Selective disclosure of attributes and data entries of a record

Abstract

Some embodiments are directed to a system for selectively disclosing attributes and data entries of a record. An issuer device generates a digital signature on a message comprising the attributes and a secret record identifier, and digital signatures on messages comprising respective data entries and each comprising the secret record identifier. The record, secret record identifier, and signatures are provided to a selector device. The selector device selectively discloses attributes and data entries of the record to a receiver device, proving authenticity by means of a zero-knowledge proof of knowledge of the signature on the attributes and signatures on respective data entries. The receiver device verifies the proof with respect to the public key of the issuer and the received attributes and data entries.

Claims

1. A system comprising an issuer device, a selector device, and a receiver device, wherein the issuer device is configured to provide a record to the selector device for selective disclosure to the receiver device, the issuer device comprising: an issuer memory configured to store: an issuer private key, the issuer private key forming a public-private key pair with a corresponding issuer public key; the record, the record comprising one or more attributes and comprising multiple data entries, wherein the one or more attributes and the multiple data entries correspond to two different data types; an issuer processor configured to: determine a secret record identifier; generate a digital signature on an attribute message using the issuer private key, the attribute message comprising all of the one or more attributes and the secret record identifier; generate multiple digital signatures on multiple data messages for the multiple data entries using the issuer private key, each data message for each data entry comprising the data entry and the secret record identifier; provide the record, the secret record identifier, the digital signature on the attribute message, and the digital signatures on the data messages to the selector device; wherein the selector device is configured to: receive a request for one or more selected attributes and one or more selected data entries from the receiver device, and disclose the selected attributes and the selected data entries to the receiver device, the selector device comprising: a selector memory configured to store: the record, the secret record identifier, the digital signature on the attribute message and the digital signatures on the data messages; a selector processor configured to: determine the selected attributes to be disclosed as a subset of the one or more attributes, and the selected data entries to be disclosed as a subset of the multiple data entries; provide the selected attributes and the selected data entries to the receiver device; perform a zero-knowledge proof with the receiver device, wherein the selector device proves knowledge of: the secret record identifier; the digital signature on the attribute message as being a digital signature on a message comprising at least the selected attributes and the secret record identifier, signed with a private key corresponding to the issuer public key; the digital signatures on the data messages for the selected data entries as being digital signatures on messages comprising the selected data entries and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key; wherein the receiver device is configured to obtain the selected attributes and selected data entries from the selector device, the receiver device comprising: a receiver memory configured to store the issuer public key; a receiver processor configured to: obtain from the selector device the selected attributes and the selected data entries; perform the zero-knowledge proof with the selector device with respect to the obtained selected attributes and selected data entries to ascertain that the obtained selected attributes and selected data entries belong to the record of the issuer device.

2. The system according to claim 1, wherein the one or more attributes comprise one or more phenotype attributes about a person; and the multiple data entries comprise one or more genome portions of the person.

3. A selector device for selectively disclosing one or more selected attributes and one or more selected data entries of a record to a receiver device that requests the selected attributes and the selected data entries, the selector device comprising: a memory configured to store: the record, comprising one or more attributes and comprising multiple data entries, wherein the one or more attributes and the multiple data entries correspond to two different data types; a secret record identifier; a digital signature on an attribute message generated using an issuer private key, the attribute message comprising all of the one or more attributes and the secret record identifier; and digital signatures on data messages generated using the issuer private key, each data message for each data entry comprising the data entry and the secret record identifier; a processor configured to: obtain the record, the secret record identifier, the digital signature on the attribute message and the digital signatures on the data messages; determine the selected attributes to be disclosed as a subset of the one or more attributes, and the selected data entries to be disclosed as a subset of the multiple data entries; provide the selected attributes and the selected data entries to the receiver device; perform a zero-knowledge proof with the receiver device, wherein the selector device proves knowledge of: the secret record identifier; the digital signature on the attribute message as being a digital signature on a message comprising at least the selected attributes and the secret record identifier, signed with a private key corresponding to the issuer public key; the digital signatures on the data messages for the multiple data entries to be disclosed as being digital signatures on messages comprising the selected data entries and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

4. The selector device according to claim 3, wherein the memory is configured to store multiple records, the processor being configured to: obtain a record query from the receiver device; select one or more of the multiple records according to the record query; and repeat the determining, the providing, and the performing of the zero-knowledge proof for each current record of the one or more selected records.

5. The selector device according to claim 4, wherein the processor is configured to perform the zero-knowledge proof for a current record to further prove that the current record satisfies the record query.

6. The selector device according to claim 3, wherein the processor is further configured to obtain a data query, the processor being configured to determine the selected data entries to be disclosed according to the data query.

7. The selector device according to claim 3, wherein performing the zero-knowledge proof comprises providing a commitment to the secret record identifier to the receiver device and proving knowledge of the digital signatures with respect to the commitment.

8. A receiver device for selectively obtaining one or more selected attributes and one or more selected data entries of record from a selector device, the receiver device comprising: a memory configured to store an issuer public key; a processor configured to: obtain from the selector device the selected attributes and the selected data entries, wherein the selected attributes and the selected data entries correspond to two different data types; perform a zero-knowledge proof with the selector device with respect to the obtained selected attributes and the obtained selected data entries to ascertain that the obtained values and the obtained selected data entries belong to a record of an issuer device corresponding to the issuer public key, wherein the selector device proves knowledge of: a secret record identifier; a digital signature on a message comprising at least the selected attributes to be disclosed and the secret record identifier, signed with a private key corresponding to the issuer public key; digital signatures on messages comprising the selected data entries to be disclosed and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

9. The receiver device according to claim 8, wherein the receiver device is configured to perform the zero-knowledge proof by obtaining a non-interactive zero-knowledge proof from the selector device and verifying the non-interactive zero-knowledge proof.

