Anonymity Properties Research Articles

Role Interchange for Anonymity and Privacy of Voting

We propose a new information-hiding property called role interchangeability for the verification of the anonymity and privacy of security protocols. First, we formally specify the new property in multi-agent systems, and describe its relationship with known anonymity properties that are also defined in multi-agent systems. Moreover, we define privacy in a way that is symmetric with anonymity, and show that exploiting this symmetry is useful for deriving anonymity and privacy from role interchangeability. Next, we show a way of verifying the new property. We show that role interchangeability in a multiagent system is characterized by the existence of role-interchange functions on the set of traces corresponding to the system. In addition, a simulation proof method is presented to prove the existence of the functions for a protocol described as an automaton. Finally, as a case study, we apply our method to the formal verification of the FOO electronic voting protocol.

Proof of certificateless MIP registration protocol based on PCL

Security protocols are the basis of many mobile communication systems, thus it is important to ensure protocol property correct. Using Protocol Composition Logic (PCL), this paper proves a Mobile IP (MIP) registration protocol that is based on certificateless public key signature without pairing between home agent and foreign agent, which minimizes the registration time and cost as well as improves the security compared with the identity-based and certificate-based registration protocol. Analysis and proof shows that the proposed protocol provides users security and authentications, moreover, the anonymity property is proved correct.

Anonymity and security for autonomous mobile agents

The mobile agent security against malicious hosts is one of the most important subjects in mobile agent technology. An extended requirement for an agent security in different applications is to provide it with anonymity property in such a way that the agent can travel in the network without exposing its owner identity and its itinerary. For this purpose, an agent anonymity protocol is proposed to maintain the anonymity of the agent owner and the agent itinerary. The introduced anonymous agent is also applied to disarm the host against the agent instead of using an armed agent, that is, an agent equipped with protection mechanisms. The analytical discussion demonstrated that this protocol preserves the autonomy of the agent in choosing the migration path and is also resistant against known traffic analysis attacks in mobile agent systems with plausible assumption. Moreover, it is feasible and adjustable regarding the required level of anonymity.

Social Aggregation Rules and Continuity

lt is shown that any continuous social aggregation rule for smooth preferences cannot simultaneously satisfy the properties of anonymity and respect of unanimity. This is true even when all individual preferences are linear. The relationship between the conditions on the social rule studied here and those of Arrow's paradox is discussed. The first result requires that the normalized gradient of the social choice rule be definable in the interior of the choice space, thus indicating a direction of increase of social preference. A second impossibility result extends the first to cases where the gradient of the social preference may vanish in the interior of the choice space.

A generalised model of e-trading for gradual secret release fair exchange protocol

In this article, we propose a generalised model of e-trading for the development of gradual secret release fair exchange protocols. Based on the model, the methodology is narrated to implement e-trading protocols that ensure fairness in true sense without using an additional trusted third party for which either party has to pay. The model provides the scope to include the correctness of the product, money atomicity and customer's anonymity properties within e-trading protocol. We conclude this article by indicating the area of applicability for the proposed model.

A Secure Authentication Scheme with Anonymity for Wireless Communications

Recently, a new authentication scheme with anonymity for wireless communications has been proposed, and then some security problems have been demonstrated. In this paper, we will discuss a few problems found in the enhanced scheme and then propose how to overcome them, regarding the properties of anonymity and backward secrecy.

An incentive-based electronic payment scheme for digital content transactions over the Internet

Digital content transactions through e-commerce will grow tremendous in the coming years. Well-designed electronic payment schemes and high-quality digital contents are two critical successful factors. This paper proposes an incentive-based electronic payment scheme, which can ensure both important properties of fair exchange and customer anonymity in e-commerce transactions and enhance authors’ motivation to create digital contents. The proposed payment scheme is based on cryptographic techniques. Besides, it adopts a mechanism called “the apportionment contract of sales revenue”, which records payees’ apportionment amount. The bank can immediately apportion the sales revenue according to this contract when customers complete payments. By scrupulous analyses, the proposed payment scheme can achieve fair exchange, customer anonymity, and payment security. This paper also compares the proposed payment scheme to related schemes. The comparison result shows that the proposed payment scheme has the best characteristics on the following viewpoints: incentive-based payment, fair exchange, customer anonymity, the denomination of payment token, and the number of payment token for a transaction.

