A Privacy-Preserving Information-Sharing Protocol for Federated Authentication

2025-12-01

AI Summary

In federated authentication systems, a privacy-security paradox arises: identity providers (IdPs) must detect cross-domain duplicate or fraudulent registrations while preventing leakage of users’ sensitive attributes or enabling cross-domain linkage. To resolve this, we propose a pseudonymous identifier mechanism based on oblivious pseudorandom functions (OPRFs) and domain-specific transformations. This mechanism enables globally consistent identity verification under full input confidentiality and, integrated with a blinded registration authority, supports a decentralized authentication framework. Experiments demonstrate efficient cross-domain uniqueness verification without exposing raw identity data, significantly mitigating identity spoofing. The scheme simultaneously achieves strong privacy guarantees—formally satisfying *k*-anonymity and unlinkability—and practical anti-fraud utility. It provides a scalable, standards-compatible, privacy-enhancing solution for multi-domain federated authentication.

Technology Category

• Application Domains: Security
• Machine Learning: Privacy
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Systems and Infrastructure for Web, Mobile and WoT: Decentralized Web and Fediverse systems

Abstract

This paper presents a privacy-preserving protocol for identity registration and information sharing in federated authentication systems. The goal is to enable Identity Providers (IdPs) to detect duplicate or fraudulent identity enrollments without revealing users personal data or enabling cross-domain correlation. The protocol relies on Oblivious Pseudorandom Functions (OPRFs) combined with domain-specific transformations, ensuring that each IdP generates independent pseudonymous identifiers derived from a shared cryptographic service while maintaining full input confidentiality. A central authority maintains a blind registry that records successful and failed identity verifications using only pseudonymous identifiers, allowing global consistency checks without exposing sensitive information or linking users across domains. The proposed construction provides a general and abstract framework suitable for a wide range of federated authentication systems, achieving strong privacy guarantees while supporting effective fraud-prevention mechanisms during identity registration.

Problem

• Detect duplicate or fraudulent identity enrollments across federated systems
• Share identity information without revealing personal user data
• Prevent cross-domain correlation while enabling global consistency checks

Innovation

• Uses Oblivious Pseudorandom Functions for privacy
• Employs domain-specific transformations to prevent cross-domain correlation
• Maintains a blind registry for global consistency checks