10. A selector method of selectively disclosing one or more selected attributes and one or more selected data entries of a record to a receiver device that requests the selected attributes and the selected data entries, the selector method comprising: storing: the record, comprising one or more attributes and comprising multiple data entries, wherein the one or more attributes and the multiple data entries correspond to two different data types; a secret record identifier; a digital signature on an attribute message generated using an issuer private key, the attribute message comprising all of the one or more attributes and the secret record identifier; and digital signatures on data messages generated using the issuer private key, each data message for each data entry comprising the data entry and the secret record identifier; obtaining the record, the secret record identifier, the digital signature on the attribute message and the digital signatures on the data messages from an issuer device; determining the selected attributes to be disclosed as a subset of the one or more attributes, and the selected data entries to be disclosed as a subset of the multiple data entries; providing the selected attributes and the selected data entries to the receiver device; performing a zero-knowledge proof with the receiver device, wherein knowledge is proven of: the secret record identifier; the digital signature on the attribute message as being a digital signature on a message comprising at least the selected attributes and the secret record identifier, signed with a private key corresponding to the issuer public key; the digital signatures on the data messages for the selected data entries as being digital signatures on messages comprising the selected data entries and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

11. A non-transitory computer readable storage medium comprising instructions to cause a processor system to perform the method according to claim 10.

12. A receiver method of selectively obtaining one or more selected attributes and one or more selected data entries of record from a selector device, the receiver method comprising: storing an issuer public key; obtaining from the selector device the selected attributes and the selected data entries, wherein the selected attributes and the selected data entries correspond to two different data types; performing a zero-knowledge proof with the selector device with respect to the obtained selected attributes and the obtained selected data entries to ascertain that the obtained selected values and the obtained selected data entries belong to a record of an issuer device corresponding to the issuer public key, wherein the selector device proves knowledge of: a secret record identifier; a digital signature on a message comprising at least the selected attributes and the secret record identifier, signed with a private key corresponding to the issuer public key; digital signatures on messages comprising the selected data entries and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

13. A non-transitory computer readable storage medium comprising instructions to cause a processor system to perform the method according to claim 12.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) Further details, aspects, and embodiments of the invention will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the Figures, elements which correspond to elements already described may have the same reference numerals. In the drawings:

(2) FIG. 1a schematically shows an example of a selective disclosure system that does not involve zero-knowledge proofs;

(3) FIG. 1b schematically shows an example of an embodiment of a selective disclosure system;

(4) FIG. 2 schematically shows an example of an embodiment of an issuer device;

(5) FIG. 3 schematically shows an example of an embodiment of a selector device;

(6) FIG. 4 schematically shows an example of an embodiment of a receiver device;

(7) FIG. 5 schematically shows an example of an embodiment of an issuer method;

(8) FIG. 6 schematically shows an example of an embodiment of a selector method;

(9) FIG. 7 schematically shows an example of an embodiment of a receiver method;

(10) FIG. 8 schematically shows a computer readable medium having a writable part comprising a computer program according to an embodiment,

(11) FIG. 9 schematically shows a representation of a processor system according to an embodiment.

LIST OF REFERENCE NUMERALS

(12) 000, 100 a selective disclosure system 010, 110, 210 an issuer device 011, 111, 311 a selector device 012, 112, 412 a receiver device 130, 131, 132 a memory 140, 141, 142 a processor 150, 151, 152 a network interface 160 a computer network 070, 170, 270 an issuer private key 071, 171, 471 an issuer public key 072, 172, 272, 372 a record 173, 273, 373 a secret record identifier 174, 374, 474 a zero-knowledge proof 075 a digital signature on disclosed attributes and data entries 180, 280, 380 a digital signature on an attribute message 081-084, 181-184, 281-282, 381-384, 483-484 an attribute 091-093, 191-193, 291-292, 391-393, 493 a data entry 191′-192′, 291′-292′, 393′ a digital signature on a data message 241 an identifier generation unit 242 an attribute signing unit 243 a data entry signing unit 341 a selection unit 342 a proving unit 441 a verification unit 800 a computer readable medium 810 a writable part 820 a computer program 910 integrated circuit(s) 920 a processing unit 922 a memory 924 a dedicated integrated circuit 926 a communication element 930 an interconnect 940 a processor system

DETAILED DESCRIPTION OF THE EMBODIMENTS

(13) While this invention is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.

(14) In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them.

(15) Further, the invention is not limited to the embodiments, and the invention lies in each and every novel feature or combination of features described herein or recited in mutually different dependent claims.

(16) FIG. 1a shows an example of a system 000 for selectively disclosing attributes and data entries of a record, according to current best practices. System 000 does not use attribute message and data message signatures or zero-knowledge proofs as defined by the claims.

(17) Shown in the figure is an issuer device 010 that wishes to enable a selector device 011, e.g., a genomics platform, to selectively disclose parts of a record 072. The particular record 072 shown in the figure comprises values for a predefined set of attributes 081-082, e.g., phenotype data, and a set of data entries 091-092, e.g., genotype data. Issuer device 010 provides the record to selector device 011.

(18) When selector device 011 wants to selectively disclose parts of record 072 to a receiver device 012, the selector device may select one or more of the attributes 081-082, in this case, attributes 083 and 084, and one or more of the data entries 091-092, in this case, data entry 093, to be disclosed to the receiver device 012. The receiver device 012 may receive the attributes 083, 084 and data entries 093 to be disclosed.

(19) Although the steps so far provide selective disclosure, e.g., only part of the record is obtained by receiver device 012, no authenticity is provided yet, e.g., the receiver device 012 does not obtain assurance that the received attributes and data entries originate from a trusted issuer device 010, and/or that the received attributes and data entries belong to the same record, e.g., all refer to the same person. To obtain such assurance using state-of-the-art techniques, a digital signature 075 may be employed. Digital signature 075 in this example may be a conventional signature, e.g., an RSA or ECDSA signature. The notation S(X; Y) adopted in the figure and throughout this description may denote a signature with private key X on a message Y. At the time of disclosure, the issuer device 010 may provide to the receiver device 012, e.g., prompted by the selector device 011, digital signature 075, signed with an issuer private key 070, on the attributes and data entries to be disclosed. Receiver device 012 may verify the digital signature 075 with respect to an issuer public key 071 corresponding to issuer private key 070. The digital signature is typically without message recovery, e.g., the message is not derived from the signature and instead the signature and message are together verified with respect to the public key 071.

(20) Although the above system can provide selective disclosure with authenticity guarantees, it has the undesirable characteristic that the issuer device 010 needs to be involved in each selective disclosure. This is cumbersome, often expensive, and sometimes not possible, e.g., the issuer device 010 or its organization may no longer exist. Accordingly, a problem addressed below is how to perform selective disclosure with comparable authenticity guarantees, but in such a way that an issuer device does not need to be involved in a selective disclosure.

(21) FIG. 1b schematically shows an example of an embodiment of a system 100 for selectively disclosing attributes and data entries of a record 172. System 100 may comprise an issuer device 110, a selector device 111, and/or a receiver device 112.