Survey on Anonymity in Unstructured Peer-to-Peer Systems

Although anonymizing Peer-to-Peer (P2P) networks often means extra cost in terms of transfer efficiency, many systems try to mask the identities of their users for privacy consideration. By comparison and analysis of existing approaches, we investigate the properties of unstructured P2P anonymity, and summarize current attack models on these designs. Most of these approaches are path-based, which require peers to pre-construct anonymous paths before transmission, thus suffering significant overhead and poor reliability. We also discuss the open problems in this field and propose several future research directions.

A novel mutual authentication scheme based on quadratic residues for RFID systems

In 2004, Ari Juels proposed a Yoking-Proofs protocol for RFID systems. Their aim is to permit a pair of tags to generate a proof which is verifiable off-line by a trusted entity even when the readers are potentially untrusted. However, we found that their protocol does not possess the anonymity property but also suffers from both known-plaintext attack and replay attack. Wong et al. [Kirk H.M. Wong, Patrick C.L. Hui, Allan C.K. Chan, Cryptography and authentication on RFID passive tags for apparel products, Computer in Industry 57 (2005) 342-349] proposed an authentication scheme for RFID passive tags, attempting to be a standard for apparel products. Yet, to our review, their protocol suffers from guessing parameter attack and replay attack. Moreover, both of the schemes have the common weakness: the backend server must use brute search for each tag's authentication. In this paper, we first describe the weaknesses in the two above-mentioned protocols. Then, we propose a novel efficient scheme which not only achieve the mutual authentication between the server and the tag but also can satisfy all the security requirements needed in an RFID system.

Epistemic Verification of Anonymity

Anonymity is not a trace-based property, therefore traditional model checkers are not directly able to express it and verify it. However, by using epistemic logic (logic of knowledge) to model the protocols, anonymity becomes an easily verifiable epistemic formula. We propose using Dynamic Epistemic Logic to model security protocols and properties, in particular anonymity properties. We have built tool support for DEL verification which reuses state-of-the-art tool support for automata-based verification. We illustrate this approach by analyzing an anonymous broadcast protocol and an electronic voting protocol. By comparison with a process-based analysis of the same protocols, we also discuss the relative (dis)advantages of the process-based and epistemic-based verification methods in general.

Anonymous authentication scheme for wireless communications

Since, wireless networks make mobile users free from tethers that bind them to fixed places, research topics referred to mobile communications recently become popular. The exposure of signal transmission, however, leads to serious security problems in wireless channels. Engineers must be concerned about illegal attacks such as delusive behaviour and eavesdropping when designing network systems. Furthermore, limitations of mobile devices are also crucial challenges to contrive systems. Hence we propose an efficient method for validating the legitimacy of mobile users. Specifically, our scheme preserves the property of anonymity so that the intruder cannot track the movement history of mobile subscribers.

Distributed Ring Signatures from General Dual Access Structures

In a distributed ring signature scheme, a subset of users cooperate to compute a distributed anonymous signature on a message, on behalf of a family of possible signing subsets. The receiver can verify that the signature comes from a subset of the ring, but he cannot know which subset has actually signed. In this work we use the concept of dual access structures to construct a distributed ring signature scheme which works with vector space families of possible signing subsets. The length of each signature is linear on the number of involved users, which is desirable for some families with many possible signing subsets. The scheme achieves the desired properties of correctness, anonymity and unforgeability. We analyze in detail the case in which our scheme runs in an identity-based scenario, where public keys of the users can be derived from their identities. This fact avoids the necessity of digital certificates, and therefore allows more efficient implementations of such systems. But our scheme can be extended to work in more general scenarios, where users can have different types of keys.

GDH group-based signature scheme with linkability

Recently, a linkable ring signature scheme (called the LWW signature scheme), exhibiting the properties of anonymity, linkability and spontaneity, was presented. Its security is based on the decision Diffie–Hellman (DDH) problem. The distinguishing feature of the LWW signature scheme that differentiates it from other ring signature schemes is linkability, i.e. two signatures by the same signer can be linked. The LWW scheme can be used to construct new efficient e-voting systems. The drawback of the LWW scheme is that it works well on a group where the DDH problem is hard, but does not work on a GDH group where the DDH problem is easy and the computational Diffie–Hellman (CDH) problem is hard. In this paper, a linkable ring signature scheme is presented, based on a GDH group with anonymity, linkability and spontaneity. The security of the scheme is reduced to the discrete logarithm and a new intractability assumption (called DPDH problem) under the random oracle model.

