Identity Privacy Research Articles

Supervised and Revocable Decentralized Identity Privacy Protection Scheme

Decentralized identity represents an innovative approach based on blockchain to achieve effective identity management. This method utilizes decentralized identifiers and verifiable credential to enable trusted authentication, free circulation of identity information, and self-sovereign control over identity data functionalities. The current decentralized identity systems rely on entirely anonymous identifiers, lacking robust identity regulation. Furthermore, they face challenges such as identity attribute leakage during verifiable credential presentation and the issuers' struggle to reliably revoke credentials. To address these issues, efficient and practical schemes have been designed based on BBS signature, zero-knowledge proof, dynamic accumulator and blockchain technology: one for decentralized identifiers management and the other for verifiable credential privacy protection, both of which are supervised and revocable. The former ensures the privacy of subject identity while achieving regulatability and revocability of identity data by regulator. The latter facilitates selective disclosure of anonymous credentials and reliable revocation. A security analysis shows that the proposed scheme meets anonymity, non-forgeability, regulatory reliability, and revocability reliability, and offers comprehensive and effective privacy protection measures. The experimental results demonstrate that the algorithms designed operate at a millisecond level, which satisfies the demands of blockchain identity management scenarios.

Empowering decentralized identity systems for Web 3.0 in complex spherical fuzzy knowledge

The Web 3.0 network system, the next generation of the world wide web, incorporates new technologies and algorithms to enhance accessibility, decentralization, and security, mimicking human comprehension and enabling more personalized user interactions. The key component of this environment is decentralized identity management (DIM), embracing an identity and access management strategy that empowers computing devices and individuals to manage their digital personas. Aggregation operators (AOs) are valuable techniques that facilitate combining and summarizing a finite set of imprecise data. It is imperative to employ such operators to effectively address multicriteria decision-making (MCDM) issues. Yager operators have a significant extent of adaptability in managing operational environments and exhibit excellent effectiveness in addressing decision-making (DM) uncertainties. The complex spherical fuzzy (CSF) model is more effective in capturing and reflecting the known unpredictability in a DM application. This research endeavors to enhance the DM scenario of the Web 3.0 environment using Yager aggregation operators within the CSF environment. We present two innovative aggregation operators, namely complex spherical fuzzy Yager-ordered weighted averaging (CSFYOWA) and complex spherical fuzzy Yager-ordered weighted geometric (CSFYOWG) operators. We elucidate some structural characteristics of these operators and come up with an updated score function to rectify the drawbacks of the existing score function in the CSF framework. By utilizing newly proposed operators under CSF knowledge, we develop an algorithm for MCDM problems. In addition, we adeptly employ these strategies to handle the MCDM scenario, aiming to identify the optimal approach for ensuring the privacy of digital identity or data in the evolving landscape of the Web 3.0 era. Moreover, we undertake a comparative study to highlight the veracity and proficiency of the proposed techniques compared to the previously designed approaches.

EPAKA: An efficient and privacy-preserving authenticated key agreement scheme based on physical security for VANET

Vehicular ad hoc network (VANET) has been a promising technology in smart transportation system, which can enable information exchange between vehicles and roadside units (RSUs). However, the privacy of vehicles and RSUs is a critical challenge in VANET, as they may expose sensitive information to malicious attackers or unauthorized parties. Many existing authenticated key agreement (AKA) schemes aim to protect the privacy of vehicles and RSUs, but they often neglect the physical security of the devices involved in the communication. Therefore, we propose an efficient and privacy-preserving AKA scheme in VANET, which embeds physical unclonable function (PUF) and fuzzy extraction (FE) technology. PUF is a physical device that generates random strings based on their intrinsic characteristics and external inputs, which can protect the secrets in the devices from being stolen by attackers. FE can compensate for the drawbacks of PUF affected by environmental factors. Our scheme preserves the identity privacy of legitimate RSUs and vehicles, as well as intercepts and traces the identity of malicious attackers. In addition, we eliminate the involvement of the third party (TP) in the AKA phase to better meet the high-speed driving of vehicles. Finally, we conduct formal and informal security analyses in random oracle model (ROM), which prove that our scheme can resist various attacks. We also show in the performance analysis that our scheme has the lowest computational cost, communication overhead, and total energy consumption.

