It is important that during the execution of a business process built from composable Web services from multiple domains, the component service be able to verify the identity of the user to check it has the required permissions for accessing the services, while at the same time identity attributes need to be protected properly as they can be target of attacks. In such context, we propose a privacy-preserved multi-domain identity attributes verification model BPVrfy. It extends federate identity management with support for multiple identity verification policies and privacy enhancement. Identity attributes verification process is partitioned into three sub-procedures consisting of attribute provision, federation enrollment and attributes transfer, and then a series of protocols based on cryptographic schemes is proposed respectively. BPVrfy adopts Perdersen Commitment, Zero-Knowledge Proof of Knowledge, BGLS Aggregate Signature and Certificate-Based Signature (CBS) cryptographic schemes together to give a privacy-preserved federate identity attributes verification solution for multi-domain Web services-based business processes.
Direct Anonymous Attestation (DAA) is a special signature scheme that enables remote authentication of a user while preserving privacy under the user's control. Thus, in this paper, based on existing schemes and mechanisms, we firstly construct a DAA signature scheme which is proven secure without random oracles. By making certain reasonable assumptions and employing the techniques of non-interactive zero-knowledge(NIZK) proof system and Two-Party Computation(2PC) scheme, we prove that our scheme satisfies anonymous and untraceable, and compares with existing DAA schemes in the aspects of security and efficiency.
The migration of web applications to Cloud computing platform has raised concerns about the privacy of sensitive data belonging to the consumers of cloud services. The traditional form of security tokens like username/password used to access cloud services are prone to phishing attacks and hence do not provide complete security. In this work we propose to extend the Microsoft's CardSpace identity management tool, to include more robust security tokens using the zero knowledge proof concept. These security tokens are in the form of SAML token supported by Windows Communication Foundation (WCF) and hence can prove interoperable with the existing security platforms.
Cloud computing dynamically provides high quality cloudbased secure services and applications over the internet. The efficient sharing of secure cloud storage services (ESC) scheme which allows the upper-level user to share the secure cloud storage services with multiple lower-level users. In hierarchical identity-based architecture, the sender needs to encrypt a file only once and store only one copy of the corresponding ciphertext in a cloud. The lower-level user needs to decrypt a file which will increase the computational overhead, because the lower-level user does not perform any partial decipherment. In this paper, we propose a Trapdoor commitment scheme that enables a lower-level user to send a short trapdoor to the cloud service provider before retrieving files. This scheme allows the CSP to participate in the partial decipherment, so as to reduce computational overhead on the users without leaking any information about the plaintext. If a lower-level user wants to retrieve a file with limited bandwidth, CPU and memory, the trapdoor which will largely helps to reduce computational power.
Provable data possession (PDP) is a technique for ensuring the integrity of data in storage outsourcing. In this paper, we address the construction of an efficient PDP scheme for distributed cloud storage to support the scalability of service and data migration, in which we consider the existence of multiple cloud service providers to cooperatively store and maintain the clients' data. We present a cooperative PDP (CPDP) scheme based on homomorphic verifiable response and hash index hierarchy. We prove the security of our scheme based on multiprover zero-knowledge proof system, which can satisfy completeness, knowledge soundness, and zero-knowledge properties. In addition, we articulate performance optimization mechanisms for our scheme, and in particular present an efficient method for selecting optimal parameter values to minimize the computation costs of clients and storage service providers. Our experiments show that our solution introduces lower computation and communication overheads in comparison with noncooperative approaches.
This paper focuses on the robustness of concurrent non-malleable zero-knowledge.Existing concurrent non-malleable zero-knowledge protocols either apply non-black-box techniques,or employ black-box but incorporate a zero-knowledge sub-protocol.Hence when concurrently composed with other protocols,security of these protocols is not preserved or hard to argue.Following the well-known Feige-Shamir style,this paper presents a new construction for concurrent non-malleable zero-knowledge argument system,which is easily composed.This protocol takes the robust non-malleable commitment scheme introduced by Lin and Pass in STOC 2009 and specially designed witness indistinguishable proofs as basic components to achieve non-malleability and robustness.Moreover,this paper applies the oblivious simulation strategy to simulate the view of the adversary,and the proof technique introduced by Lin et al.in Crypto 2010 to analyze the indistinguishability of simulation.Since witness indistinguishability is closed under concurrent composition,the commitment sub-protocol is robust and the is oblivious,when concurrently composed with other protocols,this protocol is easier to work with and analyze.Based on the one-way function assumption,the round complexity of this protocol is super-logarithmic.
Cloud computing is an emerging evolutionary computing model that provides highly scalable services over high-speed Internet on a pay-as-usage model. However, cloud-based solutions still have not been widely deployed in some sensitive areas, such as banking and healthcare. The lack of widespread development is related to usersâ concern that their confidential data or privacy would leak out in the cloudâs outsourced environment. To address this problem, we propose a novel active data-centric framework to ultimately improve the transparency and accountability of actual usage of the usersâ data in cloud. Our data-centric framework emphasizes âactiveâ feature which packages the raw data with active properties that enforce data usage with active defending and protection capability. To achieve the active scheme, we devise the Triggerable Data File Structure (TDFS). Moreover, we employ the zero-knowledge proof scheme to verify the requestâs identification without revealing any vital information. Our experimental outcomes demonstrate the efficiency, dependability, and scalability of our framework.