Multi_profile welfarism: a generalization

This paper characterizes welfarist social evaluation in a multi-profile setting where, in addition to multiple utility profiles, there may be more than one profile of nonwelfare information. We prove a new version of the welfarism theorem in this alternative framework, and we demonstrate that adding a plausible and weak anonymity property to the welfarism axioms generates welfarist social-evaluation orderings that are anonymous. Journal of Economic Literature (This abstract was borrowed from another version of this item.) (This abstract was borrowed from another version of this item.) (This abstract was borrowed from another version of this item.)

An electronic online bidding auction protocol with both security and efficiency

In this paper, a new electronic auction scheme is proposed, which not only satisfies the requirement for the electronic auction properties of anonymity, security, privacy, atomicity and low overhead cost but also adds the properties of the non-repudiation, untraceability, auditability, one-time registration and unlinkability. Furthermore, we improve the operational scheme of the proposed electronic auction to meet its security and efficiency. Therefore, the proposed scheme is suitable for implementation.

The Egalitarian Solution for Multichoice Games

In a multichoice game a coalition is characterized by the level at which each player is acting, and to each coalition a real number is assigned. A multichoice solution assigns, for each multichoice game, a numerical value to each possible activity level of each player, intended to measure the contribution of each such level to reaching the grand coalition in which each player is active at the maximal level. The paper focuses on the egalitarian multichoice solution, characterized by the properties of Efficiency, Zero Contribution, Additivity, Anonymity, and Level Symmetry. The egalitarian solution is also shown to satisfy the property of marginalism: it measures the effect of lowering, ceteris paribus, a certain activity level by one. The solution is compared to a multichoice solution studied in Klijn, Slikker, and Zarzuelo (1999). Finally, it is discussed how the formalism of this paper can be applied to the different framework of multi-attribute utilities.

Multi-profile welfarism: A generalization

This paper characterizes welfarist social evaluation in a multi-profile setting where, in addition to multiple utility profiles, there may be more than one profile of non-welfare information. We prove a new version of the welfarism theorem in this alternative framework, and we demonstrate that adding a plausible and weak anonymity property to the welfarism axioms generates welfarist social-evaluation orderings that are anonymous.

An Anonymous Fingerprinting Scheme Based on Additively Homomorphic Public Key Cryptosystem

This paper proposes an anonymous fingerprinting scheme based on the additively homomorphic public key cryptosystems. The proposed fingerprinting scheme enables the merchant to identify the illegal distributors without the help of a trusted third party when he/she finds an illegally redistributed fingerprinted copy. Furthermore, it allows two-party trials, i.e. there is no need for the accused (and possibly innocent) buyer to take part in the dispute resolution protocol and reveal his/her secrets. In addition, the problem of how to construct the anonymous public key and private key pairs is also addressed in the scheme. The security analysis shows that the proposed scheme is secure for both seller and buyer, and has the properties of anonymity and unlinkability for the buyer.

Curbing gambling activities on the internet

Gambling is prohibited in Taiwan, although it has existed in the society for a long time. With the emergence of the Internet in the past decade, not only is e-commerce being promoted, but Internet gambling as well. The negative influence of Internet gambling, however, is much greater than the impact of traditional gambling on our society. Due to the properties of anonymity, lack of boundaries, and the rapid spread on the Internet, it is becoming increasingly difficult for law enforcement to seize suspects who engage in illegal gambling. In this paper, we introduce some serious problems resulting from Internet gambling, and provide a procedure to investigate and curb the spread of Internet betting in Taiwan. According to our proposal, the information of evidence collected is believed to be presented conclusively in a court of law. Persons attempting to bet on the Internet should be deterred.

A Quantitative Analysis of Anonymous Communications

This paper quantitatively analyzes anonymous communication systems (ACS) with regard to anonymity properties. Various ACS have been designed & implemented. However, there are few formal & quantitative analyzes on how these systems perform. System developers argue the security goals which their systems can achieve. Such results are vague & not persuasive. This paper uses a probabilistic method to investigate the anonymity behavior of ACS. In particular, this paper studies the probability that the true identity of a sender can be discovered in an ACS, given that some nodes have been compromised. It is through this analysis that design guidelines can be identified for systems aimed at providing communication anonymity. For example, contrary to what one would intuitively expect, these analytic results show that the probability that the true identity of a sender can be discovered might not always decrease as the length of communication path increases.