(22) Issuer device 110 may be for providing record 172 to selector device 111 for selective disclosure. Issuer device 110 may comprise a processor 130 and a memory 140. Memory 140 may be used for data and/or instruction storage. For example, memory 140 may comprise software and/or data on which processor 130 is configured to act. Memory 140 may also store an issuer private key 170 forming a public-private key pair with a corresponding issuer public key 171. Memory 140 may also store record 172. Record 172 may comprise one or more attributes 181-182 and multiple data entries 191-192. By way of example only, two attributes and two data entries are shown. Processor 130 may be implemented as one or more processor circuits, e.g. microprocessors, ASICs, FPGA and the like. Memory 140 may comprise computer program instructions which are executable by processor 130. Processor 130, possibly together with memory 140, is configured according to an embodiment of an issuer device. Issuer device 110 may also comprise a communication interface 150 arranged to communicate with other devices, in particular, selector device 111. For example, the communication interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The communication interface may also be a storage interface to an internal or external data storage, a keyboard, an application interface (API), etc.

(23) Issuer device 110 may be configured to determine a secret record identifier 173. Issuer device 110 may also be configured to generate a digital signature 180 on an attribute message using issuer private key 170, where the attribute message comprises the one or more attributes 181-182 and the secret record identifier 173. Issuer device 110 may also be configured to generate multiple digital signatures 191′-192′ on multiple data messages for the multiple data entries 191-192 using the issuer private key 170. A data message for a data entry 191-192 may comprise the data entry and the secret record identifier 173. Issuer device 110 may be configured to provide the record 172, the secret record identifier 173, the digital signature 180 on the attribute message, and the digital signatures 191′-192′ on the data messages to the selector device 111.

(24) As shown in the figure and used throughout this description, S.sub.1(X; Y) and S.sub.2(X; Y) may be used to refer to digital signatures signed using private key X on messages Y. As shown by the subscripts, different digital signature schemes may be used for signature 180 and signatures 191′-192′, although this is not necessary. The digital signatures are typically without message recovery, e.g., the digital signature may be verified together with the message using a public key corresponding to the private key.

(25) Selector device 111 may be for selectively disclosing attributes and data entries of record 172 to receiver device 112. Selector device 111 may comprise a processor 131 and a memory 141. Memory 141 may be used for data and/or instruction storage. For example, memory 141 may comprise software and/or data on which processor 131 is configured to act. Memory 141 may also store record 172, secret record identifier 173, digital signature 180 on the attribute message and/or digital signatures 191′-192′ on the data messages. Processor 131 may be implemented as one or more processor circuits, e.g. microprocessors, ASICs, FPGA and the like. Memory 141 may comprise computer program instructions which are executable by processor 131. Processor 131, possibly together with memory 141, is configured according to an embodiment of a selector device. Selector device 111 may also comprise a communication interface 151 arranged to communicate with other devices, in particular, issuer device 110 and receiver device 112. For example, the communication interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The communication interface may also be a storage interface to an internal or external data storage, a keyboard, an application interface (API), etc.

(26) Selector device 111 may be configured to obtain record 172, secret record identifier 173, digital signature 180 on the attribute message and digital signatures 191′-192′ on the data messages. Selector device 111 may be further configured to determine one or more attributes to be disclosed as a subset of the one or more attributes 181-182. By way of example only, the figure shows two attributes 183-184 to be disclosed. Selector device 111 may be further configured to determine one or more data entries to be disclosed as a subset of the multiple data entries 191-192. By way of example, a single data entry 193 to be disclosed is shown. Selector device 111 may be configured to provide the one or more attributes to be disclosed 183, 184 and the one or more data entries to be disclosed 193 to the receiver device 112.

(27) Selector device 111 may be further configured to perform a zero-knowledge proof 174 with receiver device 112. The zero-knowledge proof is shown here as a message being sent from selector device 111 to receiver device 112, e.g., a non-interactive zero-knowledge proof, but this not necessary, e.g., the zero-knowledge proof may comprise multiple messages being exchanged between the parties.

(28) As used in this figure and throughout the description, the notation ZK(X;Y) denotes a zero-knowledge proof that values X satisfy a certain property with respect to values Y. E.g., values X are comprised in the so-called witness of the zero-knowledge proof. The prover typically uses values X to perform the proof and the verifier typically verifies the proof using values Y.

(29) In the zero-knowledge proof, the selector device may prove knowledge of: the secret record identifier 173; the digital signature 180 on the attribute message as being a digital signature on a message comprising at least the one or more attributes to be disclosed 183-184 and the secret record identifier, signed with a private key corresponding to the issuer public key 171; and the digital signatures 191′-192′ on the data messages for the data entries to be disclosed 193 as being digital signatures on messages comprising the data entries to be disclosed 193 and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key 172.

(30) Receiver device 112 may be for selectively obtaining the attributes 183-184 and data entries 193 of the record 172 from the selector device 111. Receiver device 112 may comprise a processor 132 and a memory 142. Memory 142 may be used for data and/or instruction storage. For example, memory 142 may comprise software and/or data on which processor 132 is configured to act. Memory 142 may also store issuer public key 171. Processor 132 may be implemented as one or more processor circuits, e.g. microprocessors, ASICs, FPGA and the like. Memory 142 may comprise computer program instructions which are executable by processor 132. Processor 132, possibly together with memory 142, is configured according to an embodiment of a receiver device. Receiver device 112 may also comprise a communication interface 152 arranged to communicate with other devices, in particular, selector device 111. For example, the communication interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The communication interface may also be a storage interface to an internal or external data storage, a keyboard, an application interface (API), etc.

(31) Receiver device 112 may be configured to obtain from the selector device 111 the one or more attributes 183-184 and the one or more data entries 193. Receiver device 112 may be further configured to perform the zero-knowledge proof with the selector device 111 with respect to the obtained values 183-184 and data entries 193 and the issuer public key 174 to ascertain that the obtained values 183-184 and data entries 193 belong to the record 172 of the issuer device 110.

(32) The various devices of system 100 communicate with each other over a computer network 160. The computer network may be an internet, an intranet, a LAN, a WLAN, etc. Computer network 160 may be the Internet. The computer network may be wholly or partly wired, and/or wholly or partly wireless. For example, the computer network may comprise Ethernet connections. For example, the computer network may comprise wireless connections, such as Wi-Fi, ZigBee, and the like. Computer network 160 may comprise additional elements, e.g., a router, a hub.

