Preserving Privacy While Using Authorization Certificates

• US 20080052772A1
• Filed: 12/13/2004
• Published: 02/28/2008
• Est. Priority Date: 12/24/2003
• Status: Abandoned Application

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips N.V.
• Inventors: Kamperman, Franciscus Lucas Antonius Johannes, Tuyls, Pim Theo, Conrado, Claudine Viegas
• Application Number:
  US10/596,668
• Publication Number:
  US 20080052772A1
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The invention proposes a method to provide privacy for users or a user from a group of users with respect to authorizations they are granted, where such authorizations are expressed using digital authorization certificates, and with respect to domain certificates in case of groups of users. The idea is to conceal the user identity in the certificates, while the certificate itself remains in the clear. In this way, certificates can be widely and openly available, e.g. in a public network, without a random observer being able to link a user to an authorization or to identify a user within a domain. Privacy is also provided towards the certificate verifier by means of zero-knowledge protocols, which are carried out between the user and the verifier in order for the verifier to check a user'"'"'s entitlement to a certificate. Privacy is further provided towards the certificate issuer as well, by means of a mechanism that allows the anonymous (buying or) issuing of certificates from the issuer.

Claims

1. A method of preserving privacy for a user while enabling the user controlled access to data,

the user being represented by a user device (110,721) and identified by a user identity,

the method using at least one certificate that associates data access rights with the user identity,

wherein the certificate conceals the user identity,

the certificate comprises publicly available solution information P, and

a concealed secret S′

is publicly available,

the method further comprises at least one of

a certificate verification process (120,420) between the user device and a verifier device (111,701),

a certificate issuing process (220,520,620) between the user device and an issuing device (211,711), and

a certificate re-issuing process (320) between the user device and the issuing device,

wherein the certificate verification process comprises the steps of

the user device obtaining the concealed secret S′

corresponding to the certificate,

the user device retrieving the secret S from the concealed secret S′

,

the verifier device obtaining the solution information P from the certificate,

the user device proving to the verifier device that it knows the secret S without the verifier device learning the secret S or the user identity,

wherein the certificate issuing process comprises the steps of;

generating a secret S and a solution information P,

concealing the secret S into a concealed secret S′

,

the issuing device issuing a certificate comprising at least the solution information P,

wherein the certificate re-issuing process comprises the steps of

the user device obtaining the concealed secret S′

corresponding to the certificate,

the user device retrieving the secret S from the concealed secret S′

,

the issuing device obtaining the solution information P from the certificate,

the user device proving to the issuing device that it knows the secret S without the issuing verifier device learning the secret S or the user identity,

generating a new secret S2 and new solution information P2,

concealing the secret S2 into a concealed secret S2′

,

the issuing device issuing a new certificate comprising at least the new solution information P2.

2. The method according to claim 1, wherein the certificate comprises publicly available concealed secret S′

.

3. The method according to claim 2, wherein the secret S is encrypted with the user'"'"'s public key to generate the concealed secret S′

.

4. The method according to claim 1, wherein the solution information P and the secret S are members of Zn*, and the solution information P is the square of S.

5. The method according to claim 1, wherein the concealed secret S′

comprises random information RAN.

6. The method according to claim 1, wherein the verifier device verifies that the user device has knowledge of the secret S using a zero-knowledge protocol.

7. The method according to claim 1, wherein the communication during the issuing process is protected using symmetric key encryption.

8. The method according to claim 1, wherein in the issuing process the secret S and the solution information P is generated by the user device.

9. The method of claim 1, wherein the certificate is an authorization certificate.

10. The method of claim 1, wherein the certificate is a domain certificate.

11. The method according to claim 10, wherein the concealed secret S′

in the domain certificate comprises the secret S, encrypted with the secret domain key.

12. The method according to claim 9, wherein the concealed secret S′

comprises the secret S, multiplied with cr_id.

13. The method according to claim 1, wherein the certificate comprises two secrets, of which the knowledge prove by a user device gives different access levels.

14. User device (110,721) being arranged for issuing a certificate according to claim 1, comprising:

receiving means (727) for receiving process information,

computing means (722), comprising processing (723), encryption/decryption (725) and storing means (724), for engaging in at least one of the certificate verification process, the certificate issuing process, and certificate re-issuing process, and

transmitting means (726) for transmitting process information.

15. Verifier device (111,701) being arranged for verifying a certificate according to claim 1, comprising:

receiving means (707) for receiving process information,

computing means (702), comprising processing (703), encryption/decryption (705) and storing means (704), for engaging in the certificate verification process, and

transmitting means (706) for transmitting process information.

16. Issuing device (211,711) being arranged for issuing a certificate according to claim 1, comprising:

receiving means (717) for receiving process information,

computing means (712), comprising processing (713), encryption/decryption (715) and storing means (714), for engaging in at least one of the certificate issuing process and certificate re-issuing process, and

transmitting means (716) for transmitting process information.

17. Signal carrying at least part of a certificate as used in the method according to claim 1.

18. A computer program product (732) carrying computer executable instructions comprising a computer readable medium, having thereon computer program code means, to make a computer execute, when said computer program code means is loaded in the computer, implementing at least one protocol side of at least one of:

the certificate issuing protocol,

the certificate re-issuing protocol, and

the certificate verification protocol.