%0 Conference Proceedings
%T Data-Minimizing Authentication Goes Mobile
%+ IBM Research [Zurich]
%+ Catholic University of Leuven = Katholieke Universiteit Leuven (KU Leuven)
%+ Katholieke Hogeschool Sint-Lieven (KaHo Sint-Lieven)
%A Bichsel, Patrik
%A Camenisch, Jan
%A Decker, Bart, De
%A Lapon, Jorn
%A Naessens, Vincent
%A Sommer, Dieter
%Z Part 1: Research Papers
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 13th International Conference on Communications and Multimedia Security (CMS)
%C Canterbury, United Kingdom
%Y Bart Decker
%Y David W. Chadwick
%I Springer
%3 Communications and Multimedia Security
%V LNCS-7394
%P 55-71
%8 2012-09-03
%D 2012
%R 10.1007/978-3-642-32805-3_5
%K privacy
%K anonymous credential systems
%K mobile computing
%K Android
%K secure element
%K visual communication channel
%Z Computer Science [cs]
%Z Computer Science [cs]/Networking and Internet Architecture [cs.NI]Conference papers
%X Authentication is a prerequisite for proper access control to many eservices. Often, it is carried out by identifying the user, while generally, verification of certified attributes would suffice. Even worse, this kind of authentication makes all the user’s transactions linkable and discloses an excessive amount of personal information, and thus erodes the user’s privacy. This is in clear contradiction to the data minimization principle put forth in the European data protection legislation.In this paper, we present data-minimizing mobile authentication, which is a kind of attribute-based authentication through the use of anonymous credentials, thereby revealing substantially less personal information about the user. We describe two typical scenarios, design an architecture, and discuss a prototype implemented on a smart phone which minimizes the disclosure of personal data in a user-to-terminal authentication setting. The prototype uses the Identity Mixer anonymous credential system (Idemix) and realizes short-range communication between the smart phone and the terminal using visual channels over which QR codes are exchanged. Furthermore, the security has been improved and unauthorized sharing of credentials prevented by storing the credentials’ secret key in a secure element hosted by the mobile phone. Our measurements show that the use of smart phones for data-minimizing authentication can be an actual “game changer” for a broad deployment of anonymous credential systems.
%G English
%Z TC 6
%Z TC 11
%2 https://inria.hal.science/hal-01540904/document
%2 https://inria.hal.science/hal-01540904/file/978-3-642-32805-3_5_Chapter.pdf
%L hal-01540904
%U https://inria.hal.science/hal-01540904
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-TC6
%~ IFIP-CMS
%~ IFIP-LNCS-7394