A computer program product for zero-knowledge social graph management, with session-revealed identities, the computer program product comprising a non-transitory computer-readable storage medium having program instructions embodied therewith, wherein the program instructions are executable by a processor (202) for:
- receiving, by a user registration module (212), a first registration request, from a first user of a first user device, wherein the first registration request comprises a first user communication address;
- receiving, by the user registration module (212), a second registration request, from a second user of a second user device, wherein the second registration request comprises a second user communication address;
- generating, by a hash generation module (214), a first user communication address hash and a second user communication address hash by hashing the first user communication address and the second user communication address respectively;
- generating, by a key generation module (216), a first user's public key and a first user's private key corresponding to the first user, and a second user's public key and a second user's private key corresponding to the second user;
- storing, by a storage module (218), the first user communication address hash, the second user communication address hash, the first user's public key, and second user's public key on a server (108), thereby registering the first user and the second user;
- generating, by a connection request module (220), an encrypted first user identity packet comprised of personally identifiable information of the first user, wherein the encrypted first user identity packet is encrypted using the second user's public key;
- receiving, by the hash generation module (214), a communication address of the second user, wherein the communication address of the second user is entered by the first user at the first user device;
- hashing, by the hash generation module (214), the communication address of the second user to generate a second user communication address hash;
- receiving, by a connection request module (220), a connection request from the first user targeting the second user, wherein the connection request comprises the second user communication address hash and the encrypted first user identity packet;
- sending, by a notification module (222), the connection request bundled with the encrypted first user identity packet, to the second user device;
- decrypting, by a packet processing module (224), the first user identity packet with the second user's private key when the second user reviews the connection request, and revealing the personally identifiable information of the first user to the second user on the second user device;
- generating, by the hash generation module (214), a zero-knowledge social connection hash (ZKSC1) when the second user accepts the connection request from the first user, wherein the zero-knowledge social connection hash (ZKSC1) is generated by:
- applying a hashing algorithm to a combination of the first user communication address hash and the second user communication address hash to generate a social connection hash (SC1);
- generating a random number (R1) for the social connection between the first user and the second user based on a random number generation algorithm;
- generating a zero-knowledge social connection hash (ZKSC1) by applying the hashing algorithm to a combination of the social connection hash (SC1) and the random number (R1), wherein the zero-knowledge social connection hash (ZKSC1) provides cryptographic proof of connection existence without enabling reverse-engineering of the underlying communication addresses;
- storing, by the storage module (218), the random number (R1) and the zero-knowledge social connection hash (ZKSC1) on the server (108), wherein the random number (R1) is stored in association with the zero-knowledge social connection hash (ZKSC1);
- and
- verifying, by a verification module (226), the social connection between the first user and the second user upon initiation of an application session, by:
- regenerating a real-time social connection hash (SC2) based on the first user communication address hash and the second user communication address hash generated in real-time,
- retrieving the random number (R1) from the server (108),
- generating a real-time zero-knowledge social connection hash (ZKSC2) by applying the hashing algorithm to a combination of the real-time social connection hash (SC2) and the random number (R1), and
- comparing the real-time zero-knowledge social connection hash (ZKSC2) with the zero-knowledge social connection hash (ZKSC1) stored on the server (108) wherein the social connection is verified when the real-time zero-knowledge social connection hash (ZKSC2) matches the zero-knowledge social connection hash (ZKSC1) stored on the server (108).