A secure authentication framework for IoV based on blockchain and ensemble learning

A secure authentication framework based on blockchain and ensemble learning is proposed to address the problem that vehicle identity privacy data in Internet of Vehicles (IoV) is vulnerable to theft and tampering. First, a secure and efficient authentication method based on blockchain and Physical Unclonable Function (PUF) is implemented, which ensures the identity privacy of the vehicle when accessing IoV, and improves the problem of high resource overhead of the traditional IoV authentication scheme while guaranteeing security, and the computational overhead is about 2.424 ms at the first level of security framework. Secondly, an intrusion detection method based on Whale Optimization Algorithm (WOA) and Extreme Gradient Boosting (XGBoost) is proposed, and the detection model trained based on this method can effectively detect various attacks against IoV. As a security method at the second level of secure framework, the method outperforms related works in detecting malicious attacks with a detection accuracy of 98.41% for ToN-IoT and 99.99% for BoT-IoT.

Best of two worlds: Efficient, usable and auditable biometric ABC on the blockchain

In García-Rodríguez et al. 2024, two generic constructions for biometric-based non-transferable Attribute Based Credentials (biometric ABC) are presented, which offer different trade-offs between efficiency and trust assumptions. In this paper, we focus on the second scheme denoted as BioABC-ZK that tries to remove the strong (and unrealistic) trust assumption on the Reader R, and we show that BioABC-ZK has a security flaw for a colluding R and Verifier V. Besides, BioABC-ZK lacks GDPR-compliance, which requires secure processing of biometrics, for instance in form of Fuzzy Extractors, as opposed to (i) storing the reference biometric template aBio in the user’s mobile phone and (ii) processing of biometrics using an external untrusted R, whose foreign manufacturers are unlikely to adjust their products according to GDPR.The contributions of this paper are threefold. First, we review efficient biometric ABC schemes to identify the privacy-by-design criteria for them. In view of these principles, we propose a new architecture for biometric ABC of Sarier 2021 by adapting the recently introduced core/helper setting. Briefly, a user in our modified setting is composed of a constrained core device (a SIM card) inside a helper device (a smart phone with dual SIM and face recognition feature), which – as opposed to García-Rodríguez et al. 2024 – does not need to store aBio. This way, the new design provides Identity Privacy without the need for an external R and/or a dedicated hardware per user such as a biometric smart card reader or a tamper proof smart card as in current hardware-bound credential systems. Besides, the new system maintains minimal hardware requirements on the SIM card – only responsible for storing ABC and helper data –, which results in easy adoption and usability without loosing efficiency, if deep face fuzzy vault and our modified ABC scheme are employed together. As a result, a total overhead of 500 ms to a showing of a comparable non-biometric ABC is obtained instead of the 2.1 s in García-Rodríguez et al. 2024 apart from the removal of computationally expensive pairings. Finally, as different from García-Rodríguez et al. 2024, auditing is achieved via Blockchain instead of proving in zero-knowledge the actual biometric matching by the user to reveal malicious behavior of R and V.

A Higher Performance Data Backup Scheme Based on Multi-Factor Authentication.

Remote data backup technology avoids the risk of data loss and tampering, and has higher security compared to local data backup solutions. However, the data transmission channel for remote data backup is not secure, and the backup server cannot be fully trusted, so users usually encrypt the data before uploading it to the remote server. As a result, how to protect this encryption key is crucial. We design a User-Centric Design (UCD) data backup scheme based on multi-factor authentication to protect this encryption key. Our scheme utilizes a secret sharing scheme to divide the encryption key into three parts, which are stored in the laptop, the smart card, and the server. The encryption key can be easily reconstructed from any two parts with user's private information password, identity and biometrics. As long as the biometrics has enough entropy, our scheme can resist replay attacks, impersonation user attacks, impersonation server attacks, malicious servers and offline password guessing attacks.

