WO2010034507A1

WO2010034507A1 - Method for supporting secure authentication of a user using a smartcard

Info

Publication number: WO2010034507A1
Application number: PCT/EP2009/006945
Authority: WO
Inventors: Joao Girao; Christoph Sorge; Dirk Westhoff
Original assignee: Nec Europe Ltd.
Priority date: 2008-09-25
Filing date: 2009-09-25
Publication date: 2010-04-01

Abstract

A method for supporting secure authentication of a user using a smartcard, in particular an electronic identity (elD) card, said smartcard storing a secret identifier and being issued by a trusted issuer, said secret identifier being uniquely assigned to said user, wherein a pseudonym is generated on said smartcard, said pseudonym being based on said secret identifier, is characterized by the steps of generating a signature for said pseudonym, said signature being generated on said smartcard and being based on a group signature scheme, transmitting said pseudonym and said signature to a service provider, and verifying said pseudonym by checking said signature using one or several group public keys, wherein at said verification step the identity of said user cannot be revealed.

Description

METHOD FOR SUPPORTING SECURE AUTHENTICATION OF A USER USING A SMARTCARD

The present invention relates to a method for supporting secure authentication of a user using a smartcard, in particular an electronic identity (elD) card, said smartcard storing a secret identifier and being issued by a trusted issuer, said secret identifier being uniquely assigned to said user, wherein a pseudonym is generated on said smartcard, said pseudonym being based on said secret identifier.

In recent years several smartcard based authentication systems evolved. Smart- cards are pocket-sized cards with embedded integrated circuits. They can store data, receive input data, process data and generate an output generally based on input data. Many smartcards provide storage area which can only be read using the embedded integrated circuit, generally a processor. Thus, this memory area can store private information which can only be read, if for instance a correct passphrase is provided. For some data, output might be completely prevented. This data can only be read and used at processing data on the smartcard, e.g. at generation of a signature or encrypted data.

Smartcard functionality is currently added to identity cards, thus forming electronic identity (elD) cards. In several countries these elD cards have been introduced or will be introduced shortly. With these cards, citizens can authenticate to electronic services (like music download services) or prove that they have a certain attribute (for instance they life in a certain city or they are more than 18 years old). One benefit is that the service provider can recognize a user when he/she accesses its services. However, at using the same unique identifier provided by the smartcards with several service providers, these different service provider could merge their data bases and build a profile of the users. This violates privacy of the users.

The Austrian elD solution ("Bϋrgerkarte") addresses this problem by generating pseudonyms on the card. The pseudonyms are created using a hash function, receiving as input both a secret key stored on the card and a unique identifier of the service provider. In this way, a service provider can recognize a user, as the user always accesses to its services using the same pseudonym. As the pseudonyms are different for different service providers, linking of pseudonyms is not possible and building of a profile of the users is prevented.

However, even this approach is problematic, if authentication of the pseudonym should be provided. In case of user authentication, a signature is generated based on a card secrete identifier stored in the smartcard. At many systems of the art, this key is only used for establishing a communication channel to the service provider and after authentication the received signature is deleted. However, as the signature can be related unambiguously to a specific user, this approach offers information that can be abused by service providers. Service providers can store the public key and use it as a unique identifier breaking the unlinkability provided by the pseudonym. As such, the privacy protection provided by the pseudonym generation is rendered inert when authentication schemes are used.

It is therefore an object of the present invention to improve and further develop a method of the initially described type which provides authentication of a user without transmitting information which is unambiguously linked to this user.

In accordance with the invention, the aforementioned object is accomplished by a method comprising the features of claim 1. According to this claim, such a method is characterized by the steps of generating a signature for said pseudonym, said signature being generated on said smartcard and being based on a group signature scheme, transmitting said pseudonym and said signature to a service provider, and verifying said pseudonym by checking said signature using one or several group public keys, wherein at said verification step the identity of said user cannot be revealed.

