Strong Privacy Protection Research Articles

Designing a Nurse-Led eHealth Cardiac Rehabilitation Program: Insights From Participant Experiences and Qualitative Feedback.

This study examines the perspectives of individuals with coronary heart disease (CHD) on a nurse-led eHealth cardiac rehabilitation (NeCR) program, which included a website, tele-monitoring device, and social media chatroom. Using a descriptive qualitative approach, semi-structured interviews were conducted with 18 participants to capture their feedback and experiences with the NeCR program. Participants found the NeCR program valuable in addressing gaps in cardiac rehabilitation services in China, empowering them to make behavioral changes and enhancing their social motivation. However, they also highlighted the need for a more user-friendly website, better symptom management during exercise, and stronger privacy protections in the peer networking chatroom. The study concludes that the NeCR program is feasible in providing accessible rehabilitative services at home post-discharge. Recommendations include improving the self-monitoring platform for ease of use, incorporating immediate symptom management guidance during exercise, and ensuring a secure environment for online peer support. These findings offer crucial insights for developing patient-centered eHealth cardiac rehabilitation services, emphasizing the importance of user-friendly design, effective symptom management features, and privacy protection in promoting participant engagement with e-platforms. ChiCTR1800020411 (http://www.chictr.org.cn/showprojen.aspx?proj=33906).

A single parameter method for secure privacy preserving record linkage

ObjectivesData linkage is the process of matching records that refer to the same entities (often people) across databases. In applications such as health research or government services, the databases to be linked are often sensitive and cannot be shared between organisations. Privacy-preserving record linkage (PPRL) aims to overcome this challenge by facilitating the comparison of encoded or encrypted records without having to share sensitive data. Most existing PPRL techniques are based on heuristics and they have limitations in the privacy protection they offer, such as being vulnerable to certain cryptanalysis attacks. Furthermore, existing PPRL methods have multiple parameters, which, if not set properly by the user, can result in sub-optimal linkage quality and reduced privacy protection. ApproachWe present a novel PPRL method that uses random reference q-gram sets to generate bit-arrays that represent sensitive values. Our method has a single parameter to be set by the user that trades scalability with linkage quality and privacy protection. All other parameters are either data-driven or have strong bounds based on this user parameter. ResultsWe conceptually analyse our method and conduct experiments on multiple databases. The results demonstrate that our method provides high linkage quality and strong privacy protection while being scalable to link very large databases. ConclusionOur novel PPRL method provides high linkage quality, scalability, and improved privacy protection compared to existing PPRL methods such as Bloom filter encoding. A major advantage of our method is that it requires a single parameter to be set by the user.

ENHANCING SECURITY IN NIGERIA: THE IMPLICATIONS OF SOCIAL MEDIA-BASED CRIME REPORTING

With the widespread use of social media platforms, individuals have increasingly turned to these platforms to report crimes, creating an evolving landscape for law enforcement and security agencies. Social media-based crime reporting has emerged as a transformative approach to public safety, offering real-time updates, accessibility, and community engagement. This study examines how social media platforms like Facebook and Twitter promote community mobilization and real-time information sharing by applying Information Diffusion Theory (IDT) and Social Network Theory (SNT). Notable examples, such as the Aluu Four lynching, End-SARS movement, Chibok kidnapping and the 2023 presidential elections amongst other events, demonstrate how social media plays a crucial role in increasing public knowledge, coordinating group efforts, and impacting legislative reforms. However, this innovative method of reporting also brings forth several security implications that demand careful consideration. By examining the advantages and challenges of social media for crime reporting, this study aims to provide insights into how such practices can enhance security measures while mitigating potential risks. This study, therefore, explores these security concerns and strategies for enhancing the security implications of social media-based crime reporting. It discusses the potential risks of misinformation, privacy issues, tipping off perpetrators, and the inadvertent exposure of victims and witnesses. The results emphasize the importance of adopting a well-rounded strategy to utilize the capabilities of social media for reporting crimes, while also acknowledging the difficulties it presents. The study highlights the need for collaboration between law enforcement agencies, policymakers, social media platforms, and the public to develop a robust legal framework, promote responsible reporting practices, and protect evidence integrity. The study therefore recommends the use of sophisticated verification technology, the establishment of responsible reporting criteria, collaboration with social media platforms, and the implementation of strong privacy protection measures.

