Skip to main content
SpringerLink
Log in

Privacy in e-Shopping Transactions: Exploring and Addressing the Trade-Offs

  • Conference paper
  • First Online:
Cyber Security Cryptography and Machine Learning (CSCML 2018)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10879))

  • 1141 Accesses

Abstract

The huge growth of e-shopping has brought convenience to customers, increased revenue to merchants and financial entities and evolved to possess a rich set of functionalities and requirements (e.g., regulatory ones). However, enhancing customer privacy remains to be a challenging problem; while it is easy to create a simple system with privacy, this typically causes loss of functions.

In this work, we look into current e-shopping infrastructures and aim at enhancing customer privacy while retaining important features and requiring the system to maintain the topology and transaction flow of established e-shopping systems that are currently operational. Thus, we apply what we call the “utility, privacy, and then utility again” paradigm: we start from the state of the art of e-shopping (utility); then we add privacy enhancing mechanisms, reducing its functionality in order to tighten privacy to the fullest (privacy); and finally, we incorporate tools which add back lost features, carefully relaxing privacy this time (utility again).

We also implemented and tested our design, verifying its reasonable added costs.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://www.eugdpr.org/.

  2. 2.

    https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en.

  3. 3.

    As well as many proposals in non-academic forums. See, for instance, https://z.cash/ (a modified implementation of Zerocash) and https://cryptonote.org/.

  4. 4.

    Key-privacy security requires that an eavesdropper in possession of a ciphertext not be able to tell which specific key, out of a set of known public keys, is the one under which the ciphertext was created, meaning the receiver is anonymous from the point of view of the adversary.

  5. 5.

    https://en.wikipedia.org/wiki/Address_Verification_System.

  6. 6.

    https://magento.com/sites/default/files/White%20Paper%20-%20Magento%202.0%20Performance%20and%20Scalability%2003.31.16.pdf.

  7. 7.

    https://usa.visa.com/dam/VCOM/global/about-visa/documents/visa-facts-figures-jan-2017.pdf.

References

  1. Abe, M., Fujisaki, E.: How to date blind signatures. In: Kim, K., Matsumoto, T. (eds.) ASIACRYPT 1996. LNCS, vol. 1163, pp. 244–251. Springer, Heidelberg (1996). https://doi.org/10.1007/BFb0034851

    Chapter  Google Scholar 

  2. Aiello, B., Ishai, Y., Reingold, O.: Priced oblivious transfer: how to sell digital goods. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 119–135. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44987-6_8

    Chapter  Google Scholar 

  3. Androulaki, E., Bellovin, S.M.: APOD: anonymous physical object delivery. In: Privacy Enhancing Technologies, pp. 202–215 (2009)

    Chapter  Google Scholar 

  4. Bellare, M., Boldyreva, A., Desai, A., Pointcheval, D.: Key-privacy in public-key encryption. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 566–582. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45682-1_33

    Chapter  MATH  Google Scholar 

  5. Ben-Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., Virza, M.: Zerocash: decentralized anonymous payments from bitcoin. In: 2014 IEEE Symposium on Security and Privacy, pp. 459–474 (2014)

    Google Scholar 

  6. Benjumea, V., Choi, S.G., Lopez, J., Yung, M.: Fair traceable multi-group signatures. In: Tsudik, G. (ed.) FC 2008. LNCS, vol. 5143, pp. 231–246. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-85230-8_21

    Chapter  Google Scholar 

  7. Boneh, D., Sahai, A., Waters, B.: Functional encryption: definitions and challenges. In: Ishai, Y. (ed.) TCC 2011. LNCS, vol. 6597, pp. 253–273. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-19571-6_16

    Chapter  Google Scholar 

  8. Brassard, G., Chaum, D., Crépeau, C.: Minimum disclosure proofs of knowledge. J. Comput. Syst. Sci. 37(2), 156–189 (1988)

    Article  MathSciNet  Google Scholar 

  9. Camenisch, J., Dubovitskaya, M., Neven, G.: Oblivious transfer with access control. In: ACM CCS, CCS 2009, pp. 131–140. ACM (2009)

    Google Scholar 

  10. Camenisch, J., Lysyanskaya, A.: Dynamic accumulators and application to efficient revocation of anonymous credentials. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 61–76. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45708-9_5

    Chapter  Google Scholar 

  11. Camenisch, J., Piveteau, J.-M., Stadler, M.: An efficient fair payment system. In: ACM Conference on Computer and Communications Security, pp. 88–94 (1996)

    Google Scholar 

  12. Campanelli, M., Gennaro, R., Goldfeder, S., Nizzardo, L.: Zero-knowledge contingent payments revisited: attacks and payments for services. In: Proceedings of the 2017 ACM SIGSAC CCS, pp. 229–243 (2017)

    Google Scholar 

  13. Chaum, D.: Blind signatures for untraceable payments. In: Chaum, D., Rivest, R.L., Sherman, A.T. (eds.) Advances in Cryptology, pp. 199–203. Springer, Boston (1983). https://doi.org/10.1007/978-1-4757-0602-4_18

