ANONYMOUS TOKEN ENHANCEMENTS
The disclosure provides an approach for anonymous access control. Embodiments include receiving, by a client device C i of a plurality of client devices, from a server, a first table R comprising a plurality of rows. Each row R(j) of the plurality of rows corresponds to a client device C j of the plurality of client devices. Each row R(j) comprises a public encryption key ek j corresponding to the client device C j , a commitment cm j that is based on a token budget t j of the client device C j and a random value r j , and a ciphertext ct j that is an encryption of the random value r j using the public encryption key ek j . Embodiments include generating, by the client device C i , based on the table R, a new table R′ comprising a new plurality of rows. Embodiments include sending R and R′ to the server in association with a request.
1 . A method of anonymous access control, comprising:
receiving, by a client device C i of a plurality of client devices, from a server, a first table R comprising a plurality of rows, wherein each row R(j) of the plurality of rows corresponds to a client device C j of the plurality of client devices, and wherein each row R(j) comprises:
a public encryption key ek j corresponding to the client device C j ;
a commitment cm j that is based on a token budget t j of the client device C j and a random value r j ; and
a ciphertext ct j that is an encryption of the random value r j using the public encryption key ek j ;
generating, by the client device C i , based on the table R, a new table R′ comprising a new plurality of rows, wherein:
each row R′(j) of the new plurality of rows except for row R′(i) corresponds to the client device C j of the plurality of client devices, and wherein each row R′(j) except for row R′(i) comprises:
the public encryption key ek j corresponding to the client device C j ;
a new commitment cm j ′ that is based on zero and a new random value r j ′; and
a new ciphertext ct j that is an encryption of the new random value r j ′ using the public encryption key ek j ; and
the row R′(i) corresponds to the client device C i and comprises:
a public encryption key ek i corresponding to the client device C i ;
an additional commitment cm i ′ that is based on negative one and an additional random value r i ′; and
an additional ciphertext ct i that is an encryption of the additional random value r i ′ using the public encryption key ek i ; and
sending, by the client device C i , the table R and the new table R′ in association with a request to perform an action related to the server for use by the server in determining whether to allow the client device C i to perform the action based on the table R and the new table R′.
2 . The method of claim 1 , further comprising generating, by the client device C i , a zero knowledge proof Z attesting that, for each row n in tables R and R′:
a value committed in cm n is greater by one than a corresponding value indicated by cm n i ′; or
a value committed in cm n is equal to a corresponding value indicated by cm n ′.
3 . The method of claim 2 , further comprising sending, by the client device C i , the zero knowledge proof Z to the server.
4 . The method of claim 3 , wherein the table R, the new table R′, and the zero knowledge proof Z are components of a token used by the server in determining whether to allow the client device C; to perform the action.
5 . The method of claim 2 , further comprising decrypting, by the client device C i , a respective ciphertext ct i included in the table R using a decryption key dk i that is stored by the client device C i in order to determine a respective random value r i .
6 . The method of claim 5 , wherein the zero knowledge proof Z is further based on the respective random value r i .
7 . The method of claim 1 , wherein:
each new commitment cm j ′, including the additional commitment cm i ′, is generated using unlinkable homomorphic commitment; and
each new ciphertext ct j ′, including the additional ciphertext ct i ′, is generated using unlinkable homomorphic encryption.
8 . A system for anonymous access control, the system comprising:
at least one memory; and
at least one processor coupled to the at least one memory, the at least one processor and the at least one memory configured to:
receive, by a client device C i of a plurality of client devices, from a server, a first table R comprising a plurality of rows, wherein each row R(j) of the plurality of rows corresponds to a client device C j of the plurality of client devices, and wherein each row R(j) comprises:
a public encryption key ek j corresponding to the client device C j ;
a commitment cm j that is based on a token budget t j of the client device C j and a random value r j ; and
a ciphertext ct j that is an encryption of the random value r j using the public encryption key ek j ;
generate, by the client device C i , based on the table R, a new table R′ comprising a new plurality of rows, wherein:
each row R′(j) of the new plurality of rows except for row R′(i) corresponds to the client device C j of the plurality of client devices, and wherein each row R′(j) except for row R′(i) comprises:
the public encryption key ek j corresponding to the client device C j ;
a new commitment cm j ′ that is based on zero and a new random value r j ′; and
a new ciphertext ct j that is an encryption of the new random value r j ′ using the public encryption key ek j ; and
the row R′(i) corresponds to the client device C i and comprises:
a public encryption key ek i corresponding to the client device C i ;
an additional commitment cm i ′ that is based on negative one and an additional random value r i ′; and
an additional ciphertext ct i that is an encryption of the additional random value r i ′ using the public encryption key ek i ; and
send, by the client device C i , the table R and the new table R′ in association with a request to perform an action related to the server for use by the server in determining whether to allow the client device C i to perform the action based on the table R and the new table R′.
