Privacy-preserving Payment Research Articles

Unlinkable Policy-Compliant Signatures for Compliant and Decentralized Anonymous Payments

Privacy-preserving payment systems face the difficult task of balancing privacy and accountability: on one hand, users should be able to transact privately and anonymously, on the other hand, no illegal activities should be tolerated. The challenging question of finding the right balance lies at the core of the research on accountable privacy that stipulates the use of cryptographic techniques for policy enforcement. Current state-of-the-art systems are only able to enforce rather limited policies, such as spending or transaction limits, or assertions about single participants, but are unable to enforce more complex policies that for example jointly evaluate both, the private credentials of sender and recipient, situations that occur in cross-border payments, let alone to do this without auditors in the loop during payment. This severely limits the cases where decentralized virtual assets can be used in accordance with regulatory compliance such as the Financial Action Task Force (FATF) travel rule, while retaining strong privacy features. We present unlinkable Policy-Compliant Signatures (ul-PCS), an enhanced cryptographic primitive extending the work of Badertscher et al.~(TCC 21). We give rigorous definitions, formally proven constructions, and benchmarks using our prototype developed using CharmCrypto which gives the first insights into feasibility of PCS. Unlinkable PCS has the following unique combination of features: 1) It is an enhanced signature scheme where the public key encodes in a privacy-preserving way the user's verifiable credentials (obtained from a credential authority). 2) Signatures can be created (and later publicly verified) by additionally specifying a recipient's public key aside of the to-be-signed message. A valid signature can only ever be created if the attributes $x_S$ of the signer and the attributes $x_R$ of the receiver fulfill some global policy $F(x_S,x_R)$. 3) The signature can be created by the signer just knowing the recipient's public key; there is no further interaction needed and no information is leaked (beyond the validity of the policy). 4) Once credentials are obtained, a user can generate fresh public keys without interacting with the credential authority. By merging the act of signing a transaction with the act of providing an assurance about the involved participants being compliant with complex policies, yet retain that participants are able to change public keys without the involvement of an authority, we formally show how ul-PCS is a step towards improving regulatory compliance of privacy coins such as Monero or Zcash.

A Post-Quantum Privacy-Preserving Payment Protocol in Vehicle to Grid Networks

A Post-Quantum Privacy-Preserving Payment Protocol in Vehicle to Grid Networks

Shaduf++: Non-Cycle and Privacy-Preserving Payment Channel Rebalancing

Shaduf++: Non-Cycle and Privacy-Preserving Payment Channel Rebalancing

An Efficient Multilayered Linkable Ring Signature Scheme With Logarithmic Size for Anonymous Payment in Vehicle-to-Grid Networks

Vehicle-to-Grid (V2G) networks are emerging as an outstanding technique for alleviating energy and environmental concerns. Whereas, malicious attackers thirst for private information from frequent electricity/service exchanges between electric vehicles (EVs) and smart grids (SG) in V2G networks. Several attempts have been made to use ring signatures to achieve privacy-preserving payment and ensure reliable services in V2G. Nevertheless, most of the existing ring signature-based payment proposals may still have numerous limitations in the V2G paradigm due to their heavy signature size. To address the aforementioned problem, we propose Emularis, an efficient multilayered linkable ring signature scheme with a logarithmic size. Specifically, we implement an anonymous payment scheme for V2G using Emularis. We then prove that Emularis guarantees security and privacy requirements through rigorous security analysis. Furthermore, our scheme significantly outperforms existing schemes in terms of communication and computation costs. Extensive experimental results indicate that our scheme is suitable for deployment in V2G security-related applications.

CryptoMaze: Privacy-Preserving Splitting of Off-Chain Payments

Payment protocols developed to realize off-chain transactions in Payment channel network (PCN) assumes the underlying routing algorithm transfers the payment via a single path. However, a path may not have sufficient capacity to route a transaction. It is inevitable to split the payment across multiple paths. If we run independent instances of the protocol on each path, the execution may fail in some of the paths, leading to partial transfer of funds. A payer has to reattempt the entire process for the residual amount. We propose a secure and privacy-preserving payment protocol, CryptoMaze. Instead of independent paths, the funds are transferred from sender to receiver across several payment channels responsible for routing, in a breadth-first fashion. Payments are resolved faster at reduced setup cost, compared to existing state-of-the-art. Correlation among the partial payments is captured, guaranteeing atomicity. Further, two party ECDSA signature is used for establishing scriptless locks among parties involved in the payment. It reduces space overhead by leveraging on core Bitcoin scripts. We provide a formal model in the Universal Composability framework and state the privacy goals achieved by CryptoMaze. We compare the performance of our protocol with the existing single path based payment protocol, Multi-hop HTLC, applied iteratively on one path at a time on several instances. It is observed that CryptoMaze requires less communication overhead and low execution time, demonstrating efficiency and scalability.