According to the invention and in contrast to the methods of the art it has first been recognized that for authentication of a user using a smartcard unique association of a signature to a user is not necessary. According to methods of the art, each signature provided at smartcards is unambiguously linked to a user, as this is regarded to improve the authentication. However, in this context and according to the invention it is sufficient to know that the information to which the authenticating signature refers is generated by a trusted smartcard. At the method concerning the invention, the service provider receives a pseudonym from the smartcard which was generated based on the secret identifier stored on the smartcard. This secret identifier cannot be changed after programming into the smartcard by the trusted issuer of the smartcard. If the service provider receives this pseudonym and can be sure that this pseudonym was generated by a trusted smartcard, authentication does not have to provide a link to a particular user. In fact it is sufficient to authenticate the smartcard as being trusted in order to authenticate the pseudonym.

According to the invention the signature for the pseudonym is generated based on a group signature scheme. Group signature schemes allow generating of signatures by the members of the group and verification of the signature using the group public key. At verifying the signature, it can be ensured that the signature was generated by one of the members of the group, but the identity of the user cannot be revealed. At using the group signature scheme, in a first step a signature for the pseudonym is generated on the smartcard based on the group signature scheme. The pseudonym and the signature are transmitted to the service provider. The service provider verifies the pseudonym by checking the signature using one or several group public keys, depending on the used group signature scheme. By doing so, the service provider can ensure that the pseudonym was generated and sent by a trusted smartcard. If the pseudonym would not be generated on the smartcard, the verification of the pseudonym and a signature would fail. Thus, the method concerning to the invention provides a secure authentication.

The term "group signature scheme" refers to each signature scheme, where a valid group signature can be generated by one of its members and one or several public group keys are sufficient to ensure the membership of the member. One possibility of such a group signature scheme was published by Chaum & van Heyst in 1991. Other group signature schemes were published for instance by Camenisch & Michels in November 1998. Also ring signature schemes can be used in combination with the method according to the invention. Typically, group signature schemes include the possibility for one specific entity, the group manager, to identify the signer. At ring signatures schemes, a signature is generated based on the transmitted message, the private key of the signing user and each public key of the other members of the group; there is no need for prearranged groups, as the group can be formed ad hoc using the public keys of its members. At verification of these signatures, the public keys of each member of the group, the message and the signature are checked. If the ring signature is properly computed, the test is passed. However, it is not possible for anyone to reveal the identity of the user who generated the signature. It should be understood that this signature scheme is also within the scope of the appended claims.

Further, is should be understood that the pseudonym can be each piece of information which is generated by the smartcard based on the secret identifier (which may be identical to a cryptographic private key) of the user. Although the pseudonym as described in connection with the Austrian elD card and this kind of elD is one of the preferred embodiments of the invention, it is obvious to those skilled in the art that other pieces of information can be used as well. It is just important that the piece of information is based on a secret identifier, or key, of the user.

One possibility of generating the pseudonym can be combining a random number generated on the smartcard with the secret identifier. As the pseudonym has to be the same at each connection of the smartcard to a specific service provider, the pseudonym may be stored in a table which links the single service providers to the respective pseudonyms. This table is preferably stored in a memory space of the smartcard. As the pseudonym is generated on the smartcard using the secrete identifier of the user, the pseudonym and its signature can be trusted in cases the signature is recognized as being correct.

Another possibility includes generation of the pseudonym further based on a public identifier of the service provider. This public identifier can be generated once and be stored on a remote webserver. If a pseudonym should be generated, the public identifier can be retrieved from this webserver and be passed to the smartcard for generation of the pseudonym. The pseudonym is then generated on the smartcard using the secret identifier of the user and the public identifier of the service provider.

Preferably, the signature for the pseudonym is generated on the smartcard based on a card private key. This card private key is integrated in a group signature scheme, i.e. each signature being generated based on the card private key using the group signature scheme can be verified using one or several group public keys. With most group signature schemes one group public key is sufficient. When using ring signature schemes, several public keys from the group are necessary. The card private key can be stored similarly as the generic secret identifier in a smartcard memory space which cannot be accessed directly through the I/O pin(s) of the smartcard. Each access to this memory space is controlled by the integrated circuit of the smartcard.

Preferably, the single keys necessary for the group signature scheme are generated when issuing the smartcards using a setup-function provided by the group signature scheme. At the setup of the group signature, one or several card private keys are generated as well as the group public key(s). There are group signature schemes known in the art which allow for the creation of very large groups. Even in context of using the smartcards as el D cards, it is possible for all users of the elD card solution to be member of just one group. Alternatively, the set of users can be split up into smaller groups, provided they are large enough to ensure user's anonymity. Users living in a certain area or a certain city can form a group.

