Anonymous Scheme Research Articles

Preserving Privacy with Probabilistic Indistinguishability in Weighted Social Networks

The increasing popularity of social networks has inspired recent research to explore social graphs for marketing and data mining. As social networks often contain sensitive information about individuals, preserving privacy when publishing social graphs becomes an important issue. In this paper, we consider the identity disclosure problem in releasing weighted social graphs. We identify weighted 1*-neighborhood attacks, which assume that an attacker has knowledge about not only a target's one-hop neighbors and connections between them (1-neighborhood graph), but also related node degrees and edge weights. With this information, an attacker may re-identify a target with high confidence, even if any node's 1-neighborhood graph is isomorphic with $k-1$ other nodes’ graphs. To counter this attack while preserving high utility of the published graph, we define a key privacy property, probabilistic indistinguishability, and propose a heuristic indistinguishable group anonymization (HIGA) scheme to anonymize a weighted social graph with such a property. Extensive experiments on both real and synthetic data sets illustrate the effectiveness and efficiency of the proposed scheme.

An Improved E-Payment System and Its Extension to a Payment System for Visually Impaired and Blind People with User Anonymity

Electronic payment systems have become increasingly popular due to the widespread use of the internet-based shopping and banking. Such systems should at least guarantee users' anonymity during the transaction, fair exchange of goods and offer dispute resolutions. As many of the electronic payments are nowadays performed on mobile devices, also efficiency with respect to communication and computation costs at the user's side is another important requirement. In this paper we first show that a previously proposed system does not offer the claimed anonymity and non repudiation features. These issues are based on problems in the underlying authenticated encryption scheme. We propose an alternative system that satisfies all the required security features. In addition, we show how similar techniques can be applied to develop a payment system on a vending machine or in a retail outlet for the user using its smartphone as proxy, allowing besides confidentiality and authentication, also user anonymity throughout the whole process. This payment system is in particular of interest for blind or visually impaired people, who become able to take the whole payment process in own hands, instead of being dependent of the payment device and the possibly untrusted environment. Both payment systems apply the anonymous signcryption scheme ASEC as building block.

Dynamic reversed accumulator

Anonymous credential schemes have been widely employed to prove the authenticity of a member by revealing specific member attributes while concealing the real identity from the verifier. Furthermore, an accumulator is used to demonstrate the validity of the credential by providing a corresponding witness. In existing accumulator schemes, all credential holders must update their witnesses when a member joins or is revoked from the system, causing the schemes to become impractical. This paper examines the security of several recent accumulator schemes and proposes a novel approach, the dynamic reversed accumulator, which is more efficient than existing schemes because a corresponding witness can be updated when several members have been revoked.

Graph Data Anonymization, De-Anonymization Attacks, and De-Anonymizability Quantification: A Survey

Nowadays, many computer and communication systems generate graph data. Graph data span many different domains, ranging from online social network data from networks like Facebook to epidemiological data used to study the spread of infectious diseases. Graph data are shared regularly for many purposes including academic research and for business collaborations. Since graph data may be sensitive, data owners often use various anonymization techniques that often compromise the resulting utility of the anonymized data. To make matters worse, there are several state-of-the-art graph data de-anonymization attacks that have proven successful in recent years. In this paper, we survey the graph data anonymization, de-anonymization, and de-anonymizability quantification techniques in the past decade. Specifically, we systematically classify, summarize, and analyze state-of-the-art graph data anonymization, de-anonymization, and de-anonymizability quantification techniques. For existing graph data anonymization techniques, we classify them into six categories and analyze their utility performance with respect to 15 fundamental graph utility metrics and seven high-level application utility metrics. For existing de-anonymization attacks, we classify them into two categories and examine their performance with respect to scalability, practicability, robustness, etc. We also analyze the resistance of existing graph anonymization techniques against existing graph de-anonymizaiton attacks. For existing de-anonymizability quantifications, we classify them according to whether they consider seed information or not, and analyze them in terms of their soundness. Our analysis demonstrates that: 1) most anonymization schemes can partially or conditionally preserve most graph utility while losing some application utility and 2) state-of-the-art anonymization schemes are vulnerable to several or all of the emerging structure-based de-anonymization attacks. The actual vulnerability of each anonymization algorithm depends on how much and which data utility it preserves. Based on our summarization and analysis, we discuss the research evolution, future directions, and challenges in the research area of graph data anonymization, de-anonymization, and de-anonymizability quantification.

