# PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments
## 4 System and Security Model
### Overflow of PriSign  
As shown in Figure 1, the working flow of a PriSign scheme is described as follows. CA initializes the system and outputs public parameter \(pp\), a main key pair \((msk,mpk)\), and a user registration list \(\mathcal{L}\) (\(\mathsf{PriSign.Setup}\) step 1). To be a legitimate ticket issuer, I generates a private and public key pair \((isk,ipk)\) (\(\mathsf{PriSign.IssuerKeyGen}\) 2) and authenticates to CA to obtain their public key credential _icred_ (\(\mathsf{PriSign.IssuerKeyGen}\) 3). To achieve stable policy key generation in an unstable cloud environment, CA issues keys to \(n\) policymakers such that \(t\) of these policymakers cooperate to generate the complete policy keys for verifiers (\(\mathsf{PriSign.PolMakKeyGen}\) step 4); \(t\) policymakers then generate a share of the policy key for the respective verifier with identity _vid_ and policy \(\vec{v}\) (\(\mathsf{PriSign.IssuKeyGen}\) step 5) and the verifier aggregates the \(t\) shares into a complete policy key \(tk_{vid,\vec{v}}\) (\(\mathsf{PriSign.AggrPolKey}\) step 6). Suppose a verifier with policy \(\vec{v}\) is offline. In this case, \(t\) policymakers can cooperate to issue a new key \(tk_{vid,\vec{v}}\) with the policy \(\vec{v}\) for a proxy verifier with identity _vid_'; this proxy verifier can replace the offline verifier to complete the verification of tokens that are designated to be verified by the offline verifier. When joining the system, each U generates a private and public key pair \((usk,upk)\) and a tracing key \(utk\) (\(\mathsf{PriSign.UserKeyGen}\) step 7), then U authenticates to CA to obtain their attribute-based credentials _ucred_ (\(\mathsf{PriSign.UserReg}\) step 8). To obtain a ticket, U authenticates to I by computing a credential presentation \(pst\) and disclosing a subset of attributes, then I issues a ticket \(tkt\) for U (\(\mathsf{PriSign.OptTkt}\) step 9). At this point, CA can trace the identities of users (\(\mathsf{PriSign.Trace}\) step 10). When accessing a designated service, U computes an access token of the ticket using an attribute vector \(\vec{u}\) that matches the designated verifier's policy \(\vec{v}\) (\(\mathsf{PriSign.SignOn}\) step 10). The designated  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Description** \\ \hline \(1^{\lambda}/\epsilon(\lambda)\) & security parameter/negligible function \\ \(x\xleftarrow{\mathbb{R}}\)\(\mathbb{Z}\) & \(x\) is randomly selected from the set \(\mathbb{Z}\) \\ \([1,q]\) & set \(\{1,2,\cdots,q\}\) \\ \(\mathcal{D}\) & a subset of \([1,q]\) \\ \(q\) & number of user attributes \\ \(n/t\) & number of policymakers/threshold value \\ \(k\) & length of verifier’s policy \\ \(pp/\mathcal{L}\) & public parameters/user registration list \\ \(msk/mpk\) & private key of system/public key of system \\ \(isk/ipk/icred\) & private key/public key/c credential of I \\ \(psk_{i}/ppk_{i}\) & private/verification key of \(\mathsf{P}_{i}\) \\ \(vid/\vec{v}/td_{vid,\bar{u}}\) & identity/policy/policy key of V \\ \(uid/usk/upk/utk\) & identity/secret/public/tracing key of U \\ \(\{m_{j}\}_{j\in[1,q]}/ucred\) & attributes/c credential of U \\ \(dsid/VP\) & double-spending identity/validity period \\ \(\vec{u}\) & attribute vector that matches a policy \\ \(tkt/tok\) & ticket/token of U \\ \(\mathcal{D}/1\) & set/number of indexes for disclosed attributes \\ CTX & random value \\ HASH & collision resistant hash functions: \(\{0,1\}^{*}\rightarrow\mathbb{Z}_{p}^{*}\) \\ HASH\({}^{\prime}\) & collision resistant hash functions: \(\{0,1\}^{*}\rightarrow\mathbb{G}_{1}^{*}\) \\ \(\bot\) & failed identifier \\ \hline \hline \end{tabular}
\end{table}
Table 3: Summary of notation.  
verifier with the policy key \(tk_{vid,\vec{v}}\) verifies the validity of the token and detects whether it is double-spending (\(\mathsf{PriSign.Verify\ step\)\(\{\}\)).