CT-ISG: Crypto Algorithms for an Integrated Approach to Conditional, Revocable and Traceable Anonymity

随着个人活动记录变得越来越计算机化和相互关联，隐私成为一个越来越具有挑战性的问题。当合法的安全需要要求能够将不同的交易联系起来，甚至获得有关个人的详细信息时，这一点尤其具有挑战性。该项目的重点是实现折衷的加密技术：交易记录应该是匿名的，直到出现特殊情况(如特定个人的不当行为，或需要特殊措施的紧急情况)。人们希望在交易发生之前明确这些情况，这样个人就可以选择不参与没有为他或她提供足够隐私保证的交易。该项目考虑了匿名性和责任之间的几个权衡。有条件匿名/有条件披露意味着个人用户是匿名的，直到她的活动违反了特定条件，在这一点上，关于她的一些信息被知道。可撤销匿名意味着用户对除特殊匿名撤销受托人以外的所有人都是匿名的，只有在紧急情况下才会参与其中。可跟踪匿名意味着，在特殊情况下，可以快速跟踪特定用户的所有交易；这可以是一种有条件匿名的形式，如果情况是由于用户的不当行为造成的，或者是可撤销的匿名，如果受托人决定何时运行跟踪算法。这个项目研究的技术允许人们在个人和组织之间开发和执行匿名合同，这些合同详细说明了在什么情况下可以了解个人用户的哪些信息。

As records of individuals' activities become increasingly computerized and linked, privacy becomes an ever more challenging problem. It is especially challenging when legitimate security needs require the ability to link different transactions and even obtain details about the individuals involved. The focus of this project is on cryptographic technologies that achieve a compromise: transaction records should be anonymous until special circumstances (such as wrong-doing on the part of a particular individual, or an emergency that requires special measures) arise. One wants to specify these circumstances before a transaction takes place, so an individual can choose not to participate in a transaction that does not provide him or her with sufficient privacy guarantees.The project considers several trade-offs between anonymity and accountability. Conditional anonymity/conditional disclosure means that an individual user is anonymous until her activities violate a certain condition, at which point some piece of information about her becomes known. Revocable anonymity means that a user is anonymous to all but a special anonymity-revoking trustee that only becomes involved in case of emergency. Traceable anonymity means that, under special circumstances, it is possible to quickly trace all of a particular user's transactions; this can be a form of conditional anonymity where the circumstances are due to the user's misbehavior or revocable anonymity where a trustee decides when to run the trace algorithm. This project investigates techniques that allow one to develop and enforce anonymity contracts between individuals and organizations that spell out what can become known about the individual user and under what circumstances.