Optimal Key-Trees for Tree-Based Private Authentication

Abstract

Abstract. Key-tree based private authentication has been proposed by Molnar and Wagner as a neat way to efficiently solve the problem of privacy preserving authentication based on symmetric key cryptography. However, in the key-tree based approach, the level of privacy provided by the system to its members may decrease considerably if some members are compromised. In this paper, we analyze this problem, and show that careful design of the tree can help to minimize this loss of privacy. First, we introduce a benchmark metric for measuring the resistance of the system to a single compromised member. This metric is based on the well-known concept of anonymity sets. Then, we show how the parameters of the key-tree should be chosen in order to maximize the system's resistance to single member compromise under some constraints on the authentication delay. In the general case, when any member can be compromised, we give a lower bound on the level of privacy provided by the system. We also present some simulation results that show that this lower bound is quite sharp. The results of this paper can be directly used by system designers to construct optimal key-trees in practice; indeed, we consider this as the main contribution of our work.

Improved Anonymity for Key-Trees

“…We will refer to such trees as "Buttyán trees", and to trees with a constant branching factor as "Classic trees". Buttyán et al in [4] reach the conclusion that the branching factors near the root contribute more toS and R. For trees with variable branching factors this means that a deep, top heavy Buttyán tree can potentially outperform a shallow classic tree.…”

“…A paper of particular interest is by Buttyán et al [4], where the concept of trees with variable branching factors is introduced, to better preserve anonymity in case of attack. Our work provides an optimization of Buttyán's solution.…”

“…Theorem 1 rephrases Buttyán's notion of an optimal R(B) using the term "lexicographically largest"; the proof for the original version can be found in [4]. …”

“…Buttyán notes that computingS − is hard, and therefore suggests an alternative measure: Although not stated explicitly in [4], this worst-case value is attained in (any of) the most uniform distributions of c compromised tags across T .…”

A comprehensive RFID solution to enhance inpatient medication safety

“…Solutions based on the use of pseudonyms -anonymized versions of the static identifiers -present the drawback of needing an exhaustive search in the back-end database [5]. However, our approach does not suffer from this disadvantage, since we have the advantage of knowing in advance which specific tags (i.e.…”