Anonymous hierarchical identity-based encryption with bounded leakage resilience and its application

Hierarchical identity-based encryption can be used to protect the sensitive data in cloud system. However, as the traditional security model does not capture side-channel attacks, many hierarchical identity-based encryption schemes do not resist this kind of attack, which can exploit various forms of unintended information leakage. Inspired by these, leakage-resilience cryptography formalises some models of side-channel attacks. In this paper, we consider the memory leakage resilience in anonymous hierarchical identity-based encryption schemes. By applying Lewko et al.'s tools, we construct a master key leakage-resilient anonymous hierarchical identity-based encryption scheme based on dual system encryption techniques. As an interesting application of our scheme, we consider security for public-key encryption with multi-keyword ranked search (PEMKRS) in the presence of secret key leakage in the trapdoor generation algorithm, and provide a generic construction of leakage-resilient secure PEMKRS from a master key leakage-resilient anonymous hierarchical identity-based encryption scheme.

Anonymous multi-receiver broadcast encryption scheme with strong security

Anonymity is an important way to achieve the privacy protection of identity. Recently, to protect the identities of the receivers, many anonymous multi-receiver ID-based broadcast encryption schemes have been proposed. However, most of existing schemes are shown to not be able to protect the privacy of the receivers, and their schemes are only proven to have IND-sMID-CCA security and ANON-sID-CCA security. To achieve anonymity of the receivers' identities and stronger security proof, in this paper, we first redefine the security notion of the receiver anonymity and make that the definition is stronger than the definition of previous receiver anonymity. Then we propose a novel anonymous multi-receiver ID-based broadcast encryption scheme, and show that our scheme is proven to be secure against the IND-MID-CCA attacks and ANON-ID-CCA attacks in the random oracle model, our security model is stronger than the selective identity attack model on which most of existing schemes are based. Finally, we analyse the performance of our scheme by comparing with four other schemes, the result shows that our scheme is the most efficient one.

An Analysis of the Privacy Threat in Vehicular Ad Hoc Networks due to Radio Frequency Fingerprinting

In Vehicular Ad Hoc Networks (VANETs) used in the road transportation sector, privacy risks may arise because vehicles could be tracked on the basis of the information transmitted by the Vehicle to Vehicle (V2V) and Vehicle to Infrastructure (V2I) communications implemented with the Dedicated Short Range Communications (DSRC) standards operating at 5.9 GHz. Various techniques have been proposed in the literature to mitigate these privacy risks including the use of pseudonym schemes, but they are mostly focused on data anonymization at the network and application layer. At the physical layer, the capability to accurately identify and fingerprint wireless devices through their radio frequency (RF) emissions has been demonstrated in the literature. This capability may generate a privacy threat because vehicles can be tracked using the RF emissions of their DSRC devices. This paper investigates the privacy risks related to RF fingerprinting to determine if privacy breaches are feasible in practice. In particular, this paper analyzes the tracking accuracy in challenging RF environments with high attenuation and fading.

Resilient Privacy Preservation Scheme to Detect Sybil Attacks in Vehicular Ad Hoc Networks

Objective: Vehicular Ad hoc Networks (VANETs) have the potential to improve road safety dramatically, regulate traffic, management of parking lots and public areas. Security and Privacy are two significant concerns in VANETs, as a malicious vehicle may deliberately deceive other vehicles in the network. Analysis: Disastrously, several privacy-preserving methods are susceptible to Sybil attacks, whereby a malicious vehicle impersonates as multiple benign vehicles for gaining a disproportionately large influence. Conventional pseudonym generation schemes preserve driver’s privacy and also facilitate identifying the Sybil attacker. However, the pseudonym scheme induces a brand new issue where in a smart attacker may compromise semi-trusted RSUs and launch a Sybil attack in a particular area. Findings: This paper proposes a System for detecting misbehavior vehicles with location Privacy (SYBIL-CAP), consisting TcA - Preserving Location Privacy (TAP-LOOP), and Resilience to RSU compromise (RESUME) for identifying Sybil attacker. SYBIL-CAP provides a temporarily authorized certificate that includes the trusted certificate and secret key trajectories to vehicles to recognize compromised RSU without requiring the unique identity of vehicles. More precisely, in TAP-LOOP, a vehicle approaches a TCA to receive a location-hidden trusted certificate via RSU to conceal its sensitive information at all times. RESUME implements Diffie-Hellman Key Exchange (DHKE) algorithm between two adjacent RSUs to generate a shared secret key, appended in the temporarily authorized certificate. A vehicle identifies the compromised RSU and malicious vehicle by verifying the authorized message at a group of three consecutive RSUs. Improvement: The simulation results depict that the SYBIL-CAP largely restricts Sybil attack by detecting compromised RSU with lower overhead, compared to existing P2DAP.

