HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation
Conference papers

Data-Minimizing Authentication Goes Mobile

Abstract : Authentication is a prerequisite for proper access control to many eservices. Often, it is carried out by identifying the user, while generally, verification of certified attributes would suffice. Even worse, this kind of authentication makes all the user’s transactions linkable and discloses an excessive amount of personal information, and thus erodes the user’s privacy. This is in clear contradiction to the data minimization principle put forth in the European data protection legislation.In this paper, we present data-minimizing mobile authentication, which is a kind of attribute-based authentication through the use of anonymous credentials, thereby revealing substantially less personal information about the user. We describe two typical scenarios, design an architecture, and discuss a prototype implemented on a smart phone which minimizes the disclosure of personal data in a user-to-terminal authentication setting. The prototype uses the Identity Mixer anonymous credential system (Idemix) and realizes short-range communication between the smart phone and the terminal using visual channels over which QR codes are exchanged. Furthermore, the security has been improved and unauthorized sharing of credentials prevented by storing the credentials’ secret key in a secure element hosted by the mobile phone. Our measurements show that the use of smart phones for data-minimizing authentication can be an actual “game changer” for a broad deployment of anonymous credential systems.
Complete list of metadata

Cited literature [24 references]  Display  Hide  Download

Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Friday, June 16, 2017 - 4:47:11 PM
Last modification on : Thursday, February 21, 2019 - 10:31:47 AM
Long-term archiving on: : Wednesday, January 10, 2018 - 1:02:16 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Patrik Bichsel, Jan Camenisch, Bart Decker, Jorn Lapon, Vincent Naessens, et al.. Data-Minimizing Authentication Goes Mobile. 13th International Conference on Communications and Multimedia Security (CMS), Sep 2012, Canterbury, United Kingdom. pp.55-71, ⟨10.1007/978-3-642-32805-3_5⟩. ⟨hal-01540904⟩



Record views


Files downloads