uses Tor to maintain anonymity while driver uploads segments
slide-18
SLIDE 18

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

  • Fine-grained policy: uses small road segments (where,when)
  • Privacy: uses Tor to maintain anonymity while driver uploads segments
  • Honesty: relies on audits wherein driver is asked to verify locations
slide-19
SLIDE 19

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

  • Fine-grained policy: uses small road segments (where,when)
  • Privacy: uses Tor to maintain anonymity while driver uploads segments
  • Honesty: relies on audits wherein driver is asked to verify locations

USENIX Security 2010: PrETP [BRTPVG]

  • Fine-grained policy: again uses small road segments
  • Privacy: drivers commit to segments in a way that eliminates need for Tor
  • Honesty: again relies on audits
slide-20
SLIDE 20

Previous work [BKS05,BC06,TDKP07,dJJ08,...]

4

USENIX Security 2009: VPriv [PBB]

  • Fine-grained policy: uses small road segments (where,when)
  • Privacy: uses Tor to maintain anonymity while driver uploads segments
  • Honesty: relies on audits wherein driver is asked to verify locations

USENIX Security 2010: PrETP [BRTPVG]

  • Fine-grained policy: again uses small road segments
  • Privacy: drivers commit to segments in a way that eliminates need for Tor
  • Honesty: again relies on audits
slide-21
SLIDE 21

A potential problem: keeping colluding drivers honest

5

slide-22
SLIDE 22

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-23
SLIDE 23

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-24
SLIDE 24

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-25
SLIDE 25

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-26
SLIDE 26

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-27
SLIDE 27

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

slide-28
SLIDE 28

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

Proof of payment

slide-29
SLIDE 29

A potential problem: keeping colluding drivers honest

5

In these audits, we see a challenge/response behavior:

Proof of payment

slide-30
SLIDE 30

A potential problem: keeping colluding drivers honest

5

So the authority reveals to the driver the segment in which he was seen! This information can then be shared to help drivers avoid cameras in the future In these audits, we see a challenge/response behavior:

Proof of payment

slide-31
SLIDE 31

A potential problem: keeping colluding drivers honest

5

So the authority reveals to the driver the segment in which he was seen! This information can then be shared to help drivers avoid cameras in the future In these audits, we see a challenge/response behavior:

Proof of payment

slide-32
SLIDE 32

A potential problem: keeping colluding drivers honest

5

So the authority reveals to the driver the segment in which he was seen! This information can then be shared to help drivers avoid cameras in the future In these audits, we see a challenge/response behavior:

Proof of payment

slide-33
SLIDE 33

A potential problem: keeping colluding drivers honest

5

So the authority reveals to the driver the segment in which he was seen! This information can then be shared to help drivers avoid cameras in the future In these audits, we see a challenge/response behavior:

Proof of payment

USENIX Security 2011: Milo

  • Fine-grained policy: uses same small road segments (where,when)
  • Privacy: drivers commit to segments in a way similar to PrETP
  • Honesty: audit protocol no longer reveals locations to drivers
slide-34
SLIDE 34

Outline

6

slide-35
SLIDE 35

Outline

6

Cryptographic background

slide-36
SLIDE 36

Outline

6

Cryptographic background Milo

slide-37
SLIDE 37

Outline

6

Cryptographic background Milo Evaluation

slide-38
SLIDE 38

Outline

6

Cryptographic background Milo Evaluation Conclusions

slide-39
SLIDE 39

Outline

6

Cryptographic background Milo Evaluation Conclusions Cryptographic background

Commitment schemes Zero-knowledge proofs Blind identity-based encryption

slide-40
SLIDE 40

Commitments [BCC88,P91]

7

slide-41
SLIDE 41

Commitments [BCC88,P91]

7

slide-42
SLIDE 42

Commitments [BCC88,P91]

7

My favorite number is 42

slide-43
SLIDE 43

Commitments [BCC88,P91]

7

42

My favorite number is 42

slide-44
SLIDE 44

Commitments [BCC88,P91]

7

42 c =

My favorite number is 42

slide-45
SLIDE 45

Commitments [BCC88,P91]

7

42 c =

My favorite number is 42

slide-46
SLIDE 46

Commitments [BCC88,P91]

7

42 c =

My favorite number is 42

slide-47
SLIDE 47

Commitments [BCC88,P91]

7

42 c =

My favorite number is 42

slide-48
SLIDE 48

Commitments [BCC88,P91]

7

42 c = Open(c)

My favorite number is 42

slide-49
SLIDE 49

Commitments [BCC88,P91]

7

42 c = Open(c)

My favorite number is 42

slide-50
SLIDE 50

Commitments [BCC88,P91]

7

42 c =

There are two important properties of commitments:

Open(c)

My favorite number is 42

slide-51
SLIDE 51

Commitments [BCC88,P91]