(33) The various devices of FIG. 1 may have respective user interfaces, which may include well-known elements such as one or more buttons, a keyboard, display, touch screen, etc. For example, the user interface of the receiver device 112 may be arranged for accommodating user interaction for obtaining parts of records satisfying particular record and/or data entry queries.

(34) FIG. 2 schematically shows an example of an embodiment of an issuer device 210 for providing a record to a selector device for selective disclosure, for example, for use in system 100 of FIG. 1b.

(35) FIG. 2 schematically shows functional units that may be functional units of a processor of issuer device 210 (not shown separately). For example, FIG. 2 may be used as a blueprint of a possible functional organization of the processor. For example, the functional units shown in FIG. 2, e.g., units 241-243, may be wholly or partially be implemented in computer instructions that are stored at device 210, e.g., in an electronic memory of device 210, and are executable by a microprocessor of device 210. In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, and partially in software stored and executed on device 210. For the purpose of explication, FIG. 2 also shows various elements that may be stored by the device 210 at various stages of its operation.

(36) Shown in the figure is a record 272 comprising one or more attributes 281-282 and multiple data entries 291-292. For example, record 272 may be a genomic record. In such a case, attributes 281-282 may comprise phenotype attributes of a person, e.g., one or more of an age, a BMI, flags indicating diagnoses for one or more medical conditions, etcetera. In this example, attributes are integers or other type of values encoded as integers. The integers are typically from a range 0, . . . , N−1 where value N is defined by the signature scheme(s) used, as discussed below. Data entries 291-292 may comprise genome portions of the person.

(37) As an illustrative example, data entries of record 272 may represent single nucleotide polymorphisms (SNPs) of a person's genome. For example, record 272 may be derived from, or encoded by, a Variant Call Format (VCF) file. As is known in bioinformatics, a VCF file may be used to store gene sequence variations with respect to a reference genome. Optionally, a VCF file can also store phenotype information. A portion of a VCF file is shown below:

(38) TABLE-US-00001 POS ID REF FILTER #CHROM ALT QUAL INFO FORMAT chr1 82154 rs4477212 a . . . . GT 0/0 chr1 752566 rs3094315 g A . . . GT 1/1 chr1 752721 rs3131972 A G . . . GT 1/1 chr1 798959 rs11240777 g . . . . GT 0/0 chr1 800007 rs6681049 T c . . . GT 1/1 chr1 838555 rs4970383 c . . . . GT 0/0 chr1 846808 rs4475691 C . . . . GT 0/0 chr1 854250 rs7537756 A . . . . GT 0/0 chr1 861808 rs13302982 A . . . . GT 1/1 chr1 873558 rs1110052 A G . . . GT 1/1 chr1 882033 rs2272756 G T . . . GT 0/1 chr1 888659 rs3748597 T C . . . GT 1/1 chr1 891945 rs13303106 A G . . . GT 0/1

(39) For example, for a record corresponding to a VCF file as illustrated above, data entries of the record may correspond to lines of the VCF file. For example, a data entry may be a string representing a line of a VCF file.

(40) Further shown in the figure is an identifier generation unit 241. Identifier generation unit 241 may generate secret record identifier 273. Typically, secret record identifier 273 is an integer, e.g., from the same range 0, . . . , N−1 as attributes 281-282. It is beneficial to generate secret record identifier 273 randomly from a large domain such that it is unpredictable to other devices and to minimize the probability of collision between identifiers, e.g., generated by other devices. For example, identifier generation unit 241 may generate secret record identifier 273 randomly from at least 2.sup.30, at least 2.sup.62, or 2.sup.126 possible values.

(41) Also shown is an issuer private key 270, which may be generated by the issuer device 210 or otherwise obtained. Issuer private key 270 can be any kind of secret key compatible with the digital signature schemes used to generate digital signatures 280, 291′-292′ discussed below.

(42) Shown further an attribute signing unit 242. Attribute signing unit 242 may generate digital signature 280 on an attribute message using issuer private key 270. The attribute message may comprise the one or more attributes 281-282 and the secret record identifier 273. Although, as discussed elsewhere, any signature scheme S.sub.1 can in principle used, it is particularly beneficial for the digital signature 280 to be an anonymous credential; in other words, for the signature generation to be an algorithm to generate an anonymous credential. The secret record identifier 273 may be used as an attribute of the anonymous credential.

(43) As a concrete example, using the anonymous credential scheme from the papers “Signature schemes and anonymous credentials from bilinear maps” and “An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials” mentioned above, given an ordered list of attributes m, the signature may be a quadruple (c, s, γ, σ) where attribute signing unit 242 generates values c, s, and γ randomly and computes σ as

(44) $σ = {(h_{0} \underset{i \in H}{.Math.} h_{i}^{m_{i}} γ {\tilde{h}}^{s})}^{1 / x + c},$
where x is the secret key 273 whose associated public key y is trusted by the receiver device. H may be a set of generators h.sub.i of a group G of prime order q, and similarly for {tilde over (h)} and h.sub.0. Here, γ, 273 is the secret record identifier which is in this notation considered to be part of the signature. Interestingly, {acute over (h)} may be a generator of group G used to include secret record identifier γ into the signature.

(45) Shown also is a data entry signing unit 243. Data entry signing unit 243 may generate multiple digital signatures 291′, 292′ on multiple data messages for the multiple data entries 291-292 using the issuer private key 270, for example, a signature for each data entry. As discussed above, various choices for signature scheme S.sub.2 are possible, including using signature scheme S.sub.1 also used for the attribute message. In this case, a data message may be regarded as an attribute message containing two attributes: the secret record identifier and the data entry or its digest. Signature scheme S.sub.2 preferably uses a secret key compatible with the secret key of signature scheme S.sub.1 although secret key 270 could also be a pair of respective secret keys for the schemes S.sub.1 and S.sub.2.

(46) A data message for a data entry may comprise the data entry m, 291-292 and the secret record identifier γ, 273. In particular, the digital signature on the data message may be based on a sum γ+H(m) of at least the secret record identifier γ and a digest H(m) of the data entry, e.g., a SHA256 hash of the data entry, e.g., the line of the VCF file. As discussed, such a sum may effectively bind the signature both to the secret record identifier γ and the message m in the sense that it is hard for a recipient to find another message m′ that leads to the same sum γ+H(m) for present secret identifier γ or another secret identifier in use in the system.