An efficient anonymous authentication scheme for blockchain assisted and fog-enabled smart grid

The growing integration of blockchain and fog computing with Smart Grid (SG) technologies highlights the need for strong security protocols, dependable communication channels, and sensitive user data protection. In order to meet the unique needs of SG, this research paper presents a novel and effective anonymous authentication scheme enhanced by fog computing and blockchain. The suggested scheme makes use of blockchain's decentralized structure to strengthen security protocols and ensure user privacy and anonymity within the SG ecosystem. Through the combination of fog computing's low latency benefits and blockchain's immutability, the suggested scheme creates a robust framework for secure authentication. The suggested approach gives considerable weight to reducing computational overhead and optimizing user identity privacy. Through comprehensive analysis, the study highlights the scheme's efficiency concerning authentication speed, resource utilization, and resilience against potential attacks. These results offer an important remedy for the ever-changing landscape of energy management systems and substantially advance the development of safe and privacy-preserving SG architectures.

A Self-Sovereign Identity Privacy-Preserving Scheme for Logistics Transportation Based on One-Time-Use Tokens

The advancement of the logistics industry has fostered the enhancement of operational efficacy within the socioeconomic domain. However, the current inevitable privacy leaks in the process of logistics transportation have seriously affected the development of the industry, which led to a crisis of consumer trust and even caused economic recession. This paper proposes a self-sovereign identity privacy protection scheme tailored specifically for logistics transportation contexts. First, the scheme entails furnishing users with one-time-use tokens while establishing decentralized identities capable of concealing identity information and ensuring the secure transmission of data. Furthermore, the scheme integrates fuzzy identity-based encryption to encrypt identity information, thereby guaranteeing the confidentiality and integrity of logistics user identities along with their associated data. Compared with other schemes, this scheme exhibits superior security in the realm of logistics transportation. Its targeted encryption technology and self-sovereignty strategies address the critical issue of privacy leakage, thereby safeguarding consumer privacy rights and interests while facilitating the sustainable development of the logistics industry.

Multiple time servers timed-release encryption based on Shamir secret sharing for EHR cloud system

Electronic health record (EHR) cloud system, as a primary tool driving the informatization of medical data, have positively impacted both doctors and patients by providing accurate and complete patient information. However, ensuring the security of EHR cloud system remains a critical issue. Some patients require regular remote medical services, and controlling access to medical data involving patient privacy during specific times is essential. Timed-release encryption (TRE) technology enables the sender to preset a future time T at which the data can be decrypted and accessed. It is a cryptographic primitive with time-dependent properties. Currently, mainstream TRE schemes are based on non-interactive single time server methods. However, if the single time server is attacked or corrupted, it is easy to directly threaten the security applications of TRE. Although some research schemes “distribute” the single time server into multiple ones, they still cannot resist the single point of failure problem. To address this issue, we propose a multiple time servers TRE scheme based on Shamir secret sharing and another variant derived from it. In our proposed schemes, the data receiver does not need to interact with the time servers; instead, they only need to obtain the time trapdoors that exceed or equal the preset threshold value for decryption, which ensures the identity privacy of the data sender and tolerates partial downtime or other failures of some time servers, significantly improving TRE reliability. Security analysis indicates that our proposed schemes demonstrate data confidentiality, verifiability, anti-advance decryption, and robust decryption with multiple time trapdoors, making them more practical. Efficiency analysis indicates that although our schemes have slightly higher computational costs than most efficient existing TRE schemes, such differences are insignificant from a practical application perspective.

