CredAct: Privacy-Preserving Activity Verification for Benefits Schemes in Self-Sovereign Identity

Abstract

We propose CredAct, a user activity verification designed with data minimisation to protect privacy. Many Benefits Schemes, such as discount offers, loyalty programs, and incentive systems, require verification of user activity (e.g., buying healthy food, step counts) in their business processes. These service providers can collect a large amount of users’ personal information, and often users do not have fine-grained control over the scope of data disclosure. In CredAct, we propose a Self-Sovereign Identity based framework implemented on blockchain that enables users participating in a benefits scheme to minimise data sharing during the submission and verification of data. We use a smart contract-based function along with a Zero-Knowledge Proof cryptographic commitment scheme, that forces the entities involved in the business process to collect or disclose only the required (minimum) data to fulfill the intended purpose. The evaluation shows that the system is feasible with minimal operational overheads compared to traditional cryptographic techniques. We also perform a qualitative privacy and security analysis considering relevant threats to CredAct.