(47) Data signing unit 243 may generate digital signature 291′, 292′ by computing an exponentiation of a group element g to a multiplicative inverse of a value, where the value may be based on at least the issuer private key x, 270, the secret record identifier γ, 273, and the data entry, 291-292, e.g., value x+γ+H(m) based on the sum γ+H(m) discussed above. For example, signature S.sub.i for data entry m.sub.i may be computed as:

(48) $S_{i} = h^{\frac{1}{x + γ + H (m_{i})}} .$
The general concept of using an exponentiation to a multiplicative inverse as a digital signature is known per se from D. Boneh et al., “Short signatures without random oracles and the SDH assumption in bilinear groups”, J. Cryptology, 21(2):149-177, 2008. Interestingly, however, in signature S.sub.i above, secret record identifier γ that was previously embedded in σ may also be included in the signature here. Thereby, the signatures S.sub.i and σ may be tied together, enabling a selector device to prove that issuer device 210 generated them as part of the same record 272.

(49) Issuer device 210 may further provide record 272, secret record identifier 273, digital signature 280 on the attribute message, and digital signatures 291′-292′ on the data messages to the selector device, e.g., send them via a communication interface (not shown).

(50) Although, so far, the signing process has been discussed with respect to a single record 272, the same units 241-243 may also be used to produce respective secret identifiers and sets of signatures for multiple records. Also, issuer device 210 may add data entries, update data entries, or update attributes of a record by having units 242, 243 determine new attribute message signatures or data message signatures as appropriate. For example, issuer device 210 may obtain updated data for a data entry, e.g., data entry 292; generate an updated digital signature 292′ on a data message for the updated data entry 292, and provide the updated digital signature 292′ to the selector device 210, and similarly for other modifications.

(51) FIG. 3 schematically shows an example of an embodiment of a selector device 311 for selectively disclosing attributes and data entries of a record 372 to a receiver device, for example, for use in system 100 of FIG. 1b.

(52) FIG. 3 schematically shows functional units that may be functional units of a processor of selector device 311 (not shown separately). For example, FIG. 3 may be used as a blueprint of a possible functional organization of the processor. For example, the functional units shown in FIG. 3, e.g., units 341-342, may be wholly or partially be implemented in computer instructions that are stored at device 311, e.g., in an electronic memory of device 311, and are executable by a microprocessor of device 311. In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, and partially in software stored and executed on device 311. For the purpose of explication, FIG. 3 also shows various elements that may be stored by the device 311 at various stages of its operation.

(53) Shown in the figure are a record 372 comprising one or more attributes 381-382 and comprising multiple data entries 391-392; a secret record identifier 370; a digital signature 380 on an attribute message generated using an issuer private key, where the attribute message comprises the one or more attributes 381-392 and the secret record identifier 370; and a digital signatures 393′ on a data message generated using the issuer private key, where a data message for a data entry comprises the data entry and the secret record identifier 370. Although not shown in the figure, device 311 typically stores a respective digital signature for each data entry 391-392. For example, the record, secret record identifier, and digital signatures may correspond to those of FIG. 2. For example, this data may be obtained from an issuer device.

(54) Also shown is a selection unit 341. Selection unit 341 may determine one or more attributes to be disclosed to the receiver device as a subset of the one or more attributes 381-382, and one or more data entries to be disclosed to the receiver device as a subset of the multiple data entries 391-392. In this particular example, attributes 383, 384 and data entry 393 are selected. The attributes and data entries to be disclosed may be determined based on a data entry query, e.g., provided by the receiver device, e.g., the data entry query may indicate particular data entries to be disclosed and/or criteria for selecting data entries, and similarly for the attributes. The selection unit 341 may additionally perform the selection based on criteria and/or checks that are not provided by the receiver device, e.g., a privacy policy, e.g., provided by the issuer device along with the record.

(55) Shown furthermore is a proving unit 342. Proving unit 342 may perform a zero-knowledge proof 374 with the receiver device. As is known in cryptography and discussed elsewhere, a zero-knowledge proof is for letting a prover prove a statement to a verifier. The zero-knowledge proof preferably satisfies the properties of completeness, soundness, and zero-knowledge.

(56) Completeness means that if the statement is true, then a prover who follows the protocol will convince a verifier who follows the protocol. Soundness means that, if the statement is false, a cheating prover is unlikely to be able to convince a verifier who follows the protocol. In the case of a proof of knowledge, completeness may also mean not only that the statement is true but also that the prover knows certain values, called the witness, occurring in the statement. Completeness typically holds up to a certain soundness error by which a cheating verifier succeeds in convincing the verifier; the zero-knowledge proof may however comprise multiple instances of the protocol to reduce the soundness error. Zero-knowledge means that the verifier does not learn information from the proof other than the fact that the statement is true. Zero-knowledge may be computational and/or statistical.

(57) In this case, selector device may use zero-knowledge proof 374 to prove knowledge of the secret record identifier 373; the digital signature 380 on the attribute message as being a digital signature on a message comprising at least the one or more attributes 383, 384 to be disclosed and the secret record identifier 373, signed with a private key corresponding to the issuer public key; and the digital signatures 393′ on the data messages for the data entries to be disclosed 393 as being digital signatures on messages comprising the data entries to be disclosed 393 and each comprising the secret record identifier 373, signed with a private key corresponding to the issuer public key. In other words, witnesses of the zero-knowledge proof may include the secret record identifier and the signatures; the public values with respect to which their validity is proven may include the attributes 383, 384, data entries 393′, and the issuer public key.

(58) In particular, in order to prove that the signatures 380, 393′ each comprise the same secret record identifier 373 without disclosing the secret record identifier to the receiver device, proving unit 342 may construct a commitment to the secret record identifier, e.g., a Pedersen-type commitment, and provide it to the receiver device. Accordingly, the zero-knowledge proof 374 may prove that the same secret record identifier 373 is included in each signature and in the commitment. For various kinds of zero-knowledge proofs and signature schemes, this may be an efficient way of proving the existence of a common secret identifier.

(59) Many different types of zero-knowledge proofs are known in the art and may be readily applied, e.g., Σ-protocols such as the Schnorr protocol; non-interactive zero-knowledge proofs, e.g., obtained from an interactive zero-knowledge protocol by means of the Fiat-Shamir heuristic; zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs), etc.