Secure and efficient vehicle data downloading scheme with privacy-preserving in VANETs

Data downloading is a basic data transfer requirement in VANETs. Cooperation data downloading can use all V2C, V2I and V2V communications to improve the data downloading efficiency. Security and identity privacy preserving of data downloading should be paid more attention to protect the required vehicle. Otherwise, the data and identity information leakages would lead to immeasurable loss. To address these challenges, we propose a lattice-based secure vehicle data downloading scheme with privacy-preserving for VANETs. The vehicle request message authentication and identity privacy of the vehicle are achieved by a designed lattice-based ring signature. We prove that the proposed scheme is strong unforgeable and unconditional privacy preserving in the random oracle model. The request data also is encrypted by a symmetric encryption algorithm to achieve the data confidentiality. Moreover, thanks to the post-quantum security of the lattice-based cryptographic tools, the proposed data downloading also can defend against the quantum attacks. At the same time, cooperation data downloading also can be used in this paper to improve the effects of data downloading. Performance comparison and analysis shows that the proposed scheme shares some advantages with respect to the space and computation efficiency. The main character of the proposed scheme is that the impact of the vehicle ring group number on both the computation and space efficiency is effective controlled, such as the fixed signature length for any ring group size. As a result, the bandwidth and computation resources of VANETs can be saved by using the proposed scheme. We also simulate the proposed scheme by NS-3 which shows the average download success ratio is always within the interval [95%−100%] and cooperative downloading can improve the downloading efficiency by 86%.

DID-HVC-based Web3 healthcare data security and privacy protection scheme

In response to the current situation that Web2 Internet medical giants monopolize data elements and deprive medical users of their data rights and interests, self-sovereign identity(SSI) in the open environment of “Web3+Medicine” will make it possible for users to control and manage their e-medical data independently. However, SSI is a new identity management paradigm, and in the face of frequent interactions between identity credentials and application services, the existing research schemes have a coarse granularity of identity privacy protection, so there is an urgent need for attestation methods that selectively minimize the disclosure of identity attributes. In this study, we propose a SSI attribute selectively disclosable scheme based on a decentralized identifiers-hash verifiable credentials (DID-HVC) and design a model, that enables medical users not only to selectively minimize the disclosure of identity attribute data using verifiable credentials (VCs) with hash claims and combines with DID incorporating random obfuscation factors, to prevent overexposure of personal and healthcare privacy information, but also to safeguard users’ VCs are not linked and analysed. Finally, we provide a security and practicality analysis of our scheme and do simulation experiments based on Ethernet. The experimental results show that our scheme can more securely solve the problem of excessive privacy leakage of medical users within a feasible timeframe.

A Blockchain-Based Secure Sharing Scheme for Electrical Impedance Tomography Data

Real-time electrical impedance tomography (EIT) data sharing is becoming increasingly necessary, due to the extensive use of EIT technology in various sectors, including material analysis, biomedicine, and industrial process monitoring. The prevalence of portable EIT equipment and remote imaging technology has led to a predominance of centralized storage, Internet protocol transmission, and certificates from certificate authorities (CA) in telemedicine data. This has resulted in compromised data security, network communication delays, high CA maintenance costs, increased risks of medical data privacy breaches, and low security. Therefore, this paper offers a consortia blockchain-based method for exchanging EIT data that addresses security and integrity concerns during data storage and exchange, while maintaining transparency and traceability. Proprietary re-encryption techniques are employed to guarantee traceability when exchanging anonymous data, enabling precise control over data access. This scheme serves to protect both data and identity privacy, as well as to trace the actual identity of potential malicious users, while also thwarting any coordinated efforts between partially trusted parties and data requesters seeking unauthorized access to confidential information. Additionally, a combination of blockchain and InterPlanetary File System (IPFS) distributed storage technology is utilized to ease the burden of EIT data storage. The feasibility and effectiveness of the proposed solution were validated through a series of experiments, demonstrating its ability to effectively prevent data tampering and misuse, reduce data management costs, and enhance the efficiency and quality of data sharing.

