Privacy-Preserving Electronic Ticket Scheme with Attribute-Based Credentials

Users accessing services are often required to provide personal information, for example, age, profession and location, in order to satisfy access polices. This personal information is evident in the application of e-ticketing where discounted access is granted to visitor attractions or transport services if users satisfy policies related to their age or disability or other defined over attributes. We propose a privacy-preserving electronic ticket scheme using attribute-based credentials to protect users' privacy. The benefit of our scheme is that the attributes of a user are certified by a trusted third party so that the scheme can provide assurances to a seller that a user's attributes are valid. The scheme makes the following contributions: (1) users can buy different tickets from ticket sellers without releasing their exact attributes; (2) two tickets of the same user cannot be linked; (3) a ticket cannot be transferred to another user; (4) a ticket cannot be double spent. The novelty of our scheme is to enable users to convince ticket sellers that their attributes satisfy the ticket policies and buy discounted tickets anonymously. This is a step towards identifying an e-ticketing scheme that captures user privacy requirements in transport services. The security of our scheme is proved and reduced to a well-known complexity assumption. The scheme is also implemented and its performance is empirically evaluated.

1 Introduction

Due to their flexibility and portability, electronic ticket (e-ticket) systems have been extensively investigated by both industry [1], [2] and the academic research communities [3], [4], [5]. E-tickets are attractive to transport operators as well as customers because they can reduce paper costs (tickets can be stored on a hand-held device) and improve customer experience (tickets can be purchased and delivered any time and anywhere). However, the use of e-tickets also raises many questions regarding the privacy of its users due to the possibility of linking different e-ticket transactions to a particular user –in contrast to anonymous paper-based tickets– and thus potentially revealing private information, e.g., working patterns, likely places of work, etc.