research-article

Opaak: using mobile phones to limit anonymous identities online

Authors:

Gabriel Maganis,

Dawn SongAuthors Info & Claims

MobiSys '12: Proceedings of the 10th international conference on Mobile systems, applications, and services

Pages 295 - 308

https://doi.org/10.1145/2307636.2307664

Published: 25 June 2012 Publication History

Abstract

Trust and anonymity are both desirable properties on the Internet. However, online services and users often have to make the trade off between trust and anonymity due to the lack of usable frameworks for achieving them both. We propose Opaak, a practical anonymous authentication framework. Opaak enables its users to establish identities with different online services while ensuring that these identities cannot be linked with each other or their real identity. In addition, Opaak allows online service providers to control the rate at which users utilize their services while preserving their anonymity. Hence, allowing the service providers to prevent abuse in the form of spam or Sybil attacks, which are prevalent in such online services that offer anonymity. Opaak leverages the mobile phone as a scarce resource combined with anonymous credentials in order to provide these features. We target two kinds of applications for Opaak and identify their requirements in order to achieve both trust and anonymity. We develop efficient protocols for these applications based on anonymous credentials. In addition, we design an architecture that facilitates integration with existing mobile and web applications and allows application developers to transparently utilize our protocols. We implement a prototype on Android and evaluate its performance to demonstrate the practicality of our approach.

References

[1]

Craigslist. http://www.craigslist.org.

[2]

Credentica. http://www.credentica.com/.

[3]

Facebook connect. http://developers.facebook.com/docs/guides/web.

[4]

Four squares. http://schorn.ch/lagrange.html.

[5]

Linkedin. http://www.linkedin.com.

[6]

OpenID website. http://openid.net.

[7]

PrimeLife. http://www.primelife.eu/.

[8]

Wikipedia. http://www.wikipedia.org.

[9]

R. Anderson. Can We Fix the Security Economics of Federated Authentication? In J. A. Malcolm, editor, International Workshop on Security Protocols, 2011.

Digital Library

[10]

C. Andersson, J. Camenisch, S. Crane, S. Fischer-Hubner, R. Leenes, S. Pearsorr, J. Pettersson, and D. Sommer. Trust in PRIME. International Symposium on Signal Processing and Information Technology, 0:552--559, 2005.

[11]

E. Bangerter, J. Camenisch, and A. Lysyanskaya. A Cryptographic Framework for the Controlled Release of Certified Data. In Security Protocols Workshop, 2004.

Digital Library

[12]

M. Becher, F. C. Freiling, J. Hoffmann, T. Holz, S. Uellenbeck, and C. Wolf. Mobile Security Catching Up? Revealing the Nuts and Bolts of the Security of Mobile Devices. In IEEE Symposium on Security and Privacy, 2011.

Digital Library

[13]

P. Bichsel, J. Camenisch, T. Groß, and V. Shoup. Anonymous Credentials on a Standard Java Card. In CCS, 2009.

Digital Library

[14]

M. Blanton. Online subscriptions with anonymous access. In ASIACCS, pages 217--227, 2008.

Digital Library

[15]

J. Camenisch, S. Hohenberger, M. Kohlweiss, A. Lysyanskaya, and M. Meyerovich. How to win the clonewars: Efficient Periodic n-times Anonymous Authentication. In CCS, 2006.

Digital Library

[16]

J. Camenisch, R. Leenes, and D. Sommer, editors. Digital Privacy: PRIME - Privacy and Identity Management for Europe, volume 6545. Springer, 2011.

Digital Library

[17]

J. Camenisch and A. Lysyanskaya. An efficient system for non-transferable anonymous credentials with optional anonymity revocation. In EUROCRYPT, pages 93--118, 2001.

Digital Library

[18]

J. Camenisch and A. Lysyanskaya. A signature scheme with efficient protocols. In Security in Communication Networks, 2002.

Digital Library

[19]

J. Camenisch and M. Stadler. Efficient group signature schemes for large groups. In B. Kaliski, editor, Advances in Cryptology - CRYPTO '97, volume 1294 of Lecture Notes in Computer Science, pages 410--424. 1997.

Digital Library

[20]

D. Chappell. Cardspace. http://msdn.microsoft.com/en-us/library/aa480189.aspx.

[21]

A. Dey1 and S. Weis. PseudoID: Enhancing privacy for federated login. In HotPETS, 2010.

[22]

R. Dingledine, N. Mathewson, and P. Syverson. Tor: The second-generation onion router. In USENIX Security Symposium, pages 303--320, 2004.

Digital Library

[23]

J. R. Douceur. The sybil attack. In IPTPS, pages 251--260, 2002.

Digital Library

[24]

A. Fiat and A. Shamir. How to prove yourself: Practical solutions to identification and signature problems. In A. Odlyzko, editor, Advances in Cryptology - CRYPTO '86, volume 263 of Lecture Notes in Computer Science, pages 186--194. 1987.