VRIL: A Tuple Frequency-Based Identity Privacy Protection Framework for Metaverse

VRIL: A Tuple Frequency-Based Identity Privacy Protection Framework for Metaverse

FaceRSA: RSA-Aware Facial Identity Cryptography Framework

With the flourishing of the Internet, sharing one's photos or automated processing of faces using computer vision technology has become an everyday occurrence. While enjoying the convenience, the concern for identity privacy is also emerging. Therefore, some efforts introduced the concept of ``password'' from traditional cryptography such as RSA into the face anonymization and deanonymization task to protect the facial identity without compromising the usability of the face image. However, these methods either suffer from the poor visual quality of the synthesis results or do not possess the full cryptographic properties, resulting in compromised security. In this paper, we present the first facial identity cryptography framework with full properties analogous to RSA. Our framework leverages the powerful generative capabilities of StyleGAN to achieve megapixel-level facial identity anonymization and deanonymization. Thanks to the great semantic decoupling of StyleGAN's latent space, the identity encryption and decryption process are performed in latent space by a well-designed password mapper in the manner of editing latent code. Meanwhile, the password-related information is imperceptibly hidden in the edited latent code owing to the redundant nature of the latent space. To make our cryptographic framework possesses all the properties analogous to RSA, we propose three types of loss functions: single anonymization loss, sequential anonymization loss, and associated anonymization loss. Extensive experiments and ablation analyses demonstrate the superiority of our method in terms of the quality of synthesis results, identity-irrelevant attributes preservation, deanonymization accuracy, and completeness of properties analogous to RSA.

FGDB‐MLPP: A fine‐grained data‐sharing scheme with blockchain based on multi‐level privacy protection

AbstractIn the era of 5G, billions of terminal devices achieve global interconnection and intercommunication, which leads to the generation of massive data. However, the existing cloud‐based data‐sharing mechanism faces challenges such as sensitive information leakage and data islands, which makes it difficult to achieve secure sharing across domains. In this paper, the authors propose a fine‐grained data‐sharing scheme based on blockchain and ciphertext policy attribute‐based encryption, and design a verifiable outsourced computation method to reduce the computational pressure of end users. Second, the authors comprehensively consider the user's identity privacy and transaction privacy, and propose a multi‐level privacy protection method based on ring signature and garbled bloom filter, which enhance the user's data privacy and availability, and prevent the traceability of requests. Finally, the authors design a set of interconnected smart contracts, and verify that their scheme can achieve secure and efficient data sharing through security analysis and performance testing.

KONSTRUKSI IDENTITAS PADA INDIVIDU YANG MEMILIKI LEBIH DARI SATU INSTAGRAM

This research aims to understand how identity is constructed in individuals who have more than one Instagram account. The study employs a qualitative approach, and data collection is carried out by involving 10 informants through online semi-structured interviews. The collected data is analyzed using narrative analysis methods. Based on the analysis results, five themes are identified that demonstrate the identity construction of individuals on their Instagram accounts: 1) Feelings of insecurity; 2) Anticipatory anxiety; 3) Self-image as public identity; 4) Limitations of private identity; and 5) Existential anxiety in community space. Informants position themselves as individuals who feel insecure and strive to overcome anticipatory anxiety. These two themes are further related to the informants' public identity that portrays their self-image and their attempts to limit their private identity. The formation of public and private identities by informants also serves as an effort to address informants' existential anxiety within the community space.

Secure Data Sharing over Vehicular Networks Based on Multi-sharding Blockchain

Internet of Vehicles (IoV) has become an indispensable technology to bridge vehicles, persons, and infrastructures and is promising to make our cities smarter and more connected. It enables vehicles to exchange vehicular data (e.g., GPS, sensors, and brakes) with different entities nearby. However, sharing these vehicular data over the air raises concerns about identity privacy leakage. Besides, the centralized architecture adopted in existing IoV systems is fragile to single point-of-failure and malicious attacks. With the emergence of blockchain technology, there is the chance to solve these problems due to its features of being tamper-proof, traceability, and decentralization. In this article, we propose a privacy-preserving vehicular data sharing framework based on blockchain. In particular, we design an anonymous and auditable data sharing scheme using Zero-Knowledge Proof (ZKP) technology so as to protect the identity privacy of vehicles while preserving the vehicular data auditability for Trusted Authorities (TAs). In response to high mobility of vehicles, we design an efficient multi-sharding protocol to decrease blockchain communication costs without compromising the blockchain security. We implement a prototype of our framework and conduct extensive experiments and simulations on it. Evaluation and analysis results indicate that our framework can not only strengthen system security and data privacy but also reduce communication complexity by \(O(\frac{n\sqrt {m}}{m^2})\) times compared to existing sharding protocols.