    Chapter  Google Scholar 

  14. Chaum, D., van Heyst, E.: Group signatures. In: Davies, D.W. (ed.) EUROCRYPT 1991. LNCS, vol. 547, pp. 257–265. Springer, Heidelberg (1991). https://doi.org/10.1007/3-540-46416-6_22

    Chapter  Google Scholar 

  15. Coull, S.E., Green, M., Hohenberger, S.: Access controls for oblivious and anonymous systems. ACM Trans. Inf. Syst. Secur. 14, 10:1–10:28 (2011). http://doi.acm.org/10.1145/1952982.1952992

    Article  Google Scholar 

  16. Danezis, G., Domingo-Ferrer, J., Hansen, M., Hoepman, J.-H., Le Metayer, D., Tirtea, R., Schiffner, S.: Privacy and data protection by design-from policy to engineering. Technical report, ENISA (2014)

    Google Scholar 

  17. Danezis, G., Kohlweiss, M., Livshits, B., Rial, A.: Private client-side profiling with random forests and hidden Markov models. In: Fischer-Hübner, S., Wright, M. (eds.) PETS 2012. LNCS, vol. 7384, pp. 18–37. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31680-7_2

    Chapter  Google Scholar 

  18. Davida, G., Frankel, Y., Tsiounis, Y., Yung, M.: Anonymity control in E-cash systems. In: Hirschfeld, R. (ed.) FC 1997. LNCS, vol. 1318, pp. 1–16. Springer, Heidelberg (1997). https://doi.org/10.1007/3-540-63594-7_63

    Chapter  Google Scholar 

  19. Diaz, J., Arroyo, D., de Borja Rodríguez, F.: libgroupsig: an extensible C library for group signatures. IACR Cryptology ePrint Archive, 2015:1146 (2015)

    Google Scholar 

  20. Diaz, J., Choi, S.G., Arroyo, D., Keromytis, A.D., Rodriguez, F.B., Yung, M.: Privacy threats in e-Shopping (position paper). In: Garcia-Alfaro, J., Navarro-Arribas, G., Aldini, A., Martinelli, F., Suri, N. (eds.) DPM/QASA -2015. LNCS, vol. 9481, pp. 217–225. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-29883-2_14

    Chapter  Google Scholar 

  21. Diaz, J., Choi, S.G., Arroyo, D., Keromytis, A.D., Rodriguez, F.B., Yung, M.: A methodology for retrofitting privacy and its application to e-Shopping transactions (2018, to appear)

    Google Scholar 

  22. Diffie, W., Hellman, M.E.: New directions in cryptography. IEEE Trans. Inf. Theor. 22(6), 644–654 (1976)

    Article  MathSciNet  Google Scholar 

  23. Dingledine, R., Mathewson, N., Syverson, P.: Tor: the second-generation onion router. In: USENIX Security Symposium, SSYM 2004, Berkeley, CA, USA, pp. 21–21. (2004)

    Google Scholar 

  24. Garman, C., Green, M., Miers, I.: Accountable privacy for decentralized anonymous payments. IACR Cryptology ePrint Archive, 2016:61 (2016)

    Google Scholar 

  25. Gentry, C.: Fully homomorphic encryption using ideal lattices. In: Mitzenmacher, M. (ed.) 41st ACM STOC, pp. 169–178. ACM Press, May/June 2009

    Google Scholar 

  26. Goldwasser, S., Micali, S., Rackoff, C.: The knowledge complexity of interactive proof systems. SIAM J. Comput. 18(1), 186–208 (1989)

    Article  MathSciNet  Google Scholar 

  27. Greenwood, D., Stopczynski, A., Sweatt, B., Hardjono, T., Pentland, A.: The new deal on data: a framework for institutional controls. In: Privacy, Big Data, and the Public Good: Frameworks for Engagement, p. 192 (2014)

    Google Scholar 

  28. Jacobson, M., M’Raïhi, D.: Mix-based electronic payments. In: Tavares, S., Meijer, H. (eds.) SAC 1998. LNCS, vol. 1556, pp. 157–173. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48892-8_13

    Chapter  Google Scholar 

  29. Kiayias, A., Tsiounis, Y., Yung, M.: Traceable signatures. In: Cachin, C., Camenisch, J.L. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 571–589. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24676-3_34

    Chapter  Google Scholar 

  30. Libert, B., Peters, T., Yung, M.: Group signatures with almost-for-free revocation. In: Safavi-Naini, R., Canetti, R. (eds.) CRYPTO 2012. LNCS, vol. 7417, pp. 571–589. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-32009-5_34

    Chapter  Google Scholar 

  31. Libert, B., Yung, M.: Fully forward-secure group signatures. In: Naccache, D. (ed.) Cryptography and Security: From Theory to Applications. LNCS, vol. 6805, pp. 156–184. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-28368-0_13