Digital Library

[25]

R. Henry, K. Henry, and I. Goldberg. Making a Nymbler Nymble Using VERBS. In PETS, pages 111--129, 2010.

Digital Library

[26]

IBM Research Zurich Security Team. Specification of the Identity Mixer Cryptographic Library v. 2.3.2. https://prime.inf.tu-dresden.de/idemix/, December 2010.

[27]

T. Kohno, A. Broido, and K. C. Claffy. Remote Physical Device Fingerprinting. In IEEE Symposium on Security and Privacy, pages 211--225, 2005.

Digital Library

[28]

B. N. Levine, C. Shields, and N. B. Margolin. A Survey of Solutions to the Sybil Attack. Tech report 2006-052, University of Massachusetts Amherst, 2006.

[29]

Z. Lin and N. Hopper. Jack: Scalable Accumulator-based Nymble System. In WPES, pages 53--62, 2010.

Digital Library

[30]

F. Paci, E. Bertino, S. Kerr, A. C. Squicciarini, and J. Woo. An Overview of VeryIDX - A Privacy-Preserving Digital Identity Management System for Mobile Devices. Journal of Software, 4(7):696--706, 2009.

[31]

M. O. Rabin and J. O. Shallit. Randomized algorithms in number theory. Communications on Pure and Applied Mathematics, 39, 1986.

[32]

C.-P. Schnorr. Efficient signature generation by smart cards. Journal of Cryptology, pages 161--174, 1991.

Digital Library

[33]

I. Teranishi, J. Furukawa, and K. Sako. k-Times Anonymous Authentication (Extended Abstract). In ASIACRYPT, pages 308--322, 2004.

[34]

P. P. Tsang, M. H. Au, A. Kapadia, and S. W. Smith. PEREA: Towards Practical TTP-free Revocation in Anonymous Authentication. In CCS, pages 333--344.

Digital Library

[35]

P. P. Tsang, M. H. Au, A. Kapadia, and S. W. Smith. Blacklistable anonymous credentials: Blocking misbehaving users without TTPs. In CCS, pages 72--81, 2007.

Digital Library

[36]

P. P. Tsang, M. H. Au, A. Kapadia, and S. W. Smith. Blacklistable Anonymous Credentials: Blocking Misbehaving Users without TTPs. In CCS, pages 72--81, 2007.

Digital Library

[37]

P. Verhaeghe, K. Verslype, J. Lapon, V. Naessens, and B. D. Decker. A mobile and reliable anonymous epoll infrastructure. In Mobisec, 2010.

[38]

K. Verslype, P. Verhaeghe, J. Lapon, V. Naessens, and B. De Decker. Priman: a privacy-preserving identity framework. In Data and Applications Security and Privacy XXIV, pages 327--334, 2010.

Digital Library

[39]

L. von Ahn, M. Blum, N. J. Hopper, and J. Langford. CAPTCHA: Using Hard AI Problems for Security. In EUROCRYPT, pages 294--311, 2003.

Digital Library

Cited By

Lu YZhang JQi YQi SLi YSong HLiu Y(2023)Safety Warning! Decentralised and Automated Incentives for Disqualified Drivers Auditing in Ride-Hailing ServicesIEEE Transactions on Mobile Computing10.1109/TMC.2021.310801222:3(1748-1762)Online publication date: 1-Mar-2023
https://doi.org/10.1109/TMC.2021.3108012
Li MZhu LZhang ZLal CConti MAlazab M(2022)User-Defined Privacy-Preserving Traffic Monitoring Against n-by-1 Jamming AttackIEEE/ACM Transactions on Networking10.1109/TNET.2022.315765430:5(2060-2073)Online publication date: Oct-2022
https://doi.org/10.1109/TNET.2022.3157654
Li MZhu LZhang ZLal CConti MMartinelli F(2021)Privacy for 5G-Supported Vehicular NetworksIEEE Open Journal of the Communications Society10.1109/OJCOMS.2021.31034452(1935-1956)Online publication date: 2021
https://doi.org/10.1109/OJCOMS.2021.3103445
Show More Cited By

Index Terms

Opaak: using mobile phones to limit anonymous identities online
1. Security and privacy
  1. Security services
    1. Authentication

Recommendations

Making a nymbler nymble using VERBS
PETS'10: Proceedings of the 10th international conference on Privacy enhancing technologies

We propose a new system modeled after Nymble. Like Nymble, our scheme provides a privacy-preserving analog of IP address blocking for anonymizing networks. However, unlike Nymble, the user in our scheme need not trust third parties to maintain their ...
Strengthening Authentication with Privacy-Preserving Location Verification of Mobile Phones
WPES '15: Proceedings of the 14th ACM Workshop on Privacy in the Electronic Society

Mobile devices are increasingly used in security-sensitive contexts such as physical access control and authorization of payment transactions. In this paper we contribute a mechanism to verify whether a mobile device currently resides within a ...
Information privacy?!