7

42 c =

There are two important properties of commitments:

  • Hiding: Bob didn’t know the value in c until Alice gave him Open(c)

Open(c)

My favorite number is 42

slide-52
SLIDE 52

Commitments [BCC88,P91]

7

42 c =

There are two important properties of commitments:

  • Hiding: Bob didn’t know the value in c until Alice gave him Open(c)
  • Binding: Alice couldn’t change the value in c after giving Bob the envelope

Open(c)

My favorite number is 42

slide-53
SLIDE 53

Zero-knowledge proofs [GMR89,BdSMP91]

8

c =

slide-54
SLIDE 54

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c =

slide-55
SLIDE 55

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

slide-56
SLIDE 56

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

slide-57
SLIDE 57

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

Okay, I believe you!

slide-58
SLIDE 58

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

There are two important properties of zero-knowledge proofs:

Okay, I believe you!

slide-59
SLIDE 59

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

There are two important properties of zero-knowledge proofs:

  • Soundness: Alice can’t convince Bob of something that isn’t true

Okay, I believe you!

slide-60
SLIDE 60

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

There are two important properties of zero-knowledge proofs:

  • Soundness: Alice can’t convince Bob of something that isn’t true
  • Zero knowledge: Bob doesn’t learn anything about Alice’s exact number

Okay, I believe you!

slide-61
SLIDE 61

Zero-knowledge proofs [GMR89,BdSMP91]

8

The value in c is between 0 and 100

c = π

There are two important properties of zero-knowledge proofs:

  • Soundness: Alice can’t convince Bob of something that isn’t true
  • Zero knowledge: Bob doesn’t learn anything about Alice’s exact number

Zero-knowledge proofs are much more general than this, but this range proof is the only type we will need

Okay, I believe you!

slide-62
SLIDE 62

Blind identity-based encryption (IBE)

9

slide-63
SLIDE 63

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

slide-64
SLIDE 64

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

c = Enc(“Bob”, m)

slide-65
SLIDE 65

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

c = Enc(“Bob”, m)

slide-66
SLIDE 66

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

c = Enc(“Bob”, m) “Bob”

slide-67
SLIDE 67

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

c = Enc(“Bob”, m) “Bob” skBob

slide-68
SLIDE 68

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]:

c = Enc(“Bob”, m) “Bob” skBob

m = Dec(skBob,c)

slide-69
SLIDE 69

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob

m = Dec(skBob,c)

slide-70
SLIDE 70

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob c = Enc(“Bob”, m)

m = Dec(skBob,c)

slide-71
SLIDE 71

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob c = Enc(“Bob”, m) req(“Bob”)

m = Dec(skBob,c)

slide-72
SLIDE 72

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob c = Enc(“Bob”, m) req(“Bob”) resp(skBob)

m = Dec(skBob,c)

slide-73
SLIDE 73

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob c = Enc(“Bob”, m) req(“Bob”) resp(skBob)

m = Dec(skBob,c)

  • 1. Extract skBob from resp
  • 2. m = Dec(skBob,c)
slide-74
SLIDE 74

Blind identity-based encryption (IBE)

9

Regular [S84,BF01,C01]: Blind [GH07]:

c = Enc(“Bob”, m) “Bob” skBob c = Enc(“Bob”, m) req(“Bob”) resp(skBob)

m = Dec(skBob,c)

  • 1. Extract skBob from resp
  • 2. m = Dec(skBob,c)

So the authority doesn’t learn which key is being extracted

slide-75
SLIDE 75

Outline

10

Cryptographic background Milo

A generic toll collection system A look back at (adapted) PrETP A new Audit protocol

Evaluation Conclusions

slide-76
SLIDE 76

How privacy-preserving toll pricing works

11

slide-77
SLIDE 77

How privacy-preserving toll pricing works

11

segments

slide-78
SLIDE 78

How privacy-preserving toll pricing works

11

segments

A

slide-79
SLIDE 79

How privacy-preserving toll pricing works

11

segments

A

slide-80
SLIDE 80

How privacy-preserving toll pricing works

11

segments

A B

slide-81
SLIDE 81

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) segments

A B

slide-82
SLIDE 82

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) segments

A B

slide-83
SLIDE 83

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) segments

A B C

slide-84
SLIDE 84

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) (B-C,13:02-13:03) segments

A B C

slide-85
SLIDE 85

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) (B-C,13:02-13:03) segments

A B C

slide-86
SLIDE 86

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) (B-C,13:02-13:03) segments