    Chapter  Google Scholar 

  32. Miers, I., Garman, C., Green, M., Rubin, A.D.: Zerocoin: anonymous distributed e-cash from bitcoin. In: 2013 IEEE Symposium on Security and Privacy (2013)

    Google Scholar 

  33. Minkus, T., Ross, K.W.: I know what you’re buying: privacy breaches on eBay. In: De Cristofaro, E., Murdoch, S.J. (eds.) PETS 2014. LNCS, vol. 8555, pp. 164–183. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08506-7_9

    Chapter  Google Scholar 

  34. Nakamoto, S.: Bitcoin: a peer-to-peer electronic cash system (2009). http://www.bitcoin.org/bitcoin.pdf

  35. Nakanishi, T., Haruna, N., Sugiyama, Y.: Unlinkable electronic coupon protocol with anonymity control. ISW 1999. LNCS, vol. 1729, pp. 37–46. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-47790-X_4

    Chapter  Google Scholar 

  36. Partridge, K., Pathak, M.A., Uzun, E., Wang, C.: PiCoDa: privacy-preserving smart coupon delivery architecture (2012)

    Google Scholar 

  37. ITU-T Recommendation. X.509. Information technology - open systems interconnection - the directory: authentication framework, June 1997

    Google Scholar 

  38. Rial, A., Kohlweiss, M., Preneel, B.: Universally composable adaptive priced oblivious transfer. In: Shacham, H., Waters, B. (eds.) Pairing 2009. LNCS, vol. 5671, pp. 231–247. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-03298-1_15

    Chapter  Google Scholar 

  39. Rivest, R.L., Shamir, A., Adleman, L.M.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)

    Article  MathSciNet  Google Scholar 

  40. Ruiz-Martinez, A.: Towards a web payment framework: State-of-the-art and challenges. Electron. Commer. Res. Appl. 14, 345–350 (2015)

    Article  Google Scholar 

  41. Sander, T., Ta-Shma, A.: Flow control: a new approach for anonymity control in electronic cash systems. In: Franklin, M. (ed.) FC 1999. LNCS, vol. 1648, pp. 46–61. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48390-X_4

    Chapter  Google Scholar 

  42. Stolfo, S., Yemini, Y., Shaykin, L.: Electronic purchase of goods over a communications network including physical delivery while securing private and personal information of the purchasing party. US Patent App. 11/476,304, 2 November 2006

    Google Scholar 

  43. Tan, C., Zhou, J.: An electronic payment scheme allowing special rates for anonymous regular customers. In: DEXA Workshops, pp. 428–434 (2002)

    Google Scholar 

  44. Toubiana, V., Narayanan, A., Boneh, D., Nissenbaum, H., Barocas, S.: Adnostic: privacy preserving targeted advertising. In: NDSS (2010)

    Google Scholar 

Download references

Acknowledgements

The work of Jesus Diaz was done in part while visiting the Network Security Lab at Columbia University. The work of Seung Geol Choi was supported in part by the Office of Naval Research under Grant Number N0001415WX01232. The work of David Arroyo was supported by projects S2013/ICE-3095-CM (CIBERDINE) and MINECO DPI2015-65833-P of the Spanish Government. The work of Francisco B. Rodriguez was supported by projects MINECO TIN2014-54580-R and TIN2017-84452-R of the Spanish Government. The work of Moti Yung was done in part while visiting the Simons Institute for Theory of Computing, UC Berkeley.

Author information

Authors and Affiliations

  1. Blue Indico - BEEVA, Madrid, Spain

    Jesus Diaz

  2. United States Naval Academy, Annapolis, USA

    Seung Geol Choi

  3. Universidad Autónoma de Madrid, Madrid, Spain

    David Arroyo & Francisco B. Rodriguez

  4. Georgia Institute of Technology, Atlanta, USA

    Angelos D. Keromytis

  5. Columbia University, New York, USA

    Moti Yung

Authors
  1. Jesus Diaz
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Seung Geol Choi
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. David Arroyo
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Angelos D. Keromytis
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Francisco B. Rodriguez
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Moti Yung
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jesus Diaz .

Editor information

Editors and Affiliations

  1. Ben-Gurion University of the Negev, Beer Sheva, Israel

    Itai Dinur

  2. Ben-Gurion University of the Negev, Beer Sheva, Israel

    Shlomi Dolev

  3. Tata Consultancy Services (India), Chennai, Tamil Nadu, India

    Sachin Lodha

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG, part of Springer Nature

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Diaz, J., Choi, S.G., Arroyo, D., Keromytis, A.D., Rodriguez, F.B., Yung, M. (2018). Privacy in e-Shopping Transactions: Exploring and Addressing the Trade-Offs. In: Dinur, I., Dolev, S., Lodha, S. (eds) Cyber Security Cryptography and Machine Learning. CSCML 2018. Lecture Notes in Computer Science(), vol 10879. Springer, Cham. https://doi.org/10.1007/978-3-319-94147-9_17

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-94147-9_17

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-94146-2

  • Online ISBN: 978-3-319-94147-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation