Cryptology ePrint Archive: Report 2008/474

Controlling Access to an Oblivious Database using Stateful Anonymous Credentials

Scott Coull and Matthew Green and Susan Hohenberger

Abstract: In this work, we consider the task of allowing a content provider to enforce complex access control policies on oblivious protocols conducted with anonymous users. As our primary application, we show how to construct privacy-preserving databases by combining oblivious transfer with an augmented anonymous credential system. This permits a database operator to restrict which items each user may access, without learning anything about users' identities or item choices. This strong privacy guarantee holds even when users are assigned different access control policies and are allowed to adaptively make many queries. Our system is based on standard assumptions in the standard model and, after an initial setup phase, each transaction requires only constant time.

As a main building block of our work, we show how to augment existing anonymous credential systems so that, in addition to certifying a user's attributes, they also store state about a user's access history, which is updated with each use of the credential. In addition to adaptive oblivious transfer, we show that stateful anonymous credentials can be efficiently coupled with protocols for blind signatures and oblivious keyword search to privately control access on these requests. Our construction supports a wide range of access control policies, including efficient and private realizations of the Brewer-Nash (Chinese Wall) and Bell-LaPadula (Multilevel Security) policies, which are used for financial and defense applications. Overall, our stateful anonymous credential system provides a balance between the seemingly conflicting goals of access control and user privacy.

Category / Keywords: oblivious transfer, anonymous credentials, privacy

Date: received 10 Nov 2008

Contact author: mgreen at cs jhu edu

Available formats: PDF | BibTeX Citation

Version: 20081118:204547 (All versions of this report)

Discussion forum: Show discussion | Start new discussion