BLAC: Revoking repeatedly misbehaving anonymous users without relying on TTPs

Patrick P. Tsang, Man Ho Allen Au, Apu Kapadia, Sean W. Smith

Research output: Journal article publicationJournal articleAcademic researchpeer-review

26 Citations (Scopus)

Abstract

Several credential systems have been proposed in which users can authenticate to service providers anonymously. Since anonymity can give users the license to misbehave, some variants allow the selective deanonymization (or linking) of misbehaving users upon a complaint to a Trusted Third Party (TTP). The ability of the TTP to revoke a user's privacy at any time, however, is too strong a punishment for misbehavior. To limit the scope of deanonymization, some systems have been proposed in which users can be deanonymized only if they authenticate "too many times," such as "double spending" with electronic cash. While useful in some applications, such techniques cannot be generalized to more subjective definitions of misbehavior, for example, using such schemes it is not possible to block anonymous users who "deface too many Web pages" on a Web site. We present BLAC, the first anonymous credential system in which service providers can revoke the credentials of misbehaving users without relying on a TTP. Since revoked users remain anonymous, misbehaviors can be judged subjectively without users fearing arbitrary deanonymization by a TTP. Additionally, our construction supports a d-strikes-out revocation policy, whereby users who have been subjectively judged to have repeatedly misbehaved at least d times are revoked from the system. Thus, for the first time, it is indeed possible to block anonymous users who have "defaced too many Web pages" using our scheme.
Original languageEnglish
Article number39
JournalACM Transactions on Information and System Security
Volume13
Issue number4
DOIs
Publication statusPublished - 1 Dec 2010
Externally publishedYes

Keywords

  • Anonymous authentication
  • Anonymous blacklisting
  • Privacy
  • Privacy-enhanced revocation
  • User misbehavior

ASJC Scopus subject areas

  • Computer Science(all)
  • Safety, Risk, Reliability and Quality

Cite this