Cascaded Authorization with Anonymous-Signer Aggregate Signatures Danfeng Yao, Roberto Tamassia
Total Page:16
File Type:pdf, Size:1020Kb
Proceedings of the 2006 IEEE Workshop on Information Assurance United States Military Academy, West Point, NY, 21-23 June 2006 Cascaded Authorization with Anonymous-Signer Aggregate Signatures Danfeng Yao, Roberto Tamassia Abstract— For privacy concerns, the identity of a user or an au- We introduce a decentralized trust management model thorizer may be sensitive information in e-commerce, e- called anonymous role-based cascaded delegation. In this medicine, or peer-to-peer file-sharing (e.g., Kazaa) appli- model, a delegator can issue authorizations on behalf of her role without revealing her identity. This type of delegation cations. An authorizor may not want to reveal his or her protects the sensitive membership information of a delega- identity and role membership at each authorization or au- tor and hides the internal structure of an organization. To thentication. In addition, organizations may want to hide provide an efficient storage and transmission mechanism for credentials used in anonymous role-based cascaded delega- their internal structures from the outside world. tion, we present a new signature scheme that supports both To address these privacy concerns, an anonymous role- signer anonymity and signature aggregation. Our scheme based delegation protocol can be implemented with group has compact role signatures that make it especially suitable for ubiquitous computing environments, where users may signatures, in which a signature proves the membership of a have mobile computing devices with narrow communication signer without revealing the identity [17]. The anonymous bandwidth and small storage units. signing feature of group signatures is particularly suitable for role-based delegation, because what is essential to ver- Keywords: Delegation, anonymity, aggregate signature ifying a delegation credential is the proof of the delega- I. Introduction tor’s role membership, rather than the identity. A role- based delegation protocol implemented using group signa- Authorization is an important concept of the resource ture schemes is not only scalable due to the use of roles, but sharing in open and collaborative environments such as also has strong privacy protection provided by the group Grid systems or the Internet. In role-based trust man- signature schemes. agement [21], [26], privileges are associated with roles and A practical concern about group signatures is their ef- each user is assigned one or more roles. Role members ficiency in a distributed environment. Next, we introduce prove their memberships with public keys and digital cre- the technique of aggregate signatures and explain the need dentials. Role-based delegation is important in decentral- for a signature scheme that supports both anonymous sign- ized role-based trust management for transferring privi- ing and signature aggregation. leges and sharing resources among role members that are initially unknown to each other. A delegation credential is A. Credential size and aggregate signatures a digital certificate signed by a delegator on a statement Lengthy digital credentials are inefficient to transmit and that gives authorizations to delegatees. In role-based del- store. In decentralized trust management systems [22], egation models [22], [26], a member E of role r is allowed [26], a delegation chain represents how trust or a delegated to delegate privileges associated with r to other roles by privilege is transferred from one user to another. The chain issuing delegation credentials. In order to delegate, the contains a sequence of delegation credentials that connects member E has to show his role membership by revealing unknown entities and resource owners. The number of his role credential. credentials required to authenticate a delegation chain is For example, in a collaborative environment, hospital H linear in the length of the chain. Credentials associated delegates its role guest to the role consultant at company P with a delegation chain need to be compact, because mo- in a credential C. John is a member of the role consultant bile devices may have limited storage units and bandwidth. at company P and has the corresponding role credential R. Aggregate signatures [9], [23] are an effective solution John may further delegate the role guest at H to the role for shortening credential size. Namely, multiple signatures professor at university U in a credential C0. Credentials C, 0 on different messages can be aggregated into one signature R, and C constitute the delegation credential for the role of constant size. An interesting question is how to obtain professor at U, and prove the validity of the authorzation. an aggregate signature scheme that supports anonymous signing in role-based authorization. Desirable properties of This work was supported in part by NSF grants CCF–0311510, such a signature scheme include anonymity, unlinkability, CNS–0303577 and IIS–0324846. Computer Science Department, Brown University, Providence, RI and revocability, and aggregation. In on-line