Anonymous authentication scheme for XML security standard with Refreshable Tokens
Rie Shigetomi, Akira Otsuka, Hideki Imai · 2003
Anonymity is a highly desired feature in Internet transactions. On the other hand, unconditional anonymity may contain some traps. For instance, it may cause irresponsible, or even criminal, use of the Internet. Thus, it would be desirable to have revocable anonymity in our internet applications. In this work, we suggest an anonymous authentication scheme for WS-Security. Our scheme assures the user's anonymity but the server can check, and even reject without unveiling the user's identification the user's right for accessing a specific service. The main tools which we use to achieve our rejectable anonymous protocols are "Refreshable Tokens". Our scheme does not require any active trusted third party in contrast to previous works in the literature. However, in situations where the identity of a user suspect of malicious act is required, the server could be easily to deny the user's service.