When using the Internet, we reveal much personal information both willingly and indadvertedly. Companies use this information for targeted advertisement and thereby to finance the services they offer to users. The mechanisms used today to protect users' ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

MobiSys '12: Proceedings of the 10th international conference on Mobile systems, applications, and services

June 2012

548 pages

ISBN:9781450313018

DOI:10.1145/2307636

General Chair:
Nigel Davies
Lancaster University, UK
,
Program Chairs:
Srinivasan Seshan
Carnegie Mellon University, USA
,
Lin Zhong
Rice University, USA

Copyright © 2012 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGMOBILE: ACM Special Interest Group on Mobility of Systems, Users, Data and Computing

In-Cooperation

SIGOPS: ACM Special Interest Group on Operating Systems

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 June 2012

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

MobiSys'12

Sponsor:

SIGMOBILE

MobiSys'12: The 10th International Conference on Mobile Systems, Applications, and Services

June 25 - 29, 2012

Lake District, Low Wood Bay, UK

Acceptance Rates

Overall Acceptance Rate 274 of 1,679 submissions, 16%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

14
Total Citations
View Citations
434
Total Downloads

Downloads (Last 12 months)21
Downloads (Last 6 weeks)2

Reflects downloads up to 27 Jul 2024

Other Metrics

View Author Metrics

Citations

Cited By

Lu YZhang JQi YQi SLi YSong HLiu Y(2023)Safety Warning! Decentralised and Automated Incentives for Disqualified Drivers Auditing in Ride-Hailing ServicesIEEE Transactions on Mobile Computing10.1109/TMC.2021.310801222:3(1748-1762)Online publication date: 1-Mar-2023
https://doi.org/10.1109/TMC.2021.3108012
Li MZhu LZhang ZLal CConti MAlazab M(2022)User-Defined Privacy-Preserving Traffic Monitoring Against n-by-1 Jamming AttackIEEE/ACM Transactions on Networking10.1109/TNET.2022.315765430:5(2060-2073)Online publication date: Oct-2022
https://doi.org/10.1109/TNET.2022.3157654
Li MZhu LZhang ZLal CConti MMartinelli F(2021)Privacy for 5G-Supported Vehicular NetworksIEEE Open Journal of the Communications Society10.1109/OJCOMS.2021.31034452(1935-1956)Online publication date: 2021
https://doi.org/10.1109/OJCOMS.2021.3103445
Li MChen YZheng SHu DLal CConti M(2020)Privacy-preserving Navigation Supporting Similar Queries in Vehicular NetworksIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2020.3017534(1-1)Online publication date: 2020
https://doi.org/10.1109/TDSC.2020.3017534
Li MZhu LZhang ZDu XGuizani M(2018)PROS: A Privacy-Preserving Route-Sharing Service via Vehicular Fog ComputingIEEE Access10.1109/ACCESS.2018.28787926(66188-66197)Online publication date: 2018
https://doi.org/10.1109/ACCESS.2018.2878792
Sei YOhsuga A(2017)Location Anonymization With Considering Errors and Existence ProbabilityIEEE Transactions on Systems, Man, and Cybernetics: Systems10.1109/TSMC.2016.256492847:12(3207-3218)Online publication date: Dec-2017
https://doi.org/10.1109/TSMC.2016.2564928
Maheswaran JJackowitz DZhai EWolinsky DFord BBertino ESandhu RPretschner A(2016)Building Privacy-Preserving Cryptographic Credentials from Federated Online IdentitiesProceedings of the Sixth ACM Conference on Data and Application Security and Privacy10.1145/2857705.2857725(3-13)Online publication date: 9-Mar-2016
https://dl.acm.org/doi/10.1145/2857705.2857725
Gong YCai YGuo YFang Y(2016)A Privacy-Preserving Scheme for Incentive-Based Demand Response in the Smart GridIEEE Transactions on Smart Grid10.1109/TSG.2015.24120917:3(1304-1313)Online publication date: May-2016
https://doi.org/10.1109/TSG.2015.2412091
Camenisch JOrtiz-Yepes DPreiss FRay IHopper NJansen R(2015)Strengthening Authentication with Privacy-Preserving Location Verification of Mobile PhonesProceedings of the 14th ACM Workshop on Privacy in the Electronic Society10.1145/2808138.2808144(37-48)Online publication date: 12-Oct-2015
https://dl.acm.org/doi/10.1145/2808138.2808144
Yang BYang KQin YZhang ZFeng D(2015)DAA-TZ: An Efficient DAA Scheme for Mobile Devices Using ARM TrustZoneTrust and Trustworthy Computing10.1007/978-3-319-22846-4_13(209-227)Online publication date: 14-Aug-2015
https://doi.org/10.1007/978-3-319-22846-4_13
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents