# PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments
## 2 Related Work and Comparison  
[PERSON] et al. [4] proposed an ASSO scheme suitable for the Global System for Mobile communication (GSM) system, in which the GSM network operator provides a single sign-on service for users. They combined the security features of GSM with digital signatures to allow users to access arbitrary third-party services anonymously. In their scheme, a new one-time identity is generated and used to authenticate a trusted third party (TTP) each time a user accesses a service. After authenticating the user, TTP forwards the one-timeidentity of the user to the service provider; therefore, the service provider cannot infer the user's real identity from this one-time identity. Although their scheme achieves the unlinkability of user identities, it makes the verification services vulnerable to a single point of failure due to the need for the TTP when verifying user service requests. In our scheme, users can directly access services without TTP involvement. [PERSON] et al. [5] proposed a generic construction of dynamic ASSO schemes with strong security based on CCA-secure broadcast encryption [11; 12], strongly existentially unforgeable signature [13; 14], and zero-knowledge proof [15; 16]. In their construction, registered users can obtain an encrypted credential of their public key from an identity provider (IDP) along with the set of services they want to access. Users can use this credential to access all designated services without requiring different credentials for different services. Furthermore, when the user presents their credentials, a zero-knowledge proof of the user's private key should be computed to prevent the sharing of credentials. Unfortunately, as all designated verifiers can know users' public keys, this scheme cannot achieve unlinkability of user identities. [PERSON] et al. [6] proposed a generic construction of the ASSO scheme that is transformed from dynamic group signatures [17; 18]. In their scheme, users register with a central authority and obtain a group signing key. When accessing a service, a user generates a group signature using his group signing key. The service provider checks whether the user is authorized to access the service by verifying the correctness of the group signature. In addition, the central authority can use the tracing algorithm of the group signature scheme to trace users' identities. However, all service providers can verify users' access requests; in our scheme, on the other hand, a user can designate the verifier of service requests. [PERSON] et al. [7] proposed a provably secure ASSO scheme based on extended Chebyshev chaotic maps [19; 20]. In their scheme, an issuer generates ephemeral keys to users and service providers. When accessing a service, a user and a service provider need to use their ephemeral keys to exchange a session key to grant the service. Compared to the scheme based on modular exponential computations of the elliptic curve, their scheme is more efficient; however, each service provider knows user identities when generating session keys, which compromises user privacy. [PERSON] et al. [8] utilized [PERSON] and colleagues' BBS+ signature [21] and zero-knowledge proof of knowledge [22] in constructing an ASSO scheme for designated services. The main contribution of their construction is to protect the privacy of both user identities and their service requests. Their scheme allows users to obtain tickets from the ticket issuers in order to access multiple services, while the tickets contain a set of authentication tags that can only be verified by designated verifiers. Designated verifiers can verify that their corresponding tags cannot be linked to the user's service request. However, unlike our scheme, their scheme does not support fine-grained access control of tickets nor proxy re-verification of access tokens. Recently, [PERSON] et al. [9] proposed a new ASSO scheme with proxy re-verification using BBS+ Signature [21], zero-knowledge proof of knowledge [22], and identity-based encryption [23; 24].