Edge Private Graph Neural Networks with Singular Value Perturbation

Graph neural networks (GNNs) play a key role in learning representations from graph-structured data and are demonstrated to be useful in many applications. However, the GNN training pipeline has been shown to be vulnerable to node feature leakage and edge extraction attacks. This paper investigates a scenario where an attacker aims to recover private edge information from a trained GNN model. Previous studies have employed differential privacy (DP) to add noise directly to the adjacency matrix or a compact graph representation. The added perturbations cause the graph structure to be substantially morphed, reducing the model utility. We propose a new privacy-preserving GNN training algorithm, Eclipse, that maintains good model utility while providing strong privacy protection on edges. Eclipse is based on two key observations. First, adjacency matrices in graph structures exhibit low-rank behavior. Thus, Eclipse trains GNNs with a low-rank format of the graph via singular values decomposition (SVD), rather than the original graph. Using the low-rank format, Eclipse preserves the primary graph topology and removes the remaining residual edges. Eclipse adds noise to the low-rank singular values instead of the entire graph, thereby preserving the graph privacy while still maintaining enough of the graph structure to maintain model utility. We theoretically show Eclipse provide formal DP guarantee on edges. Experiments on benchmark graph datasets show that Eclipse achieves significantly better privacy-utility tradeoff compared to existing privacy-preserving GNN training methods. In particular, under strong privacy constraints (𝜖 < 4), Eclipse shows significant gains in the model utility by up to 46%. We further demonstrate that Eclipse also has better resilience against common edge attacks (e.g., LPA), lowering the attack AUC by up to 5% compared to other state-of-the-art baselines.

REGULATION OF FINTECH INNOVATIONS THROUGH POLICY FRAMEWORKS: ENSURING CONSUMER PROTECTION WHILST PROMOTING INNOVATION

The emergence of FinTech technologies has prompted the creation of extensive regulatory frameworks that safeguard consumer interests while promoting an atmosphere that is supportive of technical progress. This study explores the complex regulatory environments that shape FinTech advances, primarily emphasizing the need to find a careful balance between protecting consumer interests and promoting innovation. This paper investigates crucial steps intended to strengthen consumer protection by undertaking a thorough review of worldwide regulatory procedures, including variances among countries and the crucial roles of governmental agencies. These controls cover a wide range of tactics, from the application of know-your-customer (KYC) and anti-money laundering (AML) procedures to strict transparency requirements and strong privacy protections. The report also looks at the procedures in place in the FinTech industry for handling customer complaints and guaranteeing accountability. In addition, the study explores different approaches to innovation in the regulatory environment, including the creation of regulatory sandboxes and the encouragement of joint ventures between industry players and regulatory bodies. This paper illustrates both effective regulatory interventions and difficulties found in regulating FinTech developments through the analysis of relevant case studies. These observations are combined to provide a set of practical suggestions that legislators can use to successfully navigate the changing regulatory environment around fintech. The report also provides predictions for future developments in FinTech legislation, giving decision-makers the insight they need to adjust to the ever-changing FinTech landscape.

STP-KDE: A spatiotemporal trajectory protection and publishing method based on kernel density estimation

Promoted by the Internet of Thing era, the widespread use of mobile sensing devices equipped with positioning functions has led to the generation of substantial trajectory data. Mining and analyzing trajectory data has high research value, but poses a risk of user privacy leakage, resulting in fewer publicly available trajectory datasets for research and analysis. Therefore, a trajectory data publishing method that ensures high data utility while protecting user privacy has become a hot topic. In this paper, we propose a spatiotemporal trajectory data protection and publishing method based on kernel density estimation (STP-KDE), which protects the trajectory data and trajectory count values while improving data utility. In the protection process of trajectory data, we designed a kernel density clustering framework that is combined with the differential privacy exponential mechanism. In the protection process of trajectory counts value, the adaptive Laplace noise perturbation mechanism is proposed to differentially protect these counts. Experimental results show that STP-KDE can provide more useful data and stronger privacy protection than existing studies.