A B C D

slide-87
SLIDE 87

How privacy-preserving toll pricing works

11

(A-B,13:01-13:02) (B-C,13:02-13:03) (C-D,13:03-13:04) segments

A B C D

slide-88
SLIDE 88

How privacy-preserving toll pricing works

12

slide-89
SLIDE 89

How privacy-preserving toll pricing works

12

OBU

slide-90
SLIDE 90

How privacy-preserving toll pricing works

12

OBU segments

slide-91
SLIDE 91

How privacy-preserving toll pricing works

12

OBU TSP segments

slide-92
SLIDE 92

How privacy-preserving toll pricing works

12

Payment OBU TSP segments

slide-93
SLIDE 93

How privacy-preserving toll pricing works

12

Payment OBU TSP segments

slide-94
SLIDE 94

How privacy-preserving toll pricing works

12

Check information and charge driver what they owe

Payment OBU TSP segments

slide-95
SLIDE 95

How privacy-preserving toll pricing works

12

Check information and charge driver what they owe

Payment OBU TSP TC segments

slide-96
SLIDE 96

How privacy-preserving toll pricing works

12

Check information and charge driver what they owe

Payment OBU TSP TC segments

slide-97
SLIDE 97

How privacy-preserving toll pricing works

12

Check information and charge driver what they owe

Audit Payment OBU TSP TC segments

slide-98
SLIDE 98

How privacy-preserving toll pricing works

12

Check information and charge driver what they owe

Audit Payment OBU TSP TC

Check outcome of Audit to ensure driver is being honest

segments

slide-99
SLIDE 99

An adapted version of PrETP

13

slide-100
SLIDE 100

An adapted version of PrETP

13

{ci,πi}i

slide-101
SLIDE 101

An adapted version of PrETP

13

{ci,πi}i

Commitment to segment price pi

slide-102
SLIDE 102

An adapted version of PrETP

13

{ci,πi}i

NIZK that the value in ci is in the proper range Commitment to segment price pi

slide-103
SLIDE 103

An adapted version of PrETP

13

{ci,πi}i

slide-104
SLIDE 104

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-105
SLIDE 105

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-106
SLIDE 106

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-107
SLIDE 107

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

(where,when)

slide-108
SLIDE 108

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

(where,when)

slide-109
SLIDE 109

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

(where,when)

Find commitment cj for (where,when)

slide-110
SLIDE 110

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

(where,when) cj, Open(cj)

Find commitment cj for (where,when)

slide-111
SLIDE 111

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
  • 1. cj vs. (where, when)
  • 2. cj vs. Open(cj)
  • 3. Correct segment price pj

(where,when) cj, Open(cj)

Find commitment cj for (where,when)

slide-112
SLIDE 112

An adapted version of PrETP

13

{ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
  • 1. cj vs. (where, when)
  • 2. cj vs. Open(cj)
  • 3. Correct segment price pj

(where,when) cj, Open(cj)

NIZK zero knowledge and commitment hiding guarantee driver privacy NIZK soundness guarantees price pi is in the right range (e.g., non-negative) Commitment binding guarantees cj is the right commitment for (where,when)

Find commitment cj for (where,when)

slide-113
SLIDE 113

“PrETP with sugar on top”: our new Audit protocol

14

slide-114
SLIDE 114

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

slide-115
SLIDE 115

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

Blind IBE of the

  • pening to ci, using

(where,when) as identity

slide-116
SLIDE 116

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

slide-117
SLIDE 117

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-118
SLIDE 118

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-119
SLIDE 119

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price
slide-120
SLIDE 120

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when)

slide-121
SLIDE 121

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when)

slide-122
SLIDE 122

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when) resp(skwhere,when)

slide-123
SLIDE 123

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when) resp(skwhere,when)

  • 1. Extract skwhere, when
  • 2. Trial decrypt each Ci
  • 3. cj vs. Open(cj)
  • 4. Correct segment price pj
slide-124
SLIDE 124

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when) resp(skwhere,when)

  • 1. Extract skwhere, when
  • 2. Trial decrypt each Ci
  • 3. cj vs. Open(cj)
  • 4. Correct segment price pj

NIZK zero knowledge and commitment hiding guarantee driver privacy NIZK soundness guarantees price pi is in the right range (e.g., non-negative) Commitment binding guarantees cj is the right commitment for (where,when)

slide-125
SLIDE 125

“PrETP with sugar on top”: our new Audit protocol

14

{ci,Ci,πi}i

  • 1. Verify each NIZK πi
  • 2. Compute total price

req(where,when) resp(skwhere,when)

  • 1. Extract skwhere, when
  • 2. Trial decrypt each Ci
  • 3. cj vs. Open(cj)
  • 4. Correct segment price pj