In order to keep the method according to the invention flexible, the used group signature function may provide a join-function which allows generating and integrating new card private keys in already setup groups. Thus, the issuer of smartcards can always add new cards to a group which provides a flexible usage of the system. The group signature scheme works nevertheless.

In case of an abuse of the system, the group signature scheme may provide an open-function which allows revealing the user's identity. The access to the open- function can be restricted to certain entities. In order to remove smartcards from one group, a revocation-function might be provided at the group signature scheme. The revocation function allows revoking a card private key by the issuer. After revocation of the card private key, the verification of a signature based on the card private key fails. The smartcard is no longer able to generate valid signatures for this group.

At the setup of the group and depending on the used group signature scheme, a membership manager and a revocation manager can be established (instead of a single group manager). Both receive specific keys which are needed to perform administrative tasks within the group. A membership manager is capable of adding new members or of revealing the identity of a member in case of abuse of the signature. The revocation manager is capable of revoking a card private key of a user. The membership manager and the revocation manager can be one entity and can use the same private key.

Each user may be member of several groups. For this reason, the smartcard might provide several card private keys for the membership of several groups. The different keys might also refer to different group signature schemes.

Before transmitting the pseudonym to the service provider, the smartcard and the service provider might establish a secure communication channel. This secure communication channel then may be used for communication between the service provider and the smartcard. The secure communication channel can be used for transmitting the pseudonym to the service provider. Besides that, the smartcard can supply the service provider with a set of user attributes through this secure communication channel. Examples for such user attributes include the citizenship of the user, the city or the address of the user, or even the size of the user. The user attributes are preferably stored in a memory area of the smartcard. The secure communication channel may be based on a Secure Socket Layer (SSL) or on Transport Layer Security (TSL).

There are several ways how to design and further develop the teaching of the present invention in an advantageous way. To this end it is to be referred to the patent claims subordinate to patent claim 1 on the one hand and to the following explanation of a preferred embodiment of the invention by way of example, illustrated by the figure on the other hand. In connection with the explanation of the preferred embodiment of the invention by the aid of the figure, generally preferred embodiments and further developments of the teaching will we explained. In the drawing

Fig. 1 is a block diagram showing generation and unauthenticated transmission of a pseudonym according to the method of the art,

Fig. 2 is a block diagram showing generation and authenticated transmission of a pseudonym according to the method of the art, and

Fig. 3 is a block diagram which refers to a preferred embodiment of a method according to the invention.

Fig. 1 is a block diagram which shows a method as used (in principle) at the Austrian elD card. A secret identifier for the user - the secret identifier - is stored on the elD card of the user. The elD card is a special smartcard issued by a trusted issuer (generally a bank institute) for a particular citizen (the user) who can authenticate using this elD card. At generating a pseudonym which is used at a service provider, a public identifier for the service provider is combined with the secret identifier of the user. This leads to an unambiguous pseudonym P which allows recognizing the user but which is different for each service provider connected in this way. The pseudonym P generated in this manner is transmitted to the service provider using unauthenticated transmission. At the service provider, the pseudonym P is recognized and used for the services of the service provider, e.g. identifying a user at a music download portal.

Fig. 2 shows a block diagram referring to authenticated transmission of the pseudonym to a user as suggested in the art. The pseudonym P is again generated using the secret identifier of the user and the public identifier for the service provider. This is performed on the el D card as well as the generation of a signature for the pseudonym P. At generating the signature, a card private key is used which is unique for the particular el D card. The card private key is linked uniquely to a card public key which is used at checking of the signature. The pseudonym P and its signature are transmitted to a service provider which uses the signature for authentication of the user. Therefore, the card public key is combined with a signature of the pseudonym. In case the signature is proven to be correct, the pseudonym P may be recognized and used for providing services of that service provider. Generally, it is expected, that the service provider does not store the card public key and does not use the information for tracking the user's habits. However, a technical possibility is given which breaks the unlinkability of the pseudonyms P for different service providers.