(60) It is however particularly beneficial if, rather than relying on generic techniques, signatures scheme S.sub.1 for the attributes and S.sub.2 for the data entries are used that admit efficient proofs of knowledge of the signatures. For example, it can be beneficial to base signature schemes S.sub.1 and/or S.sub.2 on an anonymous credential scheme, e.g., the scheme by Camenisch et al. discussed above, since they admit efficient zero-knowledge proofs to be performed. For signatures S.sub.2 on the data entries, also the use of signatures based on the principle of exponentiating a group element to a multiplicative inverse is particularly efficient, since again, this admits efficient zero-knowledge proofs.

(61) A particularly beneficial implementation based on an attribute signature 380 of the form

(62) $σ = {(h_{0} \underset{i \in H}{.Math.} h_{i}^{m_{i}} γ {\tilde{h}}^{s})}^{1 / x + c}$
and data entry signatures 393′ of the form

(63) $S_{i} = h^{\frac{1}{x + γ + H (m_{i})}},$
is now discussed in detail.

(64) It is noted that the zero-knowledge proof is presented here as an interactive proof, but with the understanding that it can be made non-interactive, e.g., using the Fiat-Shamir heuristic. The proof can also be extended to prove properties about attribute values, e.g., to prove that the record satisfies a record query, e.g., 30≤BMI≤40. Proofs about multiple records can also be performed in parallel and/or combined into one non-interactive zero-knowledge proof using known techniques.

(65) In detail, in this example, proving unit 342 may construct a commitment X={acute over (h)}.sup.γ.Math.h̆.sup.t, for generator h̆ and randomly generated value t, to secret record identifier γ. The commitment may be provided to the receiver device.

(66) In a first part of the zero-knowledge proof, proving unit 342 may prove knowledge of signature 380 as a signature on a message comprising the one or more attributes to be disclosed and a secret record identifier corresponding to commitment X described above, and signed with private key x corresponding to public key y=h.sup.x. For example, using the Camenisch-Stadler notation as described in J. Camenisch et al., “An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials”, Proceedings PKC '09, a first part of the zero-knowledge proof may be used to prove that:

(67) $C = h^{p} {\overset{.Math.}{h}}^{o p e n} ⩓ 1 = C^{c} h^{- mult} {\overset{.Math.}{h}}^{open - tmp} \frac{e (h_{0} \underset{j}{.Math.} h_{j}^{m_{j}} .Math. X, h)}{e (A, y)} = {e (A, h)}^{c} .Math. {e (\overset{.Math.}{h}, y)}^{- p} .Math. {e (\overset{.Math.}{h}, h)}^{- mult} .Math. {e (\tilde{h}, h)}^{- s} .Math. \underset{j}{.Math.} {e (h_{j}, h)}^{- m_{j}} .Math. {e (\overset{.Math.}{h}, h)}^{t}$
Here, A=σh̆.sup.p is a blinding of signature σ with random value p generated by proving unit 342 and provided to the receiver device. Π.sub.jh.sub.j.sup.m.sup.j sums over disclosed attributes whereas Π.sub.je(h.sub.j, h).sup.−m.sup.j sums over non-disclosed attributes, optionally encoded as hashes, etc.

(68) Above, e is used to denote a cryptographic pairing, e.g., a type-3 elliptic curve pairing such as a pairing over a 256-bit Barreto-Naehrig (BN) Curve as known in the art. The pairing over the BN curve may be denoted formally as follows: e(G.sub.1×G.sub.2).fwdarw.G.sub.T. The various generators used above, e.g., the generators of H, the introduced generator {acute over (h)}, etc., may be generators of G.sub.1, generated in a nothing-up-my-sleeves method, e.g., hashing a base generator of G.sub.1 until a point is encountered. With these choices, for example, data entry signatures 393′ may be only 32 bytes.

(69) In a second part of the zero-knowledge proof, it may be proven that
X={acute over (h)}.sup.γ.Math.h̆.sup.t,
e.g., knowledge of the secret identifier in the commitment X may be proven. The above proofs may be carried out by a suitable adaptation of the proofs discussed in J. Camenisch et al., “An Accumulator Based on Bilinear Maps and Efficient Revocation for Anonymous Credentials”, themselves based on the Schnorr proof system as disclosed, e.g., in U.S. Pat. No. 4,995,082A. Interestingly, the above proofs may deviate from the zero-knowledge proof of Camenisch in that commitment X is required to match the secret record identifier γ in signatures 380, 393′. Accordingly, a fraudulent party may not be able to combine signatures over multiple records in a dingle disclosure.

(70) At this point it is observed that only the attributes, e.g., phenotype data, are used in the above parts of the zero-knowledge proof, not the data entries, e.g., the genomic information. Accordingly, these parts do not scale in the number of data entries.

(71) In another part of the zero-knowledge proof, knowledge may be proven of the digital signatures 393′ on messages comprising data entries 393 and secret record identifier 370. This part of the zero-knowledge proof may be obtained by adapting a vectorized version of the known zero-knowledge proof over Boneh-Boyen signatures to the inclusion of the secret record identifier. This part of the zero-knowledge proof may work on a data-entry-by-data-entry basis. E.g., for each data entry to be disclosed, the receiver device may obtain a proof that the data entry corresponds to the record. Accordingly, an efficient solution is obtained since proofs are only with respect to data entries to be disclosed, not with respect to non-disclosed data entries as would be the case if they were all included in the same signature or similar; and moreover, instead of using relatively expensive proofs with respect to Camenisch-type signatures, more efficient proofs with respect to Boneh-Boyen-type signatures may be used.

(72) In detail, in this part of the zero-knowledge proof, the proving unit 342 may randomize respective data entry signatures S.sub.i using respective randomness ν.sub.i to obtain blinded data entry signatures V.sub.i, e.g., V.sub.i=S.sub.i.sup.ν.sup.i. Proving unit 342 may provide the blinded signatures to the verifier device and prove knowledge of signatures S.sub.i with respect to the commitments, the data entries, and the issuer public key.

(73) For example, the proving unit 342 may generate random s, q.sub.i, o, with i running over data entries to be disclosed, and provide
Y={acute over (h)}.sup.s.Math.h̆.sup.o, a.sub.i=e(V.sub.i,h).sup.−se(h,h).sup.q.sup.i
to the receiver device. Upon receiving a challenge c, e.g., from the receiver device or by means of the Fiat-Shamir heuristic, the proving unit 342 may generate responses
z.sub.γ=s−γc, z.sub.ν.sub.i=q.sub.i−ν.sub.ic, z.sub.t=o−tc
and provide them to the receiver device.

