# PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments
## 4 System and Security Model
### Security Model
If \(uid\in\mathcal{Q}_{\mathsf{HU}}\), then it removes \((uid,usk,upk,utk,\{m_{j}\}_{j\in[1,q]},ucred)\) from \(\mathcal{Q}_{\mathsf{HU}}\) and adds \(uid\) to \(\mathcal{Q}_{\mathsf{CU}}\). Finally, it returns \((usk,upk,utk,\{m_{j}\}_{j\in[1,q]},ucred)\). \(-\mathcal{O}_{\mathsf{Obt}}(uid,\mathcal{D},\mathsf{CTX}):\) an oracle that can be used to play the honest ticket issuuer issuing a ticket on an honest user \(uid\). If \(uid\in\mathcal{Q}_{\mathsf{CU}}\), it returns \(\bot\); otherwise, it runs \((yst,tkt,dsid,VP,\mathsf{CTX})\leftarrow\mathsf{PriSign.ObtTkt}\langle \mathsf{U}(usk,upk,ucred,\{m_{j}\}_{j\in[1,q]},\mathcal{D},\mathsf{CTX}) \leftrightarrow\mathsf{I}(isk,ipk,icred)\rangle\). Finally, it adds \((uid,\)\(pst,tkt,dsid,VP,\mathsf{CTX})\) to \(\mathcal{Q}_{\mathsf{TKT}}\). \(-\mathcal{O}_{\mathsf{Obt}_{\mathsf{U}}}(uid,\mathcal{D},\mathsf{CTX}):\) an oracle that can be used to play the corrupted ticket issuer issuing a ticket to an honest user \(uid\). If \(uid\in\mathcal{Q}_{\mathsf{CU}}\), it returns \(\bot\); otherwise, it runs \((pst,tkt,dsid,VP,\mathsf{CTX})\leftarrow\mathsf{PriSign.ObtTkt}\langle \mathsf{U}(usk,upk,ucred,\{m_{j}\}_{j\in[1,q]},\mathcal{D},\mathsf{CTX}) \leftrightarrow\mathcal{A}(\cdot,ipk,icred)\rangle\), where the ticket issuer's side is executed by the adversary. Finally, it adds \((uid,pst,tkt,dsid,VP,\mathsf{CTX})\) to \(\mathcal{Q}_{\mathsf{TKT}}\). \(-\mathcal{O}_{\mathsf{Obt}_{\mathsf{U}}}(uid,\mathcal{D},\mathsf{CTX}):\) an oracle that can be used to play the honest ticket issuuer issuing a ticket to a corrupt user \(uid\). If \(uid\
otin\mathcal{Q}_{\mathsf{CU}}\), it returns \(\bot\); otherwise, it runs \((pst,tkt,dsid,VP,\mathsf{CTX})\leftarrow\mathsf{PriSign.ObtTkt}\langle \mathcal{A}(\cdot,\mathcal{D},\mathsf{CTX})\leftrightarrow\mathsf{I}(isk, ipk,icred)\rangle\), where the user's side is executed by the adversary. Finally, it adds \((uid,pst,tkt,*,VP,\mathsf{CTX})\) to \(\mathcal{Q}_{\mathsf{TKT}}\), where \(*\) is unknown. \(-\mathcal{O}_{\mathsf{Sign}}(uid,\vec{u},vid,\vec{v}):\) an oracle that can be used to play an honest user \(uid\) with an attribute vector \(\vec{u}\) creating a token to a designated verifier \(vid\) with the policy \(\vec{v}\). If \(uid\in\mathcal{Q}_{\mathsf{CU}}\), it returns \(\bot\); otherwise, it runs \(tok\leftarrow\mathsf{PriSign.SignOn}(tkt,dsid,VP,\vec{u},mpk)\). Finally, it adds \((uid,tok,\vec{u},\vec{v},vid)\) to \(\mathcal{Q}_{\mathsf{TOK}}\) and returns \(tok\). \(-\mathcal{O}_{\mathsf{UnI}\mathsf{Cred}_{\mathsf{U}}}(uid_{0},uid_{1},\mathcal{ D},\mathsf{CTX})\): a challenge oracle in the unlinkability of credentials experiment, where the adversary playing as the ticket issuer is challenged to distinguish credential presentations computed by two different users. It takes two identities of users \((uid_{0},uid_{1})\) and an attribute disclosure policy \(\mathcal{D}\) as inputs, then runs \((pst_{b},tkt_{b},dsid_{b},VP_{b},\mathsf{CTX})\leftarrow\mathsf{PriSign.ObtTkt} \langle\mathsf{U}(usk_{b},upk_{b},ucred_{b},\{m_{bj}\}_{j\in[1,q]},\mathcal{D}, \mathsf{CTX})\leftrightarrow\mathsf{I}(isk,ipk,icred)\rangle\), where \(b\in\{0,1\}\). Finally, it returns \(pts_{b}\). Note that the attributes disclosed by both users should be the same, i.e., \(\forall j\in\mathcal{D},m_{0j}=m_{1,j}\). \(-\mathcal{O}_{\mathsf{UnI}\mathsf{Tkt}_{b}}(uid_{0},uid_{1},\vec{u},vid,\vec{v },\mathsf{CTX})\): a challenge oracle in the unlinkability of tokens experiment, where the adversary playing as a designated ticket verifier \(vid\) with the policy \(\vec{v}\) is challenged to distinguish access tokens computed by two different users. It takes two identities of users \((uid_{0},uid_{1})\) and an attribute vector \(\vec{u}\) that matches the policy \(\vec{v}\) (i.e., \(\mathcal{F}(\vec{u},\vec{v})=0\)) as inputs.