CONTROL CLOUD DATA ACESS PRIVELAGE AND ANONYMITY WITH FULLY ANONYMOUS ATTRIBUTE BASED ENCRYPTION

Cloud computing is a revolutionary computing paradigm, which enables flexible, ondemand, and low-cost usage of computing resources, but the data is outsourced to some cloud servers, and various privacy concerns emerge from it. Various schemes based on the attribute-based encryption have been proposed to secure the cloud storage. However, most work focuses on the data contents privacy and the access control, while less attention is paid to the privilege control and the identity privacy. In this paper, we present a semi-anonymous privilege control scheme AnonyControl to address not only the data privacy, but also the user identity privacy in existing access control schemes. AnonyControl decentralizes the central authority to limit the identity leakage and thus achieves semianonymity. Besides, it also generalizes the file access control to the privilege control, by which privileges of all operations on the cloud data can be managed in a fine-grained manner. Subsequently, we present the AnonyControl-F, which fully prevents the identity leakage and achieve the full anonymity. Our security analysis shows that both AnonyControl and AnonyControl-F are secure under the decisional bilinear Diffie–Hellman assumption, and our performance evaluation exhibits the feasibility of our schemes.

A Comprehensive Privacy-Preserving Federated Learning Scheme With Secure Authentication and Aggregation for Internet of Medical Things.

Data mining, integration, and utilization are the inevitable trend of the Internet of Medical Things (IoMT) in the context of Big Data. With the increasing demand for data privacy, federated learning has emerged as a new paradigm, which enables distributed joint training of medical data sources without leaving the private domain. However, federated learning is suffering from security threats as the shared local model will reveal original datasets. Privacy leakage is even more fatal in healthcare because medical data contains critically sensitive information. In addition, open wireless channels are susceptible to malicious attacks. To further safeguard the privacy of IoMT, we propose a comprehensive privacy-preserving federated learning scheme with a tactful dropout handling mechanism. The proposed scheme leverages blind masking and certificateless proxy re-encryption (CL-PRE) for secure aggregation, ensuring the confidentiality of the local model and rendering the global model invisible to any parties other than clients. It also provides authentication of uploaded models while protecting identity privacy. Compared with other relevant schemes, our solution has better performance on functional features and efficiency, and is more applicable to IoMT systems with many devices.

Privacy-Preserving and Traceable Blockchain-Based Charging Payment Scheme for Electric Vehicles

With the rapid development of the global clean energy industry, the electric vehicle (EV) has gradually replaced the traditional fuel vehicle as a promising modern transportation tool due to its environmental friendliness and competitive prices. Its widespread adoption has led to a substantial increase in demand for subsidiary facilities such as charging piles and stations. Despite the convenience and accessibility offered by charging services, the privacy of EV users may be compromised in the process, as malicious attackers can infer their true identities and consumption habits from service orders. Existing studies introduce blockchain technology into vehicle charging payment scenarios to protect the privacy of EV users. Unfortunately, it cannot achieve the desired full anonymity and may even hinder electricity regulators’ investigation of suspicious transactions and entities. Therefore, designing a vehicle charging payment scheme that simultaneously supports privacy protection and traceability is a challenge. To address these concerns, this paper proposes a privacy-preserving and traceable blockchain-based charging payment (PTB-CP) scheme for EVs. It can protect users’ identity privacy and transaction unlinkability and track abnormal transactions or entities in exceptional circumstances. We conduct a comprehensive analysis of PTB-CP from both theoretical and experimental aspects. The analysis results demonstrate that our scheme can realize privacy protection, reliability & authentication, traceability, scalability, and high efficiency.