Context Privacy Preservation for User Validation by Wireless Sensors in the Industrial Metaverse Access System

The Industrial Metaverse provides unparalleled prospects for increasing productivity and efficiency across multiple sectors. As wireless sensor networks play an important role in data collection and transmission within this ecosystem, preserving context privacy becomes critical to protecting sensitive information. This paper investigates the issue of context privacy preservation for user validation via AccesSensor in the Industrial Metaverse and presents a technological method to address it. We explore the need for context privacy, look at existing privacy preservation solutions, and propose novel user validation methods that are customized to the Industrial Metaverse’s access system. This method is evaluated on time-based efficiency, privacy method and bandwidth utilization. Our method performs better as compared to the DPSensor. Our research seeks to provide insights and recommendations for developing strong privacy protection methods in wireless sensor networks that operate within the Industrial Metaverse ecosystem.

Secure Cloud-Based Electronic Health Records: Cross-Patient Block-Level Deduplication with Blockchain Auditing.

In today's data-driven world, the exponential growth of digital information poses significant challenges in data management. In recent years, the adoption of cloud-based Electronic Health Records (EHR) sharing schemes has yielded numerous advantages like improved accessibility, availability, and enhanced interoperability. However, the centralized nature of cloud storage presents challenges in terms of information storage, privacy protection, and security. Despite several approaches that have been presented to ensure secure deduplication of similar EHRs, the validation of data integrity without a third-party auditor (TPA) remains a persistent task. Because involving a TPA raises concerns about the confidentiality and privacy of crucial healthcare information. To tackle this challenge, a novel cloud storage auditing technique is proposed that incorporates cross-patient block-level deduplication while upholding strong privacy protection, ensuring that EHR is not compromised. Here, we introduced blockchain technology to achieve integrity verification, thus eliminating the need for a TPA by providing a decentralized and transparent mechanism. Additionally, an index for all EHRs has been generated to facilitate block-level duplicate checks and employ a novel strategy to prevent adversaries from acquiring original information saved in the cloud storage. The security of the proposed approach is established against factorization attacks and decrypt exponent attacks. The performance evaluation demonstrates the superior efficiency of the proposed scheme in terms of file authenticator generation, challenge creation, and proof verification to other existing client-side deduplication approaches.

Private Continuous Survival Analysis with Distributed Multi-Site Data.

Effective disease surveillance systems require large-scale epidemiological data to improve health outcomes and quality of care for the general population. As data may be limited within a single site, multi-site data (e.g., from a number of local/regional health systems) need to be considered. Leveraging distributed data across multiple sites for epidemiological analysis poses significant challenges. Due to the sensitive nature of epidemiological data, it is imperative to design distributed solutions that provide strong privacy protections. Current privacy solutions often assume a central site, which is responsible for aggregating the distributed data and applying privacy protection before sharing the results (e.g., aggregation via secure primitives and differential privacy for sharing aggregate results). However, identifying such a central site may be difficult in practice and relying on a central site may introduce potential vulnerabilities (e.g., single point of failure). Furthermore, to support clinical interventions and inform policy decisions in a timely manner, epidemiological analysis need to reflect dynamic changes in the data. Yet, existing distributed privacy-protecting approaches were largely designed for static data (e.g., one-time data sharing) and cannot fulfill dynamic data requirements. In this work, we propose a privacy-protecting approach that supports the sharing of dynamic epidemiological analysis and provides strong privacy protection in a decentralized manner. We apply our solution in continuous survival analysis using the Kaplan-Meier estimation model while providing differential privacy protection. Our evaluations on a real dataset containing COVID-19 cases show that our method provides highly usable results.

Geo-indistinguishable masking: enhancing privacy protection in spatial point mapping

ABSTRACT Spatial point mapping is a useful practice in exploratory point pattern analysis, but it poses significant privacy risks as the identity of individuals may be revealed from the maps. Geomasking methods have been developed to mitigate the risks by displacing spatial points before mapping. However, many of these methods rely on a weak privacy notion called spatial k-anonymity, which is insufficient to withstand the growing amount of spatial data (e.g. land use) that adversaries can use as side information to infer the actual locations of individuals. We proposes a method called geo-indistinguishable masking to address this issue by relying on a strong privacy notion called geo-indistinguishability. This notion ensures consistent levels of privacy protection regardless of any side information. The method consists of two steps. The first step involves creating a masking area for each spatial point to include a set of candidate locations to which the point can be relocated. In the second step, we formulate an optimization model to ensure the masked locations satisfy geo-indistinguishability while minimizing the distance displaced. Computational experiments on a synthetic dataset demonstrate that our proposed method is both efficient and effective in providing strong privacy protection while preserving the spatial point patterns.

