Data-Minimizing Authentication Goes Mobile

Abstract : Authentication is a prerequisite for proper access control to many eservices. Often, it is carried out by identifying the user, while generally, verification of certified attributes would suffice. Even worse, this kind of authentication makes all the user’s transactions linkable and discloses an excessive amount of personal information, and thus erodes the user’s privacy. This is in clear contradiction to the data minimization principle put forth in the European data protection legislation.In this paper, we present data-minimizing mobile authentication, which is a kind of attribute-based authentication through the use of anonymous credentials, thereby revealing substantially less personal information about the user. We describe two typical scenarios, design an architecture, and discuss a prototype implemented on a smart phone which minimizes the disclosure of personal data in a user-to-terminal authentication setting. The prototype uses the Identity Mixer anonymous credential system (Idemix) and realizes short-range communication between the smart phone and the terminal using visual channels over which QR codes are exchanged. Furthermore, the security has been improved and unauthorized sharing of credentials prevented by storing the credentials’ secret key in a secure element hosted by the mobile phone. Our measurements show that the use of smart phones for data-minimizing authentication can be an actual “game changer” for a broad deployment of anonymous credential systems.
Complete list of metadatas

Cited literature [24 references]  Display  Hide  Download

https://hal.inria.fr/hal-01540904
Contributor : Hal Ifip <>
Submitted on : Friday, June 16, 2017 - 4:47:11 PM
Last modification on : Thursday, February 21, 2019 - 10:31:47 AM
Long-term archiving on : Wednesday, January 10, 2018 - 1:02:16 PM

File

978-3-642-32805-3_5_Chapter.pd...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Patrik Bichsel, Jan Camenisch, Bart Decker, Jorn Lapon, Vincent Naessens, et al.. Data-Minimizing Authentication Goes Mobile. 13th International Conference on Communications and Multimedia Security (CMS), Sep 2012, Canterbury, United Kingdom. pp.55-71, ⟨10.1007/978-3-642-32805-3_5⟩. ⟨hal-01540904⟩

Share

Metrics

Record views

356

Files downloads

124