PDRAA: An Efficient Privacy Data Retrieval Protocol With Anonymous Authorization Based on Verifiable Credential

Abstract

In the data-driven era, the unchecked collection and processing of personal data has given rise to serious privacy concerns. In response, the General Data Protection Regulation (GDPR) was introduced to grant individuals stronger control over the use of their data. Privacy data retrieval methods show considerable promise in this context, but further improvements are required to balance the principles of lawfulness and data minimization. To address this problem, we propose PDRAA, an efficient privacy data retrieval protocol with anonymous authorization based on the verifiable credential (VC). Specifically, our designed VC achieves anonymous identification of data subjects and facilitates fine-grained access control by supporting selective disclosure of attributes. By combining VC with non-interactive zero-knowledge (NIZK) proofs, PDRAA enables data subjects to anonymously authenticate via VC presentation. This allows the data controller to verify the legitimacy of retrieval requests while ensuring compliance with the principle of data minimization. Besides, PDRAA introduces a re-randomization mechanism to prevent linkability attacks during the authorization process and provides lightweight, flexible authorization revocation. Moreover, we utilize Labeled Private Set Intersection (Labeled PSI) technology to meet the privacy requirements of participants and support batch retrieval. Our protocol takes a comprehensive security analysis within the Universal Composability framework. Experimental results demonstrate that PDRAA outperforms existing methods in terms of performance, which is significant for promoting compliance with GDPR.