A Novel Multi-Receiver Signcryption Scheme with Complete Anonymity.

Anonymity, which is more and more important to multi-receiver schemes, has been taken into consideration by many researchers recently. To protect the receiver anonymity, in 2010, the first multi-receiver scheme based on the Lagrange interpolating polynomial was proposed. To ensure the sender’s anonymity, the concept of the ring signature was proposed in 2005, but afterwards, this scheme was proven to has some weakness and at the same time, a completely anonymous multi-receiver signcryption scheme is proposed. In this completely anonymous scheme, the sender anonymity is achieved by improving the ring signature, and the receiver anonymity is achieved by also using the Lagrange interpolating polynomial. Unfortunately, the Lagrange interpolation method was proven a failure to protect the anonymity of receivers, because each authorized receiver could judge whether anyone else is authorized or not. Therefore, the completely anonymous multi-receiver signcryption mentioned above can only protect the sender anonymity. In this paper, we propose a new completely anonymous multi-receiver signcryption scheme with a new polynomial technology used to replace the Lagrange interpolating polynomial, which can mix the identity information of receivers to save it as a ciphertext element and prevent the authorized receivers from verifying others. With the receiver anonymity, the proposed scheme also owns the anonymity of the sender at the same time. Meanwhile, the decryption fairness and public verification are also provided.

Provably Secure Multi-server Privacy-Protection System Based on Chebyshev Chaotic Maps without Using Symmetric Cryptography

Most of the privacy-protection schemes adopting chaotic maps are usually by symmetric cryptography for guaranteeing identity hiding. This will lead to a high calculated amount. So, the paper will wipe out the symmetric cryptography, and only use chaotic maps, a secure one-way hash function to construct a provable privacy-protection system (PPS) which can achieve two kinds of privacy- protection and switch between them optionally by users: The first is anonymous scheme which can make nobody know the user's identity, including the server and the registration center (RC), and they only know these users are legal or paying members. The other is hiding scheme which owns also privacy-protection property, because the user's identity is not transferred during the process of the proposed protocol, and only the server and the RC know the user's identity. About practical environment, we adopt multi-server architecture which can allow the user to register at the RC once and can access all the permitted services provided by the eligible servers. Then a new PPS authenticated key agreement protocol is given based on chaotic maps. Security of the scheme is based on chaotic maps hard problems and a secure one way hash function. Compared with the related literatures recently, our proposed scheme can not only own high efficiency and unique functionality, but is also robust to various attacks and achieves perfect forward secrecy. Finally, we give the security proof and the efficiency analysis of our proposed scheme.

A novel location privacy-preserving scheme based on l-queries for continuous LBS

Location cloaking based on k-anonymity is one of the most prevalent privacy-preserving technologies for Location Based Services (LBS). However, it has been proved vulnerable to expose the user's identity. In this paper, we propose a location anonymity scheme based on the fake queries in continuous location-based services. To prevent attackers from tracing a mobile user by his/her continuous queries, some fake queries will be randomly injected by a Trusted Third Party. These fake queries can prevent the reverse mapping from user identity to query content. Also, we hide his/her actual query amongst a set of queries by merging the neighbors’ request in a single query. Moreover, a partitioning algorithm and a clustering algorithm are introduced to reduce the computation and communication overhead further. Security analysis shows that our scheme can resist the continuous queries attack and the trajectory attack. Detailed theoretical analyses and experimental results show the effectiveness and practicality of the proposed scheme.