PILE: Robust Privacy-Preserving Federated Learning Via Verifiable Perturbations

Federated learning (FL) protects training data in clients by collaboratively training local machine learning models of clients for a global model, instead of directly feeding the training data to the server. However, existing studies show that FL is vulnerable to various attacks, resulting in training data leakage or interfering with the model training. Specifically, an adversary can analyze local gradients and the global model to infer clients' data, and poison local gradients to generate an inaccurate global model. It is extremely challenging to guarantee strong privacy protection of training data while ensuring the robustness of model training. None of the existing studies can achieve the goal. In this paper, we propose a robust privacy-preserving federated learning framework (PILE), which protects the privacy of local gradients and global models, while ensuring their correctness by gradient verification where the server verifies the computation process of local gradients. In PILE, we develop a verifiable perturbation scheme that makes confidential local gradients verifiable for gradient verification. In particular, we build two building blocks of zero-knowledge proofs for the gradient verification without revealing both local gradients and global models. We perform rigorous theoretical analysis that proves the security of PILE and evaluate PILE on both passive and active membership inference attacks. The experiment results show that the attack accuracy under PILE is between <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$[50.3\%,50.9\%]$</tex-math></inline-formula> , which is close to the random guesses. Particularly, compared to prior defenses that incur the accuracy losses ranging from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$2\%$</tex-math></inline-formula> to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$13\%$</tex-math></inline-formula> , the accuracy loss of PILE is negligible, i.e., only <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\pm 0.3\%$</tex-math></inline-formula> accuracy loss.

A Multi-Shuffler Framework to Establish Mutual Confidence for Secure Federated Learning

Albeit the popularity of federated learning (FL), recently emerging model-inversion and poisoning attacks arouse extensive concerns towards privacy or model integrity, which catalyzes the developments of secure federated learning (SFL) methods. Nonetheless, the collisions between its privacy and integrity, two equally crucial elements in collaborative learning scenarios, are relatively underexplored. Individuals' wish to “hide in the crowd” for privacy frequently clashes with aggregator' need to resist abnormal participants for integrity (i.e., the incompatibility between Byzantine robustness and differential privacy). The dilemma prompts researchers to reflect on how to build mutual confidence between individuals and aggregators. Against the backdrop, this paper proposes a multi-shuffler secure federated learning (MSFL) framework, based on which we further propound three modules (hierarchical shuffling mechanism, malice evaluation module, and composite defense strategy) to jointly guarantee strong privacy protection, efficient poisoning resistance, and agile adversary elimination. Extensive experiments on standard datasets exhibited the method's effectiveness in thwarting different FL poisoning attack paradigms with a minimal cost of privacy breaches.

Towards Strong Privacy Protection for Association Rule Mining and Query in the Cloud

Efficiently mining frequent itemsets and association rules on the encrypted outsourced data remains a great challenge for the time-consuming ciphertext computations. Nowadays, it has been not well addressed for privacy-preserving frequent itemsets and association rule mining schemes with mining efficiency, dataset, and query confidentiality simultaneously. In this paper, we investigate the study of privacy issues on frequent itemset mining and association rule mining on outsourced data in a two-cloud model, where the data are encrypted and outsourced by multiple owners holding different public keys. We develop several secure computation protocols based on additively homomorphic cryptosystem and additive secret sharing, which enable the clouds could securely mine the frequent itemsets and association rules. Furthermore, we also design two kinds of frequent itemset and association rule query service models, i.e., service customers query the cloud-mined results, and service customers query with their own decided threshold. The proposed scheme not only supports the mining process on the data encrypted by multiple public keys without compromising the security of the datasets, query data and query results, but also offline users. In addition, the experimental results show that our query scheme is much more efficient than the state-of-the-art work.

