Anonymous selectable credential system and method therefor

A method for a user to access a service in a communication network, comprising:

• acquiring one or more root credentials, each one of which is issued for a user right;
• selecting a set of user rights;
• generating one or more anonymous selectable credentials from the root credentials that respond to the selected set of user rights;
• transmitting the anonymous selectable credentials;
• and
• performing knowledge proof to anonymously prove via any one of the anonymous selectable credentials that the set of user rights was authorized.

A communication device for authorizing a user to access a service in a communication network, comprising:

• an initialization unit, being adapted to set system parameters and publish public parameters;
• a communication unit, being adapted to receive information on user identity, intended service and intended user rights;
• and
• an authorization unit, being adapted to generate root credentials for the user to use in generating one or more anonymous selectable credentials, wherein each root credential corresponds to a user right.

A method for authorizing a user to access a service in a communication network, comprising:

• setting system parameters and publishing public parameters;
• receiving information on user identity, intended service and intended user rights;
• and
• generating root credentials for the user for use in generating one or more anonymous selectable credentials, wherein each root credential corresponds to a user right.

A communication device for providing service to authorized users in a communication network, comprising:

• a communication unit, being adapted to receive information on a set of user rights and an anonymous selectable credential corresponding to the set of user rights;
• an anonymous selectable credential verification unit, being adapted to verify the anonymous selectable credential to determine whether the set of user rights was authorized;
• and
• a service unit, being adapted to provide service to the user according to the verified user rights.

A method for providing service to authorized users in a communication network, comprising:

• receiving information on a set of user rights and an anonymous selectable credential corresponding to the set of user rights;
• verifying the anonymous selectable credential to determine whether the set of user rights was authorized;
• and
• providing service to the user according to the verified user rights.

A communication system comprising at least one credential authority device, at least one user device and at least one service device coupled via a communication network, wherein

• the credential authority device comprises an authorization unit adapted to generate root credentials, each one of which corresponds to a user right;
• the user device comprises a right selecting unit adapted to select a set of user rights;
• an anonymous selectable credential generating unit adapted to generate one or more anonymous selectable credentials from the root credentials that correspond to the selected set of user rights;
• and a knowledge proving unit adapted to perform knowledge proof with the service device to anonymously prove via the anonymous selectable credential presented to the service device that the set of user rights was authorized by the credential authority;
• and
• the service device comprises an anonymous selectable credential verification unit adapted to verify the anonymous selectable credential presented by the user device;
• and a service unit adapted to provide service to the user device according to the verified user rights.

A method for a communication system comprising at least one credential authority device, at least one user device and at least one service device coupled via a communication network, the method comprising:

• the credential authority device generating root credentials, wherein each root credential corresponds to one of user rights;
• the credential authority device sending the root credentials to the user device;
• the user device selecting a set of user rights and generating one or more anonymous selectable credentials from the root credentials that correspond to the selected set of user rights;
• the user device presenting one of the anonymous selectable credentials to the service device;
• the user device performing knowledge proof with the service device to anonymously prove via the presented anonymous selectable credential that the set of user rights was authorized by the credential authority;
• and
• the service device providing service to the user device according to the verified user rights.

A manufactured article having a machine readable medium with instructions recorded thereon which, when executed by one or more processors, causes the processor to:

• acquire one or more root credentials, each one of which is issued for a user right;
• select a set of user rights;
• generate one or more anonymous selectable credentials from the root credentials that correspond to the selected set of user rights;
• transmit anonymous selectable credentials;
• and
• perform knowledge proof to anonymously prove via any one of the anonymous selectable credentials that the set of user rights was authorized.

A manufactured article having a machine readable medium with instructions recorded thereon which, when executed by one or more processors, causes the processor to:

• set system parameters and publish public parameters;
• receive information on user identity, intended service and intended user rights;
• and
• generate root credentials for the user to use in generating one or more anonymous selectable credentials, wherein each root credential corresponds to a user right.

A manufactured article having a machine readable medium with instructions recorded thereon which, when executed by one or more processors, causes the processor to:

• receive information on a set of user rights and an anonymous selectable credential corresponding to the set of user rights;
• verify the anonymous selectable credential to determine whether the set of user rights was authorized;
• and
• provide service to the user according to the verified user rights.