In cloud storage service, clients upload their data together with authentication information to cloud storage server. To ensure the availability and integrity of clients' stored data, cloud server(CS) must prove to a verifier that he is actually storing all of the client's data unchanged. And, enabling public auditability for cloud storage is of critical importance to users with constrained computing resources, who can resort to a third party auditor (TPA) to check the integrity of outsourced data. However, most of the existing proofs of retrievability schemes or proof of data possession schemes do not consider data privacy problem. Zero knowledge privacy requires TPA or the adversary can not deduce any information of the file data from auditing system. In this paper, after giving a new construction of a recently proposed cryptographic primitive named aggregatable signature based broadcast (ASBB) encryption scheme, we present an efficient public auditing scheme with zero knowledge privacy. The new scheme is as efficient as the scheme presented by Shacham and Waters without considering privacy and is secure in the random oracle model.
In order to prevent any spread of digital signatures,this paper propose a zero-knowledge proof scheme of Schnorr digital signature.Signer do not provide the signature information to Receiver,but provide the interactive information of zero-knowledge proof scheme.Receiver can not use interactive information to learn sign information, but Receiver Confident that Signer own signature informatioa this scheme has not only lower Data traffic,but also higher security.
Abstract. In this paper, we investigate on threshold proofs, a framework for distributing the proverâs side of interactive proofs of knowledge over multiple parties. Interactive proofs of knowledge (PoK) are widely used primitives of cryptographic protocols, including important user-centric protocols, such as identification schemes, electronic cash (e-cash), and anonymous credentials. We present a security model for threshold proofs of knowledge and develop threshold versions of well-known primitives such as range proofs, zero-knowledge proofs for preimages of homomorphisms (which generalizes PoKs of discrete logarithms, representations, p-th roots, etc.), as well as OR statements. These building blocks are proven secure in our model. Furthermore, we apply the developed primitives and techniques in the context of user-centric protocols. In particular, we construct distributed-user variants of Brands â e-cash system and the bilinear anonymous credential scheme by Camenisch and Lysyanskaya. Distributing the user party in such protocols has several practical advantages: First, the security of a user can be increased by sharing secrets and computations over multiple devices owned by the user. In this way, losing control of a single device does not result in a security breach. Second, this approach also allows groups of users to jointly control an application (e.g., a joint e-cash account), not giving a single user full control. The distributed versions of the protocols we propose in this paper are relatively efficient (when compared to a general MPC approach). In comparison to the original protocols only the proverâs (or userâs) side is modified while the other side stays untouched. In particular, it is oblivious to the other party whether it interacts with a distributed prover (or user) or one as defined in the original protocol.
Proof of retrievability (POR) is a technique for ensuring the integrity of data in outsourced storage services.In this paper, we address the construction of POR protocol on the standard model of interactive proof systems.We propose the first interactive POR scheme to prevent the fraudulence of prover and the leakage of verified data.We also give full proofs of soundness and zero-knowledge properties by constructing a polynomialtime rewindable knowledge extractor under the computational Diffie-Hellman assumption.In particular, the verification process of this scheme requires a low, constant amount of overhead, which minimizes communication complexity.
SĆawomir Grzonkowski, Peter Corcoran, Thomas Coughlin
A number of well-known authentication protocols are considered in the context of next-generation mobile and CE network services. The potential weaknesses of current protocols can be overcome using Zero Knowledge Proof (ZKP) techniques to protect user passwords so an alternative ZKP protocol, SeDiCi 2.0, is described. This offers mutual and also two-factor authentication that is considered more secure against various phishing attempts than existing trusted third party protocols. The suitability of such a ZKP protocol for various CE-based cloud computing applications is demonstrated.
In WS-BPEL process, Extensible Access Control Markup Language (XACML) is used as an authenticated tool to provide several services for an employee in an organization. There are several policies (XACML) used as an access control in Web Services. XACML policy as RBAC profile to support role based access controls policies. In an organization, there are several roles assigned to an employee based on their attributes. The attributes are used as an authenticating tool to assign the role and perform the task. The identity attributes are used for role provisioning policies to a particular employee i.e. social security number, date of birth, etc. are assigned as an identity attributes. In this aggregate zero knowledge proof knowledge (AgZKPK) and Oblivious commitment based envelope (OCBE) protocols are used during service (information) sharing between employees and to make it more flexible. This process may provide privacy to the user information and support multi-domain environment.
Abstract. In resetting attacks against a proof system, a prover or a verifier is reset and enforced to use the same random tape on various inputs as many times as an adversary may want. Recent deployment of cloud computing gives these attacks a new importance. This paper shows that argument systems for any NP language that are both resettably-sound and resettable zero-knowledge are possible by a constant-round protocol in the BPK model. For that sake, we define and construct a resettablyextractable conditional commitment scheme.
