Privacy-Preserving Incentive Systems with Highly Efficient Point-Collection

Abstract

Incentive systems (such as customer loyalty systems) are omnipresent nowadays and deployed in several areas such as retail, travel, and financial services. Despite the benefits for customers and companies, this involves large amounts of sensitive data being transferred and analyzed. These concerns initiated research on privacy-preserving incentive systems, where users register with a provider and are then able to privately earn and spend incentive points. In this paper we construct an incentive system that improves upon the state-of-the-art in several ways: (1) We improve efficiency of the Earn protocol by replacing costly zero-knowledge proofs with a short structure-preserving signature on equivalence classes. (2) We enable tracing of remainder tokens from double-spending transactions without losing backward unlinkability. (3) We allow for secure recovery of failed Spend protocol runs (where usually, any retries would be counted as double-spending attempts). (4) We guarantee that corrupt users cannot falsely blame other corrupt users for their double-spending. We propose an extended formal model of incentive systems and a concrete instantiation using homomorphic Pedersen commitments, ElGamal encryption, structure-preserving signatures on equivalence classes (SPS-EQ), and zero-knowledge proofs of knowledge. We formally prove our construction secure and present benchmarks showing its practical efficiency.

Fast Privacy-Preserving Punch Cards

“…Although we offer a similar functionality, we will do so with stronger security guarantees and significantly improved performance. On the other hand, other follow-up works to BBA [5,6,34,36] offer additional features that might be useful in other kinds of loyalty programs, such as reducing balances and partially spending accrued rewards. These features enable other applications, but, as described in Section 1, they render the solutions less effective for the original punch card problem.…”

“…These features enable other applications, but, as described in Section 1, they render the solutions less effective for the original punch card problem. Bobolz et al [6] introduce the possibility of recovering from a partially completed spend that gets interrupted mid-protocol, e.g., due to a communication or hardware fault. Our scheme avoids the potential for this problem entirely because redemption only requires a single message from the client to the server.…”

“…Unfortunately, although individual hole punches are unlinkable in the original BBA scheme, the processes of issuing and redeeming a punch card are not. This shortcoming is rectified in a series of follow-up works [5,6,[34][35][36], all of which additionally extend the idea of black box accumulation to support a broader set of functionalities, usually via some combination of blind signatures and zero-knowledge proofs that previously signed values satisfy certain relationships, e.g., that a balance was correctly updated.…”

Unlinkable Updatable Hiding Databases and Privacy-Preserving Loyalty Programs

“…For privacy's sake, the key issue is whether V requires collection of PHs or not. Some privacy-preserving LPs (PPLPs) do not allow V to collect PHs [5,6,16,28]. In [16], blind signatures are used to provide unlinkability between issuance and redemption of loyalty points (lpts).…”

“…In [5], an updatable anonymous credential scheme is proposed that allows Bs to get V to add lpts at each purchase without revealing the total number of lpts accumulated. Recently, in [6], the scheme in [5] is improved to add some features such as recoverability of failed spent lpts or backward unlinkability. Despite offering privacy protection to Bs, these solutions prevent any form of buyer profiling, and thus they limit the benefits that Vs obtain from LPs.…”