P4TC—Provably-Secure yet Practical Privacy-Preserving Toll Collection

Fetzer, Valerie; Hoffmann, Max; Nagel, Matthias; Rupp, Andy; Schwerdt, Rebecca

doi:10.2478/popets-2020-0046

Cited by 9 publications

(7 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most (partially) blind signature schemes in fact satisfy both of them. This is in particular the case 10 for the schemes of Abe and Okamoto [2,20] (but not for the blind signature scheme underlying the Idemix attribute based credential scheme [18,4]).…”

Section: Two Faces Of Blindness Chaum Explained Blind Signatures Intu...mentioning

confidence: 99%

“…Details will vary depending on the particular blind signature scheme used. 10 The (partial) blindness property is defined using a game where two messages m 0 and m 1 are randomly assigned to two users (based on a random bit b). Each user then requests a blind signature on its message from the signer.…”

Section: Dealing With Failuresmentioning

confidence: 99%

“…In this paper we focus on the privacy issues in e-ticketing for public transport. This problem has been studied in the past for e-ticketing in particular [15,16], but also for related problems like electronic toll collection systems [10] or more general road pricing systems [17]. Compared to the work of Heydt-Benjamin et al [15,16] (which relies on anonymous e-cash and anonymous credentials as building blocks) we use (partially) blind signatures instead to create either unlinkable travel tickets or unlinkable travel credit.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Privacy Friendly E-Ticketing For Public Transport

Hoepman¹

2021

Preprint

View full text Add to dashboard Cite

This paper studies how to implement a privacy friendly form of ticketing for public transport in practice. The protocols described are inspired by current (privacy invasive) public transport ticketing systems used around the world. The first protocol emulates paper based tickets. The second protocol implements a pay-as-you-go approach, with fares determined when users check-in and check-out. Both protocols assume the use of a smart phone as the main user device to store tickets or travel credit. We see this research as a step towards investigating how to design commonly used infrastructure in a privacy friendly manner in practice, paying particular attention to how to deal with failures.

show abstract

Section: Two Faces Of Blindness Chaum Explained Blind Signatures Intu...mentioning

confidence: 99%

Section: Dealing With Failuresmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Privacy Friendly E-Ticketing For Public Transport

Hoepman¹

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…PPETC leaking minimal information. To address these issues, several privacy-preserving ETC (PPETC) schemes have been proposed so far, e.g., [2,10,15,31,34] (cf. Section 10 for an overview).…”

Section: Introductionmentioning

confidence: 99%

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Adavoudi Jolfaei,

Rupp,

Schiffner

et al. 2024

PoPETs

View full text Add to dashboard Cite

The use of Electronic Toll Collection (ETC) systems is on the rise, as these systems have a significant impact on reducing operational costs. Toll service providers (TSPs) access various information, including drivers' IDs and monthly toll fees, to bill drivers. While this is legitimate, such information could be misused for other purposes violating drivers' privacy, most prominent, to infer drivers' movement patterns. To this end, privacy-preserving ETC (PPETC) schemes have been designed to minimize the amount of information leaked while still allowing drivers to be charged. We demonstrate that merely applying such PPETC schemes to current ETC infrastructures may not ensure privacy. This is due to the (inevitable) minimal information leakage, such as monthly toll fees, which can potentially result in a privacy breach when combined with additional background information, such as road maps and statistical data. To show this, we provide a counterexample using the case study of Brisbane's ETC system. We present two attacks: the first, being a variant of the presence disclosure attack, tries to disclose the toll stations visited by a driver during a billing period as well as the frequency of visits. The second, being a stronger attack, aims to discover cycles of toll stations (e.g., the ones passed during a commute from home to work and back) and their frequencies. We evaluate the success rates of our attacks using real parameters and statistics from Brisbane's ETC system. In one scenario, the success rate of our toll station disclosure attack can be as high as 94%. This scenario affects about 61% of drivers. In the same scenario, our cycle disclosure attack can achieve a success rate of 51%. It is remarkable that these high success rates can be achieved by only using minimal information as input, which is, e.g., available to a driver's payment service provider or bank, and by following very simple attack strategies without exploiting optimizations. As a further contribution, we analyze how the choice of various parameters, such as the set of toll rates, the number of toll stations, and the billing period length, impact a driver's privacy level regarding our attacks.

show abstract

“…Examples include -auctions (protecting the bids' confidentiality) [8], -contact discovery (protecting the contacts' confidentiality) [35], -toll collection (protecting e.g. location data) [21], -medicine (protecting highly sensitive data such as (parts of) the genome) [3,48], -electronic payment (ensuring privacy and e.g. unlinkability) or [7], -voting (e.g.…”

Section: Introductionmentioning

confidence: 99%

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

Broadnax¹,

Koch

Mechler

et al. 2021

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

In practice, there are numerous settings where mutually distrusting parties need to perform distributed computations on their private inputs. For instance, participants in a first-price sealed-bid online auction do not want their bids to be disclosed. This problem can be addressed using secure multi-party computation (MPC), where parties can evaluate a publicly known function on their private inputs by executing a specific protocol that only reveals the correct output, but nothing else about the private inputs. Such distributed computations performed over the Internet are susceptible to remote hacks that may take place during the computation. As a consequence, sensitive data such as private bids may leak. All existing MPC protocols do not provide any protection against the consequences of such remote hacks. We present the first MPC protocols that protect the remotely hacked parties’ inputs and outputs from leaking. More specifically, unless the remote hack takes place before the party received its input or all parties are corrupted, a hacker is unable to learn the parties’ inputs and outputs, and is also unable to modify them. We achieve these strong (privacy) guarantees by utilizing the fact that in practice parties may not be susceptible to remote attacks at every point in time, but only while they are online, i.e. able to receive messages. To this end, we model communication via explicit channels. In particular, we introduce channels with an airgap switch (disconnect-able by the party in control of the switch), and unidirectional data diodes. These channels and their isolation properties, together with very few, similarly simple and plausibly remotely unhackable hardware modules serve as the main ingredient for attaining such strong security guarantees. In order to formalize these strong guarantees, we propose the UC with Fortified Security (UC#) framework, a variant of the Universal Composability (UC) framework.

show abstract

P4TC—Provably-Secure yet Practical Privacy-Preserving Toll Collection

Cited by 9 publications

References 41 publications

Privacy Friendly E-Ticketing For Public Transport

Privacy Friendly E-Ticketing For Public Transport

Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

Contact Info

Product

Resources

About