This paper presents a new zero-knowledge protocol for SDH pair(A,a),which is based on Chik How Tan encryption,then we prove that the protocol is an honest verifier zero knowledge proof of knowledge under DBDH assumption.The protocol is suitable for users with higher requirements for data security.Compared with[6],the protocol is of higher efficiency.
Sanjam Garg, Rafail Ostrovsky, Ivan Visconti, Akshay Wadia
Abstract Two central notions of Zero Knowledge that provide very strong, yet seemingly incomparable security guarantees against malicious verifiers are those of Statistical Zero Knowledge and Resettable Zero Knowledge. The current state of the art includes several feasibility and impossibility results about the two notions separately. However, the challenging question of achieving Resettable Statistical Zero Knowledge (i.e., Resettable Zero Knowledge and Statistical Zero Knowledge simultaneously) for non-trivial languages is still open. In this paper, we show:- Resettable Statistical Zero Knowledge with efficient provers: Efficient-prover Resettable Statistical Zero-Knowledge proof systems exist for all languages that admit hash proof systems (e.g., QNR, QR, DDH, DCR). Furthermore, for these languages, as an application of our technique, we also construct a two-round resettable statistical witness-indistinguishable argument system.- Resettable Statistical Zero Knowledge with unbounded provers: Under the assumption that sub-exponentially hard one-way functions exist, rSZK = SZK. In other words, every language that admits a Statistical Zero-Knowledge (SZK) proof system also admits a Resettable Statistical Zero-Knowledge (rSZK) proof system. (Further, the result can be re-stated unconditionally provided there exists a sub-exponentially hard language in SZK). Moreover, under the assumption that (standard) one-way functions exist, all languages L such that the complement of L is random self reducible, admit a rSZK, in other words: co-RSR â rSZK. The round complexity of all our proof systems is Ă(log Îș), where Îș is the security parameter, and all our simulators are black-box. 1
Cloud computing provides a novel computing paradigm for enterprises to store programs and data in the Cloud in a transparent manner, which poses the challenge of security and privacy. In this paper, based on homomorphic cryptography and Zero-Knowledge Proof, we present a novel privacy-preserving scheme for Cloud publish/subscribe service, which achieve efficient privacy-preserving authentication, data integrity, and publish-subscribe confidentiality. The performance evaluation and security analysis demonstrate the practice and validity of the proposed scheme.
The main idea is to protect the signer of a document against the document being digitally distributed without the cooperation of signer. This paper proposes a new scheme of undeniable signature, which is so effective and improved D. Chaum's scheme. And our scheme which is zero-knowledge proved by using one-way function and partition - selection method, shows that its communication(challenge-response) only needs much fewer times during the confirmation protocol and disavowal protocol respectively, being very useful for wireless network environment. In the meantime our scheme allows the verifier to verify that the signature is valid, while the signer doesn't know the original message and the signature, to preserve the privacy of the verifier.
Matteo Maffei, Giulio Malavolta, Manuel Reinert, Dominique Schröder
The existing (election) voting systems, e.g., representative democracy, have many limitations and often fail to serve the best interest of the people in collective decision making. To address this issue, the concept of liquid democracy has been emerging as an alternative decision-making model to make better use of "the wisdom of crowds". Very recently, a few liquid democracy implementations, e.g. Google Votes and Decentralized Autonomous Organization (DAO), are released; however, those systems only focus on the functionality aspect, as no privacy/anonymity is considered. In this work, we, for the first time, provide a rigorous study of liquid democracy under the Universal Composability (UC) frame- work. In the literature, liquid democracy was achieved via two separate stages -- delegation and voting. We propose an efficient liquid democracy e-voting scheme that uni es these two stages. At the core of our design is a new voting concept called statement voting, which can be viewed as a natural extension of the conventional voting approaches. We remark that our statement voting can be extended to enable more complex voting and generic ledger-based non-interactive multi-party computation. We believe that the statement voting concept opens a door for constructing a new class of e-voting schemes.
Abhilasha Bhargav-Spantzel, Anna Squicciarini, Rui Xue, Elisa Bertino
The problem of identity theft, that is, the act of impersonating others' identities by presenting stolen identifiers or proofs of identities, has been receiving increasing attention because of its high financial and social costs. In this paper, we address the problem of verification of such identifiers and proofs of identity. Our approach is based on the concept of privacy preserving multifactor verification of such identifiers and proofs achieved by the development of a new cryptographic primitive, which uses aggregate signatures on commitments that are then used for aggregate zero-knowledge proof of knowledge (ZKPK) protocols. The resultant signatures are very short and the ZKPs are succinct and efficient. We prove the security of our scheme under the co-gap Diffie-Hellman (co-GDH) assumption for groups with bilinear maps. Our cryptographic scheme is an improvement in terms of the performance, flexibility, and storage requirements than the existing efficient ZKPK techniques that may be used to prove under zero knowledge and the knowledge of multiple secrets.