A Hidden Credential Based Oblivious Automated Trust Negotiation Model

Abstract

Automated trust negotiation (ATN) is an important means to establish trust between strangers through the exchange of digital credentials and access control policies specifying what credentials a stranger must submit in the open and distributed environment. While ATN brings convenience, there are still two issues unsolved successfully: 1) to protect the transmitting message; 2) to prevent the sensitive information leakage. Hidden credential can provide high security level to protect sensitive resources, policies and credentials from being attacked. Zero-knowledge is an important means to avoid leakage and can be used to protect the user's private context and sensitive information from unauthorized inferences. If hidden credentials and zero-knowledge are well-combined and redesigned, they can jointly make ATN better. Based on these, a hidden credential based oblivious automated trust negotiation model (HBOA) is proposed in this paper. In the model, the negotiation information is carried by hidden credentials, which have the same secure level with elliptic curve. Zero-knowledge protocol is provided by Pedersen commitment scheme, which ensures that no sensitive information can be attained by authorized users. A practical example is given to prove its usability.