Jan Camenisch

In Cooperative Intelligent Transport Systems (C-ITSs), vehicles broadcast their location and other information over dedicated short-range radio channels. This communication must be authenticated to protect the information against tampering, but at the same time must be anonymous to protect the location privacy of the driver. The most prominent C-ITS solutions today let vehicles either store large numbers of preloaded pseudonym certificates, or let them regularly fetch new pseudonyms from an online authority. More advanced solutions based on group signatures or anonymous credentials allow vehicles to generate arbitrarily many pseudonyms locally, without requiring further interaction. These solutions, however, are vulnerable to Sybil attacks, as the compromised key material of a single vehicle could be used to impersonate an arbitrary number of vehicles simultaneously. In this paper, we propose a new generic approach for C-ITS authentication based on privacy-preserving Attribute-Based Credential (ABC) that generates pseudonyms locally on the vehicle, but where only one valid pseudonym can be generated at any given time. The computational performance and signature sizes of current Privacy-ABC schemes makes them more useful for low-frequency warning messages than for high-frequency beaconing. We therefore see our approach rather as a conceptual framework that can direct further research into more efficient dedicated implementations.

Personal information is often gathered and processed in a decentralized fashion. Examples include health records and governmental data bases. To protect the privacy of individuals, no unique user identifier should be used across the different databases. At the same time, the utility of the distributed information needs to be preserved which requires that it be nevertheless possible to link different records if they relate to the same user. Recently, Camenisch and Lehmann (CCS 15) have proposed a pseudonym scheme that addresses this problem by domain-specific pseudonyms. Although being unlinkable, these pseudonyms can be converted by a central authority (the converter). To protect the users' privacy, conversions are done blindly without the converter learning the pseudonyms or the identity of the user. Unfortunately, their scheme sacrifices a crucial privacy feature: transparency. Users are no longer able to inquire with the converter and audit the flow of their personal data. Indeed, such auditability appears to be diametral to the goal of blind pseudonym conversion. In this paper we address these seemingly conflicting requirements and provide a system where user-centric audits logs are created by the oblivious converter while maintaining all privacy properties. We prove our protocol to be UC-secure and give an efficient instantiation using novel building blocks.