banking appli- 02912, {dyao, rt}@cs.brown.edu cations for example, certain transaction can be approved ISBN 1-4244-0130-5/06/ $20.00 c 2006 IEEE 1 only if it is signed sequentially by a member of the role grates the long-term private key of a signer with a random cashier, a member of the role accountant, and a member of blinding factor. Using this special signing key, a role mem- the role manager. Each signature can be generated with- ber cannot deny a signature when revoked anonymity; yet, out disclosing the signer’s identity for privacy protection, the role manager cannot misattribute a signature to any and then be aggregated to existing ones. role member. By leveraging signature aggregation [9], the In this paper, we present an anonymous-signer aggre- length of a role signature can be as short as 170 bits with gate signature scheme that supports both anonymity and security equivalent to a 1024-bit RSA signature. A role aggregation by designing a special kind of cryptographic signature along with the public information needed for ver- key pair. The unique feature of the key is that it contains ification is only 510 bits or 64 bytes long. Role members the identity information of a role member, yet it is un- can join and leave at any time, without requiring existing linkable. In other words, the seemingly random key used members to perform any update. for signing cannot be forged by a role manager, as it con- In an anonymous-signer aggregate signature scheme, in- tains the long term secret key of a role member, which is dividual role signatures that may be generated by mem- not known to the manager. We are able to achieve this bers of different roles can be aggregated into one signature by leveraging properties of a bilinear map, which was first of constant length. Even if a signature is aggregated with used in the identity-based encryption scheme of Boneh and other signatures, a role manager can trace the signer by Franklin [8]. showing a proof. The security is based on the security In the following, we briefly introduce the role-based cas- of the aggregate signature scheme [9]. Because of one-time caded delegation (RBCD) protocol [26], [28]. RBCD pro- public keys, the asymptotic growth of our signatures is still tocol is extended in this paper to support anonymity using linear in the number of individual signatures. Nevertheless, the anonymous-signer aggregate signature scheme. signature aggregation can significantly reduce the length of multiple signatures. A discussion on the efficiency of the B. Role-based cascaded delegation scheme is given in Section V. A large amount of work has been done on trust man- We describe how anonymous-signer aggregate signatures agement and distributed authorization systems [1], [3], [6], can be used to realize an anonymous and efficient role- [19], [21]. Among them, role-based cascaded delegation based authorization protocol, where a delegator issues del- [26] is an efficient role-based trust management model that egation credentials and proves role membership without supports administrator-free delegation. Administrator-free disclosing the identity. Although anonymous RBCD can delegation allows an individual role member to issue dele- be realized with any group signature scheme, using our gations without the participation of a role administrator. It anonymous-signer aggregate signature scheme allows the enables flexible and dynamic authorization in a decentral- compression of delegation credentials and significantly im- ized environment. It comprises four operations: Initiate, proves the efficiency. Delegation certificates in RBCD are Extend, Prove, and Verify. Initiate and Extend are issued to roles, rather than individual role members. For used by a resource owner and an intermediate delegator, re- example, a privilege is delegated to the role doctor at a spectively, to delegate a privilege to a role. Prove is used hospital. by a requester to produce a proof of a delegation chain that Note that the RBCD protocol does not require a hier- connects the resource owner with the requester. Verify archical generalization of our signature scheme, and does decides whether the requester is granted the access based not require the (expensive) hierarchical certification of one- on the proof. time signing keys. In RBCD [26], a delegation credential includes role mem- Finally, we point out that anonymous role-based dele- bership certificates of each intermediate delegator, and del- gation implemented with anonymous-signer aggregate sig- egation extension credentials that are proofs of delegation natures gives rise to a proxy signature scheme for groups, transactions signed by delegators. Credentials associated which may be of separate interest. In this scheme, an origi- with a delegation chain are transmitted to delegated role nal signer E serves as a delegator, and delegates the signing members at each delegation transaction. Therefore, for a power to a certain group G of proxy signers by issuing a delegation chain of length n, the number of certificates re- delegation certificate. Each of the proxy signers can sign quired to verify the delegation path is 2n.