9 . The system of claim 8 , wherein the at least one processor and the at least one memory are further configured to generate, by the client device C i , a zero knowledge proof Z attesting that, for each row n in tables R and R′:
a value committed in cm n is greater by one than a corresponding value indicated by cm n ′; or
a value committed in cm n is equal to a corresponding value indicated by cm n ′.
10 . The system of claim 9 , wherein the at least one processor and the at least one memory are further configured to send, by the client device C i , the zero knowledge proof Z to the server.
11 . The system of claim 10 , wherein the table R, the new table R′, and the zero knowledge proof Z are components of a token used by the server in determining whether to allow the client device C i to perform the action.
12 . The system of claim 9 , wherein the at least one processor and the at least one memory are further configured to decrypt, by the client device C i , a respective ciphertext ct i included in the table R using a decryption key dk i that is stored by the client device C i in order to determine a respective random value r i .
13 . The system of claim 12 , wherein the zero knowledge proof Z is further based on the respective random value r i .
14 . The system of claim 8 , wherein:
each new commitment cm j ′, including the additional commitment cm i ′, is generated using unlinkable homomorphic commitment; and
each new ciphertext ct j ′, including the additional ciphertext ct i ′, is generated using unlinkable homomorphic encryption.
15 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive, by a client device C i of a plurality of client devices, from a server, a first table R comprising a plurality of rows, wherein each row R(j) of the plurality of rows corresponds to a client device C j of the plurality of client devices, and wherein each row R(j) comprises:
a public encryption key ek j corresponding to the client device C j ;
a commitment cm j that is based on a token budget t j of the client device C j and a random value r j ; and
a ciphertext ct j that is an encryption of the random value r j using the public encryption key ek j ;
generate, by the client device C i , based on the table R, a new table R′ comprising a new plurality of rows, wherein:
each row R′(j) of the new plurality of rows except for row R′(i) corresponds to the client device C j of the plurality of client devices, and wherein each row R′(j) except for row R′(i) comprises:
the public encryption key ek j corresponding to the client device C j ;
a new commitment cm j ′ that is based on zero and a new random value r j ′; and
a new ciphertext ct j that is an encryption of the new random value r j ′ using the public encryption key ek j ; and
the row R′(i) corresponds to the client device C i and comprises:
a public encryption key ek i corresponding to the client device C i ;
an additional commitment cm i ′ that is based on negative one and an additional random value r i ′; and
an additional ciphertext ct i that is an encryption of the additional random value r i ′ using the public encryption key ek i ; and
send, by the client device C i , the table R and the new table R′ in association with a request to perform an action related to the server for use by the server in determining whether to allow the client device C i to perform the action based on the table R and the new table R′.
16 . The non-transitory computer-readable medium of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to generate, by the client device C i , a zero knowledge proof Z attesting that, for each row n in tables R and R′:
a value committed in cm n is greater by one than a corresponding value indicated by cm n ′; or
a value committed in cm n is equal to a corresponding value indicated by cm n ′.
17 . The non-transitory computer-readable of claim 16 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to send, by the client device C i , the zero knowledge proof Z to the server.
18 . The non-transitory computer-readable of claim 17 , wherein the table R, the new table R′, and the zero knowledge proof Z are components of a token used by the server in determining whether to allow the client device C i to perform the action.
19 . The non-transitory computer-readable of claim 16 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to decrypt, by the client device C i , a respective ciphertext ct i included in the table R using a decryption key dk i that is stored by the client device C i in order to determine a respective random value r i .
20 . The non-transitory computer-readable of claim 19 , wherein the zero knowledge proof Z is further based on the respective random value r i .