(74) Although the above procedure has been discussed for a single record, it will be understood that selector device 311 can be readily adapted to the case where it stores multiple records and associated information, e.g., from multiple issuer devices. In such a way, selector device 311 may also selectively disclose parts of the multiple records. For example, as also discussed elsewhere, selector device 311 may obtain a record query and select one or more of the multiple records according to the record query. The steps performed by units 341 and 342 may be repeated for respective selected records to perform the selective disclose for the respective records.

(75) Interestingly, also the zero-knowledge proof for a record may then be used to prove that the current record satisfies the record query. For example, the record query may comprise a condition on an attribute, e.g., age>65, 40≤age<65, etc. For example, in the particular case of using the adapted Camenisch anonymous credentials as signatures 380, known techniques for proving properties about attributes of such a credential may be readily used.

(76) FIG. 4 schematically shows an example of an embodiment of a receiver device 412 for selectively obtaining attributes and data entries of record from a selector device, for example, for use in system 100 of FIG. 1b.

(77) FIG. 4 schematically shows functional units that may be functional units of a processor of receiver device 412 (not shown separately). For example, FIG. 4 may be used as a blueprint of a possible functional organization of the processor. For example, the functional units shown in FIG. 4, e.g., unit 441, may be wholly or partially be implemented in computer instructions that are stored at device 412, e.g., in an electronic memory of device 412, and are executable by a microprocessor of device 412. In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, and partially in software stored and executed on device 412. For the purpose of explication, FIG. 4 also shows various elements that may be stored by the device 412 at various stages of its operation.

(78) Shown in the figure is an issuer public key 471 stored in a memory of receiver device 412. Authenticity of the parts of the record may be established with respect to this public key. Shown further are attributes 483, 484 of the record, two in this example, data entries 493 of the record, in this case one. Receiver device 412 may receive this information from a selector device, as discussed elsewhere.

(79) Also shown in the figure is a verification unit 441. Verification unit 441 may perform a zero-knowledge proof with the selector device with respect to the obtained values 483, 484 and data entries 493 and the issuer public key 471. Shown here is a non-interactive zero-knowledge proof 474 which verification unit 441 may verify non-interactively, but the proof may also be interactive instead, e.g., with verification unit 441 generating a challenge and providing it to the selector device. The proof may be as discussed, from the perspective of the prover, with respect to selector device 311. Proof 474 may ascertain that the obtained values 483-484 and data entries 493 belong to a record of an issuer device corresponding to issuer public key 481. Accordingly, the selector device may prove knowledge of a secret record identifier; a digital signature on a message comprising at least the one or more attributes to be disclosed 483-484 and the secret record identifier, signed with a private key corresponding to the issuer public key 471; and digital signatures on messages comprising the data entries to be disclosed 493 and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key 471.

(80) Verification of the zero-knowledge proof may be performed corresponding to the zero-knowledge proof system that the selector device uses to prove the statements discussed above. As a concrete example, again, an adapted Camenisch-type signature

(81) $σ = {(h_{0} \underset{i \in H}{.Math.} h_{i}^{m_{i}} γ {\tilde{h}}^{s})}^{1 / x + c}$
for the attributes and adapted Boneh-Boyen-type signatures

(82) $S_{i} = h^{\frac{1}{x + γ + H (m_{i})}}$
for the data entries may be used. In this particular example, the proof in multiple parts discussed with respect to selector device 311 may be used as described above. For example, receiver device 412 may receive a commitment to the secret identifier from the selector device. The selector device may then prove knowledge, which verification unit 441 verifies, of an opening of the commitment to the secret record identifier and of signatures on attributes 483-484 and the same secret identifier, as discussed above.

(83) Concerning the part of the proof relating to the data entries, as discussed with respect to selector device 311, the verification unit 441 may receive respective blinded signatures V.sub.i=S.sub.i.sup.ν.sup.i for data entries 493 to be disclosed. The selector device may prove knowledge of signatures corresponding to the blinded signatures and containing the respective data entries. Concretely, receiving values
Y={acute over (h)}.sup.s.Math.h̆.sup.o, a.sub.i=e(V.sub.i,h).sup.−se(h,h).sup.q.sup.i
and responses
z.sub.γ=s−γc, z.sub.ν.sub.i=q.sub.i−ν.sub.ic, z.sub.t=o−tc
to a challenge c it generates, verification unit 441 may verify these responses by verifying that

(84) $Y = = X^{c} .Math. {\overset{'}{h}}^{z_{γ}} .Math. {\overset{˘}{h}}^{z_{t}} ⩓ \forall i : a_{i} = = {e (V_{i}, y .Math. H (m_{i}))}^{c} .Math. {e (V_{i}, h)}^{- z_{γ}} .Math. {e (h, h)}^{z_{v_{i}}}$
where y is issuer public key 471 and m.sub.i are respective data entries 493. In particular, it is noted that issuer public key 471 is multiplied in this example with the exponentiation of the hash H(m.sub.i) of the disclosed data entry. Accordingly, secret record identifier γ may be kept secret while data entry m.sub.i may still be verified to correspond to the same record as other data entries and attributes.

(85) Although not explicitly shown in the figure, as also discussed before, the selective disclosure techniques as described herein may be applied to multiple records, possibly from different issuer devices, in which case verification unit 442 may repeat the above procedure for each disclosed record. The receiver device may also provide record queries and/or data entry queries to the receiver device to influence what records to obtain. Verification unit 441 may also be adapted to verify that such a data entry query is satisfied by the obtained record, for instance.

(86) Accordingly, by the various measures discussed above, receiver device 412 may obtain information it needs, e.g., attributes 483, 484 and data entries 493, and appropriate authenticity guarantees with respect to public key 471, while not needing access to other sensitive material such as non-disclosed attributes and data entries, the secret record identifier or the issuer private key.

(87) FIG. 5 schematically shows an example of an embodiment of an issuer method 500 of providing a record to a selector device for selective disclosure. Method 500 is typically computed-implemented.

(88) Issuer method 500 may comprise storing 510 an issuer private key, the issuer private key forming a public-private key pair with a corresponding issuer public key; and the record, the record comprising one or more attributes and comprising multiple data entries;

(89) Issuer method 500 may comprise determining 520 a secret record identifier.

(90) Issuer method 500 may comprise generating 530 a digital signature on an attribute message using the issuer private key, the attribute message comprising the one or more attributes and the secret record identifier.