SorTEE: Service-Oriented Routing for Payment Channel Networks With Scalability and Privacy Protection

Payment channel networks (PCNs) are emerged as the most widely deployed solution to mitigate the scalability problem of permissionless cryptocurrencies, allowing vast payments to be carried out off-chain. Routing, which finds feasible paths between the senders and receivers, is critical for PCNs. However, existing solutions either fail to achieve high scalability that can maintain low storage/computation/network communication overhead, or they are susceptible to privacy disclosure. In this paper, we propose SorTEE, a service-oriented routing solution for PCNs, which adopts a set of service nodes to alleviate the per-user burden of routing and achieves more comprehensive privacy guarantees than the state-of-the-art by leveraging trusted execution environments (TEEs). SorTEE demands users communicate with the TEE by the secure channel to protect the privacy of transaction value. Then, an oblivious path mechanism is designed to construct redundant paths with the pseudo senders and receivers generated by TEEs to confuse its untrusted controller. Further, we report a novel attack that allows malicious service nodes to drop the valid paths for profit, and design a feedback mechanism to relieve it. Moreover, SorTEE hides the identities of the senders/receivers for the intermediate nodes of payment paths by introducing a novel identity information transfer scheme called encrypted identity chain. Based on security analysis and performance evaluation, our results demonstrate that SorTEE is able to achieve sufficient privacy-preserving payment and low per-user overhead.

Vehicloak: A Blockchain-Enabled Privacy-Preserving Payment Scheme for Location-Based Vehicular Services

The Internet of Vehicles (IoV) technology enables vehicles to communicate with each other, with pedestrians and with roadside infrastructures, to realize more efficient, safer and more environmentally friendly transportation. IoV also promises rich location-based services for vehicles, such as parking and toll highway. However, preserving privacy for location-based service payments emerges as a critical and challenging problem in IoV. Existing schemes rely on centralized banks for payment processing, resulting in location privacy leakage to centralized entities. In this paper, we propose a decentralized privacy-preserving payment scheme named Vehicloak for IoV based on the blockchain technology. The biggest challenge is to provide location privacy for vehicles while guaranteeing correct service payments using the transparent blockchain. To tackle this challenge, we introduce a new cryptographic technique called zk-GSigproof that integrates zero-knowledge proof with group signature. Vehicloak implements this technique in a smart contract to process payment, which verifies zero-knowledge proof and group signature without leaking location information. It is not limited to IoV and can be applied in many payment scenarios. To evaluate the performance of our scheme, we implement Vehicloak on a private blockchain of 100 nodes on Aliyun, and conduct a test with up to 4,000 transactions. The experimental results prove the feasibility of Vehicloak.

Formula omitted]-HTLC: Neo hashed time-Lock commitment to defend against wormhole attack in payment channel networks

In today’s cryptocurrency, the Payment Channel Network (PCN) is noticed as one of the most gifted off-chain solutions for scalability issues. Besides this, it consumes lesser transaction fees and low transaction confirmation time. However, security and privacy issues need to be addressed appropriately to make the solution even more effective. Most of the existing HTLC (Hashed Time-Lock Contract) protocols revealed the sender’s information to the intermediate users in the payment route. In this work, we propose an effective secure and privacy-preserving Payment Channel Network protocol, named Neo Hashed Time-Lock Commitment (n-HTLC) protocol. (n-HTLC) does not require the sender to send any information to each intermediate user along the payment route, thus preserves the identity of the sender. But, (n-HTLC) is not compatible with Sphinx onion packet format. Therefore, a symmetric key encryption-based protocol called kTLC has been proposed. kTLC is compatible with the Sphinx onion packet format, which is used in the current Lightning network atop of the Bitcoin blockchain network. The security of both n-HTLC and kTLC are proved using the Universal Composability (UC) framework. It is observed that both ensure that no attacker can extract information on the payment route if at least one of the users in the path is honest. To analyze the performance of both n-HTLC and kTLC payment protocol, we conduct experiments using the snapshots of Ripple network11According to the network snapshots (Dec 2015) Malavolta et al. (2017a) pre-processed by Mazumdar and Ruj (2020)., Lightning network22According to the network snapshots (May 2020) Lns pre-processed by Mazumdar and Ruj (2020)., and synthetic network of Mazumdar and Ruj (2020). Our experimental results show that both n-HTLC and kTLC outperform state-of-the-art off-chain payment protocols in terms of computational and communication overhead.