PrivLava: Synthesizing Relational Data with Foreign Keys under Differential Privacy

Answering database queries while preserving privacy is an important problem that has attracted considerable research attention in recent years. A canonical approach to this problem is to use synthetic data. That is, we replace the input database R with a synthetic database R* that preserves the characteristics of R, and use R* to answer queries. Existing solutions for relational data synthesis, however, either fail to provide strong privacy protection, or assume that R contains a single relation. In addition, it is challenging to extend the existing single-relation solutions to the case of multiple relations, because they are unable to model the complex correlations induced by the foreign keys. Therefore, multi-relational data synthesis with strong privacy guarantees is an open problem. In this paper, we address the above open problem by proposing PrivLava, the first solution for synthesizing relational data with foreign keys under differential privacy, a rigorous privacy framework widely adopted in both academia and industry. The key idea of PrivLava is to model the data distribution in R using graphical models, with latent variables included to capture the inter-relational correlations caused by foreign keys. We show that PrivLava supports arbitrary foreign key references that form a directed acyclic graph, and is able to tackle the common case when R contains a mixture of public and private relations. Extensive experiments on census data sets and the TPC-H benchmark demonstrate that PrivLava significantly outperforms its competitors in terms of the accuracy of aggregate queries processed on the synthetic data.

S-Glint: Secure Federated Graph Learning With Traffic Throttling and Flow Scheduling

Federated learning has been proposed as a promising distributed machine learning paradigm with strong privacy protection on training data. In this paper, we study federated graph learning (FGL) under a cross-silo setting where several servers are connected by a wide-area network and cooperate in training a graph convolutional network (GCN) model. We find that communication becomes the main system bottleneck because of frequent information exchanges among federated severs and limited network bandwidth. To tackle this challenge, we design S-Glint, a secure federated graph learning system, containing a homomorphic encryption-based protocol with pre-aggregation and batching strategies. The network traffic throttling and flows scheduling are also proposed to accelerate the learning process. To evaluate the effectiveness of S-Glint, we conduct experiments using trace-driven simulations. The results show that S-Glint can significantly outperform existing federated learning solutions.

Blockchain-Based Trusted Federated Learning with Pre-Trained Models for COVID-19 Detection

COVID-19 is a serious epidemic that not only endangers human health, but also wreaks havoc on the development of society. Recently, there has been research on using artificial intelligence (AI) techniques for COVID-19 detection. As AI has entered the era of big models, deep learning methods based on pre-trained models (PTMs) have become a focus of industrial applications. Federated learning (FL) enables the union of geographically isolated data, which can address the demands of big data for PTMs. However, the incompleteness of the healthcare system and the untrusted distribution of medical data make FL participants unreliable, and medical data also has strong privacy protection requirements. Our research aims to improve training efficiency and global model accuracy using PTMs for training in FL, reducing computation and communication. Meanwhile, we provide a secure aggregation rule using differential privacy and fully homomorphic encryption to achieve a privacy-preserving Byzantine robust federal learning scheme. In addition, we use blockchain to record the training process and we integrate a Byzantine fault tolerance consensus to further improve robustness. Finally, we conduct experiments on a publicly available dataset, and the experimental results show that our scheme is effective with privacy-preserving and robustness. The final trained models achieve better performance on the positive prediction and severe prediction tasks, with an accuracy of 85.00% and 85.06%, respectively. Thus, this indicates that our study is able to provide reliable results for COVID-19 detection.

The Digital Personal Data Protection Bill 2022 in Contrast with the EU General Data Protection Regulation: A Comparative Analysis

The European Union’s General Data Protection Regulation (GDPR) is considered to be the most comprehensive &amp; strong privacy and data protection law in the world, which doesn’t only regulate within the territory of EU but also has an extraterritorial effect. GDPR has influenced privacy &amp; data protection legislation of many nations. India is ready with the draft Digital Personal Data Protection Bill, 2022 (DPDP Bill) which is the latest in a series of draft legislations presented and removed since mid-2018. In this article we discuss the key differences between the GDPR &amp; DPDP Bill by analysing the different approaches and methods prescribed in both the legislations to understand their scope &amp; applicability, concerned parties, classification of personal data, legal basis for data processing, children’s rights, reporting breach, cross-border data transfer, penalties, etc. In conclusion, we can say that the GDPR is relatively more detailed in its instructions, whereas the DPDP Bill establishes certain fundamental concepts. The DPDP Bill offers a glimpse of hope for balancing the interests of data subjects while acknowledging the practical challenges that businesses may encounter.

Exploring the Relationship Between Privacy and Utility in Mobile Health: Algorithm Development and Validation via Simulations of Federated Learning, Differential Privacy, and External Attacks.

