Logo image
Back
Group Time-based One-time Passwords and its Application to Efficient Privacy-Preserving Proof of Location
Conference proceeding

Group Time-based One-time Passwords and its Application to Efficient Privacy-Preserving Proof of Location

Zheng Yang, Chenglu Jin, Jianting Ning, Zengpeng Li, Anh Dinh, Jianying Zhou and ACM
Annual Computer Security Applications Conference, pp.497-512
ACM Other Conferences
ACSAC '21: Annual Computer Security Applications Conference
06/12/2021
DOI: https://doi.org/10.1145/3485832.3488009

Abstract

Security and privacy Security and privacy -- Cryptography Security and privacy -- Cryptography -- Symmetric cryptography and hash functions Security and privacy -- Network security Security and privacy -- Network security -- Security protocols Security and privacy -- Security services Security and privacy -- Security services -- Authentication Security and privacy -- Security services -- Privacy-preserving protocols Security and privacy -- Security services -- Pseudonymity, anonymity and untraceability Security and privacy -- Systems security Security and privacy -- Systems security -- Operating systems security
Time-based One-Time Password (TOTP) provides a strong second factor for user authentication. In TOTP, a prover authenticates to a verifier by using the current time and a secret key to generate an authentication token (or password) which is valid for a short time period. Our goal is to extend TOTP to the group setting, and to provide both authentication and privacy. To this end, we introduce a new authentication scheme, called Group TOTP (GTOTP), that allows the prover to prove that it is a member of an authenticated group without revealing its identity. We propose a novel construction that transforms any asymmetric TOTP scheme into a GTOTP scheme. Our approach combines Merkle tree and Bloom filter to reduce the verifier’s states to constant sizes. As a promising application of GTOTP, we show that GTOTP can be used to construct an efficient privacy-preserving Proof of Location (PoL) scheme. We utilize a commitment protocol, a privacy-preserving location proximity scheme, and our GTOTP scheme to build the PoL scheme, in which GTOTP is used not only for user authentication but also as a tool to glue up other building blocks. In the PoL scheme, with the help of some witnesses, a user can prove its location to a verifier, while ensuring the identity and location privacy of both the prover and witnesses. Our PoL scheme outperforms the alternatives based on group digital signatures. We evaluate our schemes on Raspberry Pi hardware, and demonstrate that they achieve practical performance. In particular, the password generation and verification time are in the order of microseconds and milliseconds, respectively, while the computation time of proof generation is less than 1 second.

Metrics

1 Record Views

Details

Logo image