A New Privacy-Preserving Payment Protocol for Blockchain Transactions

Ring confidential transaction (RingCT) protocol is widely used in cryptocurrency to protect the privacy of both users’ identities and transaction amounts. Most recently, a new RingCT protocol (called RingCT 2.0) was proposed by leveraging cryptographic accumulators, which can achieve a constant-size output theoretically but still far from being practical due to the heavy zero-knowledge associated with the accumulator. In this article, we revisit the design of ring confidential transaction protocol and put forward a more efficient privacy-preserving payment protocol, which is built upon an extended version of one-out-of-many proof and a special multi-signature. Compared with previous works, the new protocol is not only more practical, but also does not suffer from a trusted setup. Besides, we show that the protocol satisfies the security requirements provided that the underlying cryptographic primitives are secure in the random oracle model. We implement our new payment protocol in Java, and the experimental results show that it is efficient enough to be used in practice.

Privacy-Preserving Payment Splitting

AbstractWidely used payment splitting apps allow members of a group to keep track of debts between members by sending charges for expenses paid by one member on behalf of others. While offering a great deal of convenience, these apps gain access to sensitive data on users’ financial transactions. In this paper, we present a payment splitting app that hides all transaction data within a group from the service provider, provides privacy protections between users in a group, and provides integrity against malicious users or even a malicious server.The core protocol proceeds in a series of rounds in which users either submit real data or cover traffic, and the server blindly updates balances, informs users of charges, and computes integrity checks on user-submitted data. Our protocol requires no cryptographic operations on the server, and after a group’s initial setup, the only cryptographic tool users need is AES.We implement the payment splitting protocol as an Android app and the accompanying server. We find that, for realistic group sizes, it requires fewer than 50 milliseconds per round of computation on a user’s phone and the server requires fewer than 300microseconds per round for each group, meaning that our protocol enjoys excellent performance and scalability properties.

Smart Parking System With Privacy Preservation and Reputation Management Using Blockchain

Most of the existing smart parking systems threaten the drivers' privacy by revealing information about their visited locations. Moreover, they are centralized making them vulnerable to a single point of failure and attack, which threatens the availability of the parking service. They also suffer from a lack of transparency, where the centralized service organizer may favor some parking lots by booking their parking slots first. To tackle these concerns, we propose a blockchain-based smart parking system with privacy preservation and reputation management. In our system, a consortium blockchain is created by different parking lots to run the parking system securely and transparently, where the parking offers are recorded on a shared and immutable ledger. We use a commitment technique during the submission of the offers to ensure fair parking rates. Then, we use a private information retrieval technique during the offers retrieval to preserve the drivers' location privacy. Furthermore, to anonymously and efficiently authenticate drivers during the reservation process, we use a short randomizable signature. We also use a time-locked anonymous payment technique to discourage drivers from not committing to their parking reservations and provide a secure and privacy-preserving payment method for parking service. Finally, we integrate a blockchain-based anonymous reputation management scheme into our system, where drivers can anonymously rate the parking service to ensure high quality of service. Our evaluations demonstrate that our smart parking system is secure and capable of preserving drivers' privacy with low communication, computation, and storage overheads.

A Blockchain-Based Privacy-Preserving Payment Mechanism for Vehicle-to-Grid Networks

As an integral part of V2G networks, EVs receive electricity from not only the grid but also other EVs and may frequently feed the power back to the grid. Payment records in V2G networks are useful for extracting user behaviors and facilitating decision-making for optimized power supply, scheduling, pricing, and consumption. Sharing payment and user information, however, raises serious privacy concerns in addition to the existing challenge of secure and reliable transaction processing. In this article, we propose a blockchain-based privacy preserving payment mechanism for V2G networks, which enables data sharing while securing sensitive user information. The mechanism introduces a registration and data maintenance process that is based on a blockchain technique, which ensures the anonymity of user payment data while enabling payment auditing by privileged users. Our design is implemented based on Hyperledger to carefully evaluate its feasibility and effectiveness.

Network Security and Privacy Challenges in Smart Vehicle-to-Grid

Smart vehicle-to-grid (V2G) involves intelligent charge and discharge decisions based on user operational energy requirements, such as desired levels of charging and waiting time. V2G is also supported by information management capabilities enabled by a secure network, such as a reliable privacy-preserving payment system. In this article, we describe the network security and privacy requirements and challenges of V2G applications. We present a new network security architecture to support V2G. We propose a scheme with the following security and privacy-preserving features: anonymous authentication, fine-grained access control, anonymous signatures, information confidentiality, message integrity, remote attestation, and a payment system. This article is oriented toward practitioners interested in designing and implementing secure and privacy-preserving networks for smart V2G applications.

