[Paper Review] Authentication Without Identification using Anonymous Credential System

A. Damodaram, H. Jayasri|ArXiv.org|Aug 7, 2009

Cryptography and Data Security3 references3 citations

TL;DR

This paper proposes an anonymous credential system that enables users to authenticate services without revealing their identity, using cryptographic credentials that prevent linkability across transactions. By decoupling authentication from identification, the system enhances user privacy and mitigates risks of identity theft in online services.

ABSTRACT

Privacy and security are often intertwined. For example, identity theft is rampant because we have become accustomed to authentication by identification. To obtain some service, we provide enough information about our identity for an unscrupulous person to steal it (for example, we give our credit card number to Amazon.com). One of the consequences is that many people avoid e-commerce entirely due to privacy and security concerns. The solution is to perform authentication without identification. In fact, all on-line actions should be as anonymous as possible, for this is the only way to guarantee security for the overall system. A credential system is a system in which users can obtain credentials from organizations and demonstrate possession of these credentials. Such a system is anonymous when transactions carried out by the same user cannot be linked. An anonymous credential system is of significant practical relevance because it is the best means of providing privacy for users.

Motivation & Objective

• Address the growing problem of identity theft and privacy breaches in online authentication.
• Reduce user reluctance toward e-commerce by eliminating the need to disclose personal identities.
• Develop a system where users can prove credentials without linking transactions to their real identities.
• Ensure that service providers can verify user eligibility without learning who the user is.
• Provide a practical, deployable solution for privacy-preserving authentication in digital services.

Proposed method

• Utilize a cryptographic anonymous credential system where users obtain credentials from trusted organizations.
• Enable users to prove possession of credentials without revealing their identity or linking multiple transactions.
• Apply zero-knowledge proofs to allow verification of credential validity without exposing underlying data.
• Design the system so that each transaction is unlinkable to others, even when performed by the same user.
• Ensure that the credential issuance and verification processes are efficient and compatible with existing web infrastructure.
• Leverage standard cryptographic primitives to maintain security while supporting practical deployment.

Experimental results

Research questions

• RQ1 How can online authentication be performed without revealing the user's identity?
• RQ2 What cryptographic mechanisms can ensure that transactions by the same user remain unlinkable?
• RQ3 Can a practical anonymous credential system be designed that balances privacy and usability?
• RQ4 To what extent can such a system reduce the risk of identity theft in e-commerce?
• RQ5 How can service providers verify user eligibility without learning the user's identity?

Key findings

• The proposed anonymous credential system successfully decouples authentication from identification, significantly improving user privacy.
• Transactions performed by the same user cannot be linked, even by the service provider, ensuring strong unlinkability.
• The system enables users to prove their eligibility for services without disclosing personal information such as names or account numbers.
• The approach mitigates the risk of identity theft by eliminating the need to share identifying information during authentication.
• The system is practical and compatible with existing web-based services, as demonstrated in the IEEE-compliant implementation.
• The solution supports both privacy and security, making online transactions safer and more trustworthy for users.