Anonymizing popularity in online social networks with full utility

With the rapid growth of social network applications, more and more people are participating in social networks. Privacy protection in online social networks becomes an important issue. The illegal disclosure or improper use of users’ private information will lead to unaccepted or unexpected consequences in people’s lives. In this paper, we concern on authentic popularity disclosure in online social networks. To protect users’ privacy, the social networks need to be anonymized. However, existing anonymization algorithms on social networks may lead to nontrivial utility loss. The reason is that the anonymization process has changed the social network’s structure. The social network’s utility, such as retrieving data files, reading data files, and sharing data files among different users, has decreased. Therefore, it is a challenge to develop an effective anonymization algorithm to protect the privacy of user’s authentic popularity in online social networks without decreasing their utility. In this paper, we first design a hierarchical authorization and capability delegation (HACD) model. Based on this model, we propose a novel utility-based popularity anonymization (UPA) scheme, which integrates proxy re-encryption with keyword search techniques, to tackle this issue. We demonstrate that the proposed scheme can not only protect the users’ authentic popularity privacy, but also keep the full utility of the social network. Extensive experiments on large real-world online social networks confirm the efficacy and efficiency of our scheme.

A new generic construction of anonymous designated confirmer signature for privacy-preserving fair exchange

ABSTRACTDesignated confirmer signature (DCS), introduced by Chaum at Eurocrypt 1994, can be used to control the public verifiability of a digital signature. It is a very useful tool in many applications which require a signature to remain anonymous and unverifiable until a certain time/condition is reached. In this paper, we propose a new generic construction of Anonymous Identity-Based DCS from Anonymous Identity-Based Signature. Interestingly, our construction also automatically implies an Anonymous Identity-Based Convertible Undeniable Signature scheme. We prove that the construction is secure for signer, verifier and confirmer in the standard model.

Privacy-preserving distributed location proof generating system

The rapid development of location-based service (LBS) drives one special kind of LBS, in which the service provider verifies user location before providing services. In distributed location proof generating schemes, preventing users from colluding with each other to create fake location proofs and protecting user's location privacy at the same time, are the main technical challenges to bring this kind of LBS into practical. Existing solutions tackle these challenges with low collusion-detecting efficiency and defected collusion-detecting method. We proposed two novel location proof generating schemes, which inversely utilized a secure secret-sharing scheme and a pseudonym scheme to settle these shortcomings. Our proposed solution resists and detects user collusion attacks in a more efficient and correct way. Meanwhile, we achieve a higher level of location privacy than that of previous work. The correctness and efficiency of our proposed solution is testified by intensive security analysis, performance analysis, as well as experiments and simulation results.

Pricing combinatorial auctions by a set of linear price vectors

In combinatorial auctions, items are sold simultaneously. A substantial component of an auction mechanism is the pricing scheme. Prices determine the auctioneer's revenue and, ideally, justify the outcome of the auction to the bidders. Each bidder should be able to see why he won or lost a certain bundle by comparing the determined price of a bundle and his bid's value. In this paper, we pick up a non-linear anonymous pricing scheme from the literature that consists of a set of linear price vectors. We investigate whether this scheme can guarantee to find prices that support the winner allocation. Furthermore, we refine the pricing scheme by suggesting various objectives in order to evaluate different prices. We consider the computational complexity of the corresponding optimization problems and compare different objectives by means of a computational study using a well-established combinatorial auction test suite.

SARDS: Secured Anonymous Routing with Digital Signature in Wireless Sensor Network

A Wireless Sensor Network has witnessed a massive research towards security as well as energy efficiency in past decades. However, there are few studies that have witnessed a cost effective secure routing technique with energy effectiveness till date. Objectives: Our objective is to use public key cryptography for ensuring energy-efficient routing technique in Wireless Sensor Network. Method/Analysis: The proposed paper presents a technique called as SARDS (Secured Anonymous Routing with Digital Signature) that performs verification of the routing information exchanged among the sensors in Wireless Sensor Network. SARDS uses elliptical curve cryptography as the backbone of security formulations and performs authentication of all the communicating nodes present in the network. Findings: The system also allows a dual layer of security by introducing a novel signature based scheme towards public key encryption policy. The outcome of the study shows SARDS to excel best in performance in comparison of existing security and energy efficient routing schemes. Application/Improvements: Proposed SARDS technique offers 1) A novel public key encryption, 2) A novel digital signature scheme, and 3) A novel privacy or anonymous scheme. The outcome of the proposed system is also found to be superior as compared to existing protocols e.g. SecLEACH, LEACH and PEGASIS.