Listening to Whispers of Ripple: Linking Wallets and Deanonymizing Transactions in the Ripple Network

Abstract The decentralized I owe you (IOU) transaction network Ripple is gaining prominence as a fast, low-cost and efficient method for performing same and cross-currency payments. Ripple keeps track of IOU credit its users have granted to their business partners or friends, and settles transactions between two connected Ripple wallets by appropriately changing credit values on the connecting paths. Similar to cryptocurrencies such as Bitcoin, while the ownership of the wallets is implicitly pseudonymous in Ripple, IOU credit links and transaction flows between wallets are publicly available in an online ledger. In this paper, we present the first thorough study that analyzes this globally visible log and characterizes the privacy issues with the current Ripple network. In particular, we define two novel heuristics and perform heuristic clustering to group wallets based on observations on the Ripple network graph. We then propose reidentification mechanisms to deanonymize the operators of those clusters and show how to reconstruct the financial activities of deanonymized Ripple wallets. Our analysis motivates the need for better privacy-preserving payment mechanisms for Ripple and characterizes the privacy challenges faced by the emerging credit networks.

Secure distributed programming with value-dependent types

AbstractDistributed applications are difficult to program reliably and securely. Dependently typed functional languages promise to prevent broad classes of errors and vulnerabilities, and to enable program verification to proceed side-by-side with development. However, as recursion, effects, and rich libraries are added, using types to reason about programs, specifications, and proofs becomes challenging. We present F*, a full-fledged design and implementation of a new dependently typed language for secure distributed programming. Our language provides arbitrary recursion while maintaining a logically consistent core; it enables modular reasoning about state and other effects using affine types; and it supports proofs of refinement properties using a mixture of cryptographic evidence and logical proof terms. The key mechanism is a new kind system that tracks several sub-languages within F* and controls their interaction. F* subsumes two previous languages, F7 and Fine. We prove type soundness (with proofs mechanized in Coq) and logical consistency for F*. We have implemented a compiler that translates F* to .NET bytecode, based on a prototype for Fine. F* provides access to libraries for concurrency, networking, cryptography, and interoperability with C#, F#, and the other .NET languages. The compiler produces verifiable binaries with 60% code size overhead for proofs and types, as much as a 45x improvement over the Fine compiler, while still enabling efficient bytecode verification. We have programmed and verified nearly 50,000 lines of F* including new schemes for multi-party sessions; a zero-knowledge privacy-preserving payment protocol; a provenance-aware curated database; a suite of web-browser extensions verified for authorization properties; a cloud-hosted multi-tier web application with a verified reference monitor; the core F* typechecker itself; and programs translated to F* from other languages such as F7 and JavaScript.

PSP: Private and secure payment with RFID

RFID can be used for a variety of applications, e.g., to conveniently pay for public transportation. However, achieving security and privacy of payment is challenging due to the extreme resource restrictions of RFID tags. In this paper, we propose PSP – a secure, RFID-based protocol for privacy-preserving payment that supports multiple different payees. Similar to traditional electronic cash, the user of a tag can pay for a service using his tag and so called coins of a virtual currency. With PSP, tags do not need to store valid coins, but generate them on the fly. Using Bloom filters, readers can verify the validity of generated coins offline. PSP guarantees privacy such that neither payees nor an adversary can reveal the identity of a user or link subsequent payments. PSP is secure against invention and overspending of coins, and can reveal the identity of users trying to double spend coins. Still, PSP is lightweight: it requires only a hash function and few bytes of non-volatile memory on the tag.

Secure distributed programming with value-dependent types

Distributed applications are difficult to program reliably and securely. Dependently typed functional languages promise to prevent broad classes of errors and vulnerabilities, and to enable program verification to proceed side-by-side with development. However, as recursion, effects, and rich libraries are added, using types to reason about programs, specifications, and proofs becomes challenging. We present F*, a full-fledged design and implementation of a new dependently typed language for secure distributed programming. Unlike prior languages, F* provides arbitrary recursion while maintaining a logically consistent core; it enables modular reasoning about state and other effects using affine types; and it supports proofs of refinement properties using a mixture of cryptographic evidence and logical proof terms. The key mechanism is a new kind system that tracks several sub-languages within F* and controls their interaction. F* subsumes two previous languages, F7 and Fine. We prove type soundness (with proofs mechanized in Coq) and logical consistency for F*. We have implemented a compiler that translates F* to .NET bytecode, based on a prototype for Fine. F* provides access to libraries for concurrency, networking, cryptography, and interoperability with C#, F#, and the other .NET languages. The compiler produces verifiable binaries with 60% code size overhead for proofs and types, as much as a 45x improvement over the Fine compiler, while still enabling efficient bytecode verification. To date, we have programmed and verified more than 20,000 lines of F* including (1) new schemes for multi-party sessions; (2) a zero-knowledge privacy-preserving payment protocol; (3) a provenance-aware curated database; (4) a suite of 17 web-browser extensions verified for authorization properties; and (5) a cloud-hosted multi-tier web application with a verified reference monitor.