Is there a way to authenticate users online without knowing their real identity yet preventing them from registering twice? If not, what is the least amount of information you would need? If it helps, you may assume the user has a smart phone and you have access to all its sensors. Probabilistic guarantees are quite acceptable (e.g., 1-$\epsilon$ certainty of uniqueness for small $\epsilon$).
1 Answer
The easiest way would be to make use of a trusted third party. In this way, users can authenticate to the trusted party (maybe with the cellphone/IMEI number) which then issues them with a "ticket" or "group/blind signature" along with a pseudo-identity, similar to those used in e-voting schemes. The pseudo-identities can then be checked for duplicates.
Without a third party, I think it will be hard for you to proof that each user is unique even if you have access to all his sensors. e.g. user can always change his current location to change the gps, temperature, illumination, and humidity sensor readings.
-
$\begingroup$ I was thinking of obtaining biometric not ambient signals from the phone; audio, video, and fingerprints. What trusted third parties can you recommend? $\endgroup$– EmreFeb 8, 2014 at 19:56
-
$\begingroup$ Usually schemes for anonymity (e.g. www0.cs.ucl.ac.uk/staff/l.capra/publications/querciaTATA06.pdf) will make use of PKI for signatures, so the trusted party would be a CA in this case. Other schemes (e.g. blackhat.com/presentations/bh-usa-07/Lindell/Presentation/…) do not require a third party but are more complex in implementation. $\endgroup$– jingyangFeb 9, 2014 at 5:20