Identity fraud (IDF) may be defined informally as exploitation of credential information using some form of impersonation or misrepresentation of identity, in the context of transactions. Thus, IDF may be viewed as a combination of two old problems: user authentication and transaction authorization. We propose an innovative approach to detect IDF attempts, by combining av-certificates (digitally-signed audiovisual recordings in which users identify themselves) with av-signatures (audiovisual recordings showing users' explicit consent for unique transaction details). Av-certificates may be used in on-site transactions, to confirm user identity. In the case of remote (e.g. web-based) transactions, both av-certificates and av-signatures may be used to authenticate users and verify their consent for transaction details. Conventional impersonation attacks, whereby credentials (e.g. passwords, biometrics, or signing keys) are used without the consent of their legitimate users, fail against VideoTicket. The proposed solution assumes that identity thieves have access to such credentials.Public Key Setup. B generates for itself a signaturerelated public-private key pair (eB, dB), and V obtains an authentic copy of eB. If R = V , R and V may also obtain authentic copies of each other's signature and encryptionrelated public keys to realize authenticated, confidentialityprotected, and integrity-protected communication channels between them.
Replay-Protection Setup. V creates a table EV (used inStep 4 of Section 2.3) to detect replay attacks. EV contains