PIMA: A Privacy-preserving Identity management system based on an unlinkable MAlleable signature

Souha Masmoudi, Maryline Laurent and Nesrine Kaaniche
"Journal of Network and Computer Applications, Volume 208, December 2022, DOI:10.1016/j.jnca.2022.103517"

This paper presents a privacy-preserving identity management system, referred to as PIMA. The proposed system is built over a novel unlinkable malleable signature scheme, called UMS. PIMA supports pseudonymity, as it is more in line with today's web service interactions than anonymity. The originality of the approach is manifold. First, PIMA satisfies both users' and providers' basic security and privacy needs as it provides a user centric approach which permits the users to keep control over their revealed attributes, and the service providers to get attributes certified by an identity provider and associated with different pseudonymous sessions. Second, PIMA helps service providers to comply with the data minimization principle required by the E.U. General Data Protection Regulation, through the enforcement of both sanitizable and redactable features. Third, the proposed signature scheme fulfills main security and strong privacy requirements at a constant pairing computation overhead. Fourth, PIMA's concrete construction is proven as secure under the generic group model. Fifth, the implementation results demonstrate high efficiency w.r.t. most closely related work, while considering resource-constrained devices, i.e., Android-10 smartphone.

Publication:
PIMA: A Privacy-preserving Identity management system based on an unlinkable MAlleable signature
Type:
Journal
Date:
December 2022
Source Code:
PIMA Source Code
Communications:
Une gestion des identités placée sous le contrôle des individus : une certification sous pseudonymat
Funded by:
The Chair Values and Policies of Personal Information (VP-IP)