Data-Minimizing Authentication Goes Mobile - Inria - Institut national de recherche en sciences et technologies du numérique
Conference Papers Year : 2012

Data-Minimizing Authentication Goes Mobile

Patrik Bichsel
  • Function : Author
  • PersonId : 1010444
Jan Camenisch
  • Function : Author
  • PersonId : 997995
Jorn Lapon
  • Function : Author
  • PersonId : 1004392
Vincent Naessens
  • Function : Author
  • PersonId : 1003318
Dieter Sommer
  • Function : Author
  • PersonId : 1010445

Abstract

Authentication is a prerequisite for proper access control to many eservices. Often, it is carried out by identifying the user, while generally, verification of certified attributes would suffice. Even worse, this kind of authentication makes all the user’s transactions linkable and discloses an excessive amount of personal information, and thus erodes the user’s privacy. This is in clear contradiction to the data minimization principle put forth in the European data protection legislation.In this paper, we present data-minimizing mobile authentication, which is a kind of attribute-based authentication through the use of anonymous credentials, thereby revealing substantially less personal information about the user. We describe two typical scenarios, design an architecture, and discuss a prototype implemented on a smart phone which minimizes the disclosure of personal data in a user-to-terminal authentication setting. The prototype uses the Identity Mixer anonymous credential system (Idemix) and realizes short-range communication between the smart phone and the terminal using visual channels over which QR codes are exchanged. Furthermore, the security has been improved and unauthorized sharing of credentials prevented by storing the credentials’ secret key in a secure element hosted by the mobile phone. Our measurements show that the use of smart phones for data-minimizing authentication can be an actual “game changer” for a broad deployment of anonymous credential systems.
Fichier principal
Vignette du fichier
978-3-642-32805-3_5_Chapter.pdf (285.28 Ko) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01540904 , version 1 (16-06-2017)

Licence

Identifiers

Cite

Patrik Bichsel, Jan Camenisch, Bart De Decker, Jorn Lapon, Vincent Naessens, et al.. Data-Minimizing Authentication Goes Mobile. 13th International Conference on Communications and Multimedia Security (CMS), Sep 2012, Canterbury, United Kingdom. pp.55-71, ⟨10.1007/978-3-642-32805-3_5⟩. ⟨hal-01540904⟩
374 View
125 Download

Altmetric

Share

More