Efficient Anonymous Broadcast Encryption with Adaptive Security

Broadcast encryption is an efficient way to distribute confidential information to a set of receivers using broadcast channel. It allows the broadcaster to dynamically choose the receiver set during each encryption. However, most broadcast encryption schemes in the literature haven’t taken into consideration the receiver’s privacy protection, and the scanty privacy preserving solutions are often less efficient, which are not suitable for practical scenarios. In this paper, we propose an efficient dynamic anonymous broadcast encryption scheme that has the shortest ciphertext length. The scheme is constructed over the composite order bilinear groups, and adopts the Lagrange interpolation polynomial to hide the receivers’ identities, which yields efficient decryption algorithm. Security proofs show that, the proposed scheme is both secure and anonymous under the threat of adaptive adversaries in standard model.

Unconditionally Anonymous Controllable ID-Based Ring Signatures

ID-Based ring signatures are result of application of ID-Based cryptosystems to ring signature schemes. The contribution of this paper is twofold. At first the paper introduces a new variant of ID-based ring signatures named as controllable ID-Based ring signatures (CIBRS). This new primitive has additional properties like control linkability, anonymous authorship and convertibility. Formal definitions of these properties and the security model for the new primitive were presented. Secondly, the paper presents the first unconditionally anonymous CIBRS scheme from Chow et al.’s [4] scheme. The proposed scheme uses control linkability to achieve high efficiency of computation and storage. In the proposed scheme, to generate k signatures, a member of an n-member-ring needs only n+k scalar point multiplications and 2n+k-1 hash computations when compared to kn operations of Chow et al.’s scheme. Also, to verify k signatures the scheme requires only 2 pairing operations and n+k-1 hash computations compared to 2k and nk operations respectively. Link-signatures due to the proposed scheme are independent of size of the ring. Using the link-signatures our scheme achieves a significant signature size of 3(n+k)-1 compared to 2k(n+1) (in the units of size of the field element). The scheme provides unconditional anonymity and uncontrollability to the signer even in case of compromise of the key-escrow.

Effectiveness Analysis of ALNCode Scheme for Anonymous Communication with Network Coding

Network coding provides a new perspective for anonymous communication. Wang et al. propose an anonymous communication scheme named ALNCode, in which the linear relation of the global encoding vectors can be hidden without the participation of encryption/decryption operations. But the effectiveness of the scheme needs to be further analyzed. In this paper, we present an exact formula of the effectiveness of ALNCode scheme, which goes a step further than the lower bound given by Wang et al.. Based on the exact formula, the influential factors of effectiveness of the scheme are taken into account in details. Moreover, a comparison between the exact effectiveness and the lower bound shows that the lower bound is not true. The reason of the error is analyzed finally.

PUCA: A pseudonym scheme with strong privacy guarantees for vehicular ad-hoc networks

Pseudonym certificates are the state-of-the-art approach for secure and privacy-friendly message authentication in vehicular ad-hoc networks. However, most of the proposed pseudonym schemes focus on privacy among participants. Privacy towards backend providers is usually (if at all) only protected by separation of responsibilities. The protection can be overridden, when the entities collaborate, e.g. when revocation of long-term credentials is required. This approach puts the users’ privacy at risk, if the backend systems are not fully trusted.We propose PUCA – a scheme that provides full anonymity for honest users, even against colluding backend providers. The scheme uses anonymous credentials for authentication with the backend, while leaving the communication among vehicles and with road side units unchanged and in compliance with existing standards. For removal of misbehaving vehicles from the system, we leverage a privacy-friendly revocation mechanism, that does not require resolution of pseudonyms. With our scheme, we demonstrate that strong and verifiable privacy protection in vehicular networks can be achieved, while fulfilling common security requirements, such as sybil-resistance and revocation.