Although evidence supporting the feasibility of large-scale mobile health (mHealth) systems continues to grow, privacy protection remains an important implementation challenge. The potential scale of publicly available mHealth applications and the sensitive nature of the data involved will inevitably attract unwanted attention from adversarial actors seeking to compromise user privacy. Although privacy-preserving technologies such as federated learning (FL) and differential privacy (DP) offer strong theoretical guarantees, it is not clear how such technologies actually perform under real-world conditions. Using data from the University of Michigan Intern Health Study (IHS), we assessed the privacy protection capabilities of FL and DP against the trade-offs in the associated model's accuracy and training time. Using a simulated external attack on a target mHealth system, we aimed to measure the effectiveness of such an attack under various levels of privacy protection on the target system and measure the costs to the target system's performance associated with the chosen levels of privacy protection. A neural network classifier that attempts to predict IHS participant daily mood ecological momentary assessment score from sensor data served as our target system. An external attacker attempted to identify participants whose average mood ecological momentary assessment score is lower than the global average. The attack followed techniques in the literature, given the relevant assumptions about the abilities of the attacker. For measuring attack effectiveness, we collected attack success metrics (area under the curve [AUC], positive predictive value, and sensitivity), and for measuring privacy costs, we calculated the target model training time and measured the model utility metrics. Both sets of metrics are reported under varying degrees of privacy protection on the target. We found that FL alone does not provide adequate protection against the privacy attack proposed above, where the attacker's AUC in determining which participants exhibit lower than average mood is over 0.90 in the worst-case scenario. However, under the highest level of DP tested in this study, the attacker's AUC fell to approximately 0.59 with only a 10% point decrease in the target's R2 and a 43% increase in model training time. Attack positive predictive value and sensitivity followed similar trends. Finally, we showed that participants in the IHS most likely to require strong privacy protection are also most at risk from this particular privacy attack and subsequently stand to benefit the most from these privacy-preserving technologies. Our results demonstrated both the necessity of proactive privacy protection research and the feasibility of the current FL and DP methods implemented in a real mHealth scenario. Our simulation methods characterized the privacy-utility trade-off in our mHealth setup using highly interpretable metrics, providing a framework for future research into privacy-preserving technologies in data-driven health and medical applications.

Blockchain-enabled cross-chain collaboration model for elderly health information from a whole process perspective.

Due to people having less children and the aging population, the demand for elderly health services is increasing, which leads to an increase in demand for elderly health information. However, there is a gap between elderly medical health information and elderly care information due to different storage institutions and storage methods, which makes it difficult for the medical service industry and the elderly service industry to fully grasp and utilize the health information of the elderly. Therefore, it is difficult to provide whole process services that combine elderly medical health and elderly care. To solve the problem of the poor collaborative utilization of elderly healthcare information, this paper, based on blockchain cross-chain technology and the literature and field research, studies the specific contexts that are needed to realize elderly health information collaboration. Based on the system theory viewpoint, the component-based modular design concept is used to identify the attributes and types of current health information of the elderly from health information related to the five modules of prevention, detection, diagnosis, treatment, and rehabilitation in the process of elderly healthcare. This paper explores the structure, elements, and interactions between the medical health information chains and the elderly care information chains. We build a blockchain-enabled cross-chain collaboration model of elderly health information from the perspective of the whole process with the help of the underlying logic of virtual chain, and to realize the applicability and flexibility of cross-chain collaboration for health information for the elderly in the whole process. The research results show that the proposed cross-chain collaboration model can realize the cross-chain collaboration of health information for the elderly with easy implementation, high throughput, and strong privacy protection.

An Efficient Decentralized Identity Management System Based on Range Proof for Social Networks

Online social networks (OSNs) are becoming more and more popular in people's lives as the demand for online interaction continues to grow. Current OSNs are using centralized identity management system (IDM), which has some problems of single point of failure and privacy data leakage. The emergence of decentralized identity (DID) can solve these problems. However, most existing DID systems have some privacy issues that a user's attributes value are disclosed while accessing service. In this paper, we design a DID protocol to solve these challenges. The proposed protocol includes a range proof protocol to provide attribute privacy. The range proof protocol works with anonymous credentials and does not need a trusted setup. Moreover, the identity model behind the DID protocol is extended from an existing model, which achieves identity revocation. Finally, we implement a system prototype on the blockchain for evaluation. The security analysis shows that our protocol provides stronger privacy protection. The performance evaluation indicates that the computation cost and blockchain overheads of our protocol are acceptable in OSNs.