Fig. 3 shows a method according to the invention which solves this problem. This method allows verifying that a transmitted signature is generated by a valid el D card. By doing so authentication of the signature is possible, but a link to the user generating the signature is prevented. The pseudonym P is again generated using the secret identifier of the user and the public identifier of the service provider. For the pseudonym P a signature is generated using a card private key. However, in contrast to the method of the art, this card private key is a key of a group signature scheme which is linked to a group public key. This group public key is shared by many cards and thus by many users. The group signature scheme allows authentication of the signature without allowing a link to a specific user.

The pseudonym P and its signature are transmitted to the service provider preferably (but not necessarily) using a secure communication channel based on SSL or TLS. At the service provider, the group signature is checked using the group public key to which the user generating the signature belongs. After passing the group signature check, the membership of the user to the specific group is verified. As the group signature is generated by a smartcard which is issued by a trusted issuer, the smartcard itself generating the signature can be trusted. Thus, the pseudonym P generated on the smartcard using the secret identifier of the user can be trusted as well. By the combination of the group signature for signing and the secret identifier of the user for generating a piece of information to be authenticated, both the user and the piece of information are authenticated. As a group signature scheme generally does not reveal the identity of the user who generated the group signature, linkability of an elD card at several service providers is prevented technically. Thus, security and privacy of a user can be guaranteed using technical means.

In the following an example usage scenario is described for further improving understanding of the invention. A user has received an elD card from the local issuing authority. The user now accesses the library's website and orders a set of books to read at home. The library requires a proof that the user is a local. The user fills in the form and his el D card gives out the proof that the user is a local based on a pseudonym generated for the library. When the user returns the book, he'll associate the return with that same pseudonym, thanks to his/her el D card. The transactions with pseudonyms will be secured by the fact that the card will prove that it is a correctly issued card without revealing the user's identity. The card will use a group signature to sign over the newly generated pseudonym. In a similar way, the card can prove that the user is a local resident by signing other information with that same group signature. Should the user try to steal the book, the Library can contact the issuing authority (e.g. the local government) to break the anonymity provided by the group digital signature (using the open function) and reveal the user under that pseudonym, if a group signature scheme with such an open function has been applied.

Many modifications and other embodiments of the invention set forth herein will come to mind the one skilled in the art to which the invention pertains having the benefit of the teachings presented in the foregoing description and the associated drawings. Therefore, it is to be understood that the invention is not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims

C l a i m s

1. Method for supporting secure authentication of a user using a smartcard, in particular an electronic identity (elD) card, said smartcard storing a secret identifier and being issued by a trusted issuer, said secret identifier being uniquely assigned to said user, wherein a pseudonym is generated on said smartcard, said pseudonym being based on said secret identifier, c h a r a c t e r i z e d b y the steps of generating a signature for said pseudonym, said signature being generated on said smartcard and being based on a group signature scheme, transmitting said pseudonym and said signature to a service provider, and verifying said pseudonym by checking said signature using one or several group public keys, wherein at said verification step the identity of said user cannot be revealed.

2. Method according to claim 1 , wherein said pseudonym is generated further based on a public identifier of said service provider.

3. Method according to claim 1 or 2, wherein said signature is generated based on a card private key, said card private key being integrated in said group signature scheme.

4. Method according to claim 3, wherein said group public key and said card private key being generated using a setup-function of said group signature scheme.

5. Method according to claim 3 or 4, wherein said card private key is generated and integrated in said group signature scheme by said issuer using a join-function of said group signature scheme.

6. Method according to any of claims 3 to 5, wherein said group signature scheme provides an open-function, said open function revealing the identity of said user.

7. Method according to any of claims 3 to 6, wherein said group signature scheme provides a revocation-function, said revocation-function allowing revocation of a card private key by said issuer, wherein after revocation of said card private key said step of verification fails.

8. Method according to any of claims 1 to 7, further comprising the step of setting up a secure communication channel between said smartcard and said service provider, said secure communication channel being used for communication between said service provider and said smartcard.

9. Method according to claim 8, wherein said secure communication channel is used for transmitting said pseudonym to said service provider.

10. Method according to claim 8 or claim 9, wherein said secure communication channel is used for transmitting user attributes of said user of said smartcard.

11. Method according to any of claims 8 to 10, wherein said secure communication channel is based on SSL (Secure Socket Layer) or TLS (Transport Layer Security).