NIZK zero knowledge and commitment hiding guarantee driver privacy NIZK soundness guarantees price pi is in the right range (e.g., non-negative) Commitment binding guarantees cj is the right commitment for (where,when) IBE blindness guarantees that driver doesn’t learn segment (where,when)

slide-126
SLIDE 126

Outline

15

Cryptographic background Milo Evaluation

Implementation details Milo’s performance

Conclusions

slide-127
SLIDE 127

Implementation

16

slide-128
SLIDE 128

Implementation

16

Used MIRACL [Scott] for blind IBE, ZKPDL [MEKHL’10] for commitments and NIZKs

slide-129
SLIDE 129

Implementation

16

Used MIRACL [Scott] for blind IBE, ZKPDL [MEKHL’10] for commitments and NIZKs Collected timing information on both a MacBook Pro (acting as the TC) and an ARM v5TE (acting as the OBU)

slide-130
SLIDE 130

Implementation

16

Used MIRACL [Scott] for blind IBE, ZKPDL [MEKHL’10] for commitments and NIZKs Collected timing information on both a MacBook Pro (acting as the TC) and an ARM v5TE (acting as the OBU) When are blind IBE operations happening?

slide-131
SLIDE 131

Implementation

16

Used MIRACL [Scott] for blind IBE, ZKPDL [MEKHL’10] for commitments and NIZKs Collected timing information on both a MacBook Pro (acting as the TC) and an ARM v5TE (acting as the OBU) When are blind IBE operations happening?

  • Encryption: during Payment process
  • Extraction: during Audit (OBU as authority, TC as user)
  • Decryption: during Audit (TC needs to trial decrypt each ciphertext)
slide-132
SLIDE 132

Various measurements: time and space

17

slide-133
SLIDE 133

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Time for blind IBE

slide-134
SLIDE 134

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Time for blind IBE

cost for OBU during Audit is reduced

slide-135
SLIDE 135

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Object Size (B) NIZK 5455 Commitment 130 Ciphertext 366 Total Pay segment 5955 Audit message 494

3: Size of each of the components that needs

Time for blind IBE Size for messages

cost for OBU during Audit is reduced

slide-136
SLIDE 136

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Object Size (B) NIZK 5455 Commitment 130 Ciphertext 366 Total Pay segment 5955 Audit message 494

3: Size of each of the components that needs

Time for blind IBE Size for messages

cost for OBU during Audit is reduced NIZK size dominates total size

slide-137
SLIDE 137

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Object Size (B) NIZK 5455 Commitment 130 Ciphertext 366 Total Pay segment 5955 Audit message 494

3: Size of each of the components that needs

Length Time step Segments Time for TC (s) 1 mile 1 minute 2000 55.68 1 mile 1 hour 1000 33.51 2 miles 1 hour 500 10.45

in seconds and over a run of 10, for the TC to perform a single spot

Time for blind IBE Size for messages Time for TC to perform Audit

cost for OBU during Audit is reduced NIZK size dominates total size

slide-138
SLIDE 138

Various measurements: time and space

17

Time (ms) Operation Laptop ARM Creating parameters 75.12 1083.61 Encryption 82.11 1187.82 Blind extraction (user) 13.13 214.06 Blind extraction (authority) 11.21 175.25 Decryption 78.31 1131.58

Table 1: The average time, in milliseconds and over a run

Object Size (B) NIZK 5455 Commitment 130 Ciphertext 366 Total Pay segment 5955 Audit message 494

3: Size of each of the components that needs

Length Time step Segments Time for TC (s) 1 mile 1 minute 2000 55.68 1 mile 1 hour 1000 33.51 2 miles 1 hour 500 10.45

in seconds and over a run of 10, for the TC to perform a single spot

Time for blind IBE Size for messages Time for TC to perform Audit

time to iterate dominates cost for TC cost for OBU during Audit is reduced NIZK size dominates total size

slide-139
SLIDE 139

Outline

18

Cryptographic background Milo Evaluation Conclusions

slide-140
SLIDE 140

Conclusions

19

slide-141
SLIDE 141

Conclusions

19

We presented Milo, a privacy-preserving electronic toll collection system

slide-142
SLIDE 142

Conclusions

19

We presented Milo, a privacy-preserving electronic toll collection system

  • Guarantees honesty even in the face of driver collusion
  • Did so using blind IBE
  • Found that computational overhead was manageable, significantly

cheaper than certain alternatives

slide-143
SLIDE 143

Conclusions

19

We presented Milo, a privacy-preserving electronic toll collection system

  • Guarantees honesty even in the face of driver collusion
  • Did so using blind IBE
  • Found that computational overhead was manageable, significantly

cheaper than certain alternatives Future work:

  • Possibly formalizing security definitions
  • Find cheaper methods for achieving same security properties
slide-144
SLIDE 144

Conclusions

19

We presented Milo, a privacy-preserving electronic toll collection system

  • Guarantees honesty even in the face of driver collusion
  • Did so using blind IBE
  • Found that computational overhead was manageable, significantly

cheaper than certain alternatives Future work:

  • Possibly formalizing security definitions
  • Find cheaper methods for achieving same security properties

Thanks! Any questions?