(91) Issuer method 500 may comprise generating 540 multiple digital signatures on multiple data messages for the multiple data entries using the issuer private key, a data message for a data entry comprising the data entry and the secret record identifier.

(92) Issuer method 500 may comprise providing 550 the record, the secret record identifier, the digital signature on the attribute message, and the digital signatures on the data messages to the selector device.

(93) FIG. 6 schematically shows an example of an embodiment of a selector method 600 of selectively disclosing attributes and data entries of a record to a receiver device. Method 600 is typically computer-implemented.

(94) Selector method 600 may comprise storing 610 the record, comprising one or more attributes and comprising multiple data entries; a secret record identifier; a digital signature on an attribute message generated using an issuer private key, the attribute message comprising the one or more attributes and the secret record identifier; and digital signatures on the data messages generated using the issuer private key, a data message for a data entry comprising the data entry and the secret record identifier.

(95) Selector method 600 may comprise obtaining 620 the record, the secret record identifier, the digital signature on the attribute message and the digital signatures on the data messages.

(96) Selector method 600 may comprise determining 630 one or more attributes to be disclosed as a subset of the one or more attributes, and one or more data entries to be disclosed as a subset of the multiple data entries.

(97) Selector method 600 may comprise providing 640 the one or more attributes to be disclosed and the one or more data entries to be disclosed to the receiver device.

(98) Selector method 600 may comprise performing 650 a zero-knowledge proof with the receiver device, wherein knowledge is proven of the secret record identifier; the digital signature on the attribute message as being a digital signature on a message comprising at least the one or more attributes to be disclosed and the secret record identifier, signed with a private key corresponding to the issuer public key; the digital signatures on the data messages for the data entries to be disclosed as being digital signatures on messages comprising the data entries to be disclosed and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

(99) FIG. 7 schematically shows an example of an embodiment of a receiver method 700 of selectively obtaining attributes and data entries of record from a selector device. Method 700 is typically computer-implemented.

(100) Receiver method 700 may comprise storing 710 an issuer public key.

(101) Receiver method 700 may comprise obtaining 720 from the selector device one or more attributes and one or more data entries.

(102) Receiver method 700 may comprise performing 730 a zero-knowledge proof with the selector device with respect to the obtained values and data entries and the issuer public key to ascertain that the obtained values and data entries belong to a record of an issuer device corresponding to the issuer public key, wherein the selector device proves knowledge of: a secret record identifier; a digital signature on a message comprising at least the one or more attributes to be disclosed and the secret record identifier, signed with a private key corresponding to the issuer public key; digital signatures on messages comprising the data entries to be disclosed and each comprising the secret record identifier, signed with a private key corresponding to the issuer public key.

(103) Many different ways of executing the method are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein, or may be unrelated to the method. For example, steps 530 and 540 of method 500 may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started.

(104) Embodiments of the methods may be executed using software, which comprises instructions for causing a processor system to perform a method 500, 600, or 700. Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and/or for remote usage on a server. Embodiments of the method may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.

(105) It will be appreciated that the invention also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiments of the method. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and/or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the means of at least one of the systems and/or products set forth.

(106) FIG. 8 shows a computer readable medium 800 having a writable part 810 comprising a computer program 820, the computer program 820 comprising instructions for causing a processor system to perform an issuer method, a selector method, or a receiver method, according to an embodiment. The computer program 820 may be embodied on the computer readable medium 800 as physical marks or by means of magnetization of the computer readable medium 800. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 800 is shown here as an optical disc, the computer readable medium 800 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 820 comprises instructions for causing a processor system to perform one or said methods.

(107) FIG. 9 shows in a schematic representation of a processor system 940 according to an embodiment. The processor system comprises one or more integrated circuits 910. The architecture of the one or more integrated circuits 910 is schematically shown in FIG. 7b. Circuit 910 comprises a processing unit 920, e.g., a CPU, for running computer program components to execute a method according to an embodiment and/or implement its modules or units. Circuit 910 comprises a memory 922 for storing programming code, data, etc. Part of memory 922 may be read-only. Circuit 910 may comprise a communication element 926, e.g., an antenna, connectors or both, and the like. Circuit 910 may comprise a dedicated integrated circuit 924 for performing part or all of the processing defined in the method. Processor 920, memory 922, dedicated IC 924 and communication element 926 may be connected to each other via an interconnect 930, say a bus. The processor system 910 may be arranged for contact and/or contact-less communication, using an antenna and/or connectors, respectively.

(108) For example, in an embodiment, processor system 940, e.g., the issuer device, selector device, or receiver device, may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc. In an embodiment, the processor circuit may be ARM Cortex M0. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software.

(109) Typically, the devices each comprise a microprocessor which executes appropriate software stored at the devices; for example, that software may have been downloaded and/or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the devices may, in whole or in part, be implemented in programmable logic, e.g., as field-programmable gate array (FPGA). The devices may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), e.g., an integrated circuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL etc.

(110) In an embodiment, the issuer device comprises an identifier generation circuit, an attribute signing circuit, and a data entry signing unit. In an embodiment, the selector device comprises a selection circuit and a proving circuit. In an embodiment, the receiver device comprises a verification circuit. The devices may comprise additional circuits. The circuits implement the corresponding units described herein. The circuits may be a processor circuit and storage circuit, the processor circuit executing instructions represented electronically in the storage circuits. A processor circuit may be implemented in a distributed fashion, e.g., as multiple sub-processor circuits. Part of the storage may be read-only. The circuits may also be, FPGA, ASIC or the like. A storage may be distributed over multiple distributed sub-storages. Part or all of the memory may be an electronic memory, magnetic memory, etc. For example, the storage may have volatile and a non-volatile part.

(111) It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments.

(112) In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb ‘comprise’ and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article ‘a’ or ‘an’ preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

(113) In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Selective disclosure of attributes and data entries of a record

Assignee

Inventors

Cpc classification

Classification Explorer

H04L2209/88

ELECTRICITY

Classification Explorer

H04L9/3231

ELECTRICITY

Classification Explorer

G06F16/2379

PHYSICS

Classification Explorer

H04L9/3247

ELECTRICITY

Classification Explorer

H04L9/30

ELECTRICITY

Classification Explorer

H04L9/3218

ELECTRICITY

Classification Explorer

H04L2209/42

ELECTRICITY

International classification

Classification Explorer

H04L9/32

ELECTRICITY

Classification Explorer

G06F16/23

PHYSICS

Classification Explorer

H04L9/30

ELECTRICITY

Abstract

Claims

Description