영지식 증명을 활용한 프라이버시 보장 신용평가방법
Privacy-Preserving Credit Scoring Using Zero-Knowledge Proofs
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
현재의 신용평가체계에서는 신용정보회사가 개인의 신용정보를 금융기관으로부터 수집하고 이를 기반으로 신용평가를 수행한다. 하지만 이런 신용평가방법은 민감한 신용정보가 하나의 중앙기관에 집중되기에 프라이버시 침해 소지가 있으며, 외부의 공격이 성공할 경우 대규모의 개인정보가 유출될 수 있다. 본 논문에서는 이 문제를 해결하기위해 개인이 스스로 금융기관으로부터 수집한 신용정보를 바탕으로 신용점수를 계산하고, 이 신용점수가 정상적으로계산되었음을 영지식 증명과 블록체인으로 증명하는 프라이버시 보장 신용평가방법을 제안한다. 또한 영지식 증명에이용된 신용정보가 금융기관에서 실제로 제공한 값인지 블록체인을 통해 확인하기 위해, 커밋된 입력에 대해 효율적으로 증명이 가능한 영지식 증명 기법을 제안한다. 이 기법은 Agrawal 등의 기법과 달리 완벽한 영지식성을 제공하며, CRS와 증명의 크기가 작고 증명과 검증 과정이 빠르다. 그리고 제안한 신용평가방법에 실제 환경과 유사한신용점수 알고리즘을 적용하여 구현 및 실험함으로써 실제 환경에 이용 가능함을 확인하였다.
Abstract
In the current credit scoring system, the credit bureau gathers credit information from financial institutions and calculatesa credit score based on it. However, because all sensitive credit information is stored in one central authority, there arepossibilities of privacy violations and successful external attacks can breach large amounts of personal information. To handlethis problem, we propose privacy-preserving credit scoring in which a user gathers credit information from financialinstitutions, calculates a credit score and proves that the score is calculated correctly using a zero-knowledge proof and ablockchain. In addition, we propose a zero-knowledge proof scheme that can efficiently prove committed inputs to checkwhether the inputs of a zero-knowledge proof are actually provided by financial institutions with a blockchain. This schemeprovides perfect zero-knowledge unlike Agrawal et al.'s scheme, short CRSs and proofs, and fast proof and verification. Weconfirmed that the proposed credit scoring can be used in the real world by implementing it and experimenting with acredit score algorithm which is similar to that of the real world.
참고문헌 (25)
- H.A. Abdou, "Credit scoring, statistical techniques and evaluation criteria: a review of the literature", Intelligent Systems in Accounting, Finance and Management, 18(2-3), pp.59~88 (2011)
- "Public disclosure of personal credit scoring model" (2019)[URL]
- "The Equifax cyber attack - how it happened and how to protect yourself" (2019)[URL]
- "How to kill Equifax" (2019)[URL]
- "Trustless computing on private data" (2019)[URL]
- S. Agrawal, "Non-interactive zeroknowledge proofs for composite statements", CRYPTO 2018, pp.643~673 (2018)
- B. Parno, "Pinocchio: nearly practical verifiable computation", Symposium on Security and Privacy 2013, pp.238~252 (2013)
- J. Groth, "On the size of pairing-based non-interactive arguments", EUROCRYPT 2016, pp.305~326 (2016)
- D. Fiore, "Hash first, argue later: adaptive verifiable computations on outsourced data", ACM Conference on Computer and Communications Security 2016, pp.1304~1316 (2016)
- M. Campanelli, "LegoSNARK: modular design and composition of succinct zeroknowledge proofs", ACM Conference on Computer and Communications Security 2019, pp.2075~2092 (2019)
- N. Bitansky, "Succinct non-interactive arguments via linear interactive proofs", Theory of Cryptography Conference 2013, pp.315~333 (2013)
- "On Σ-protocols" (2019)[URL]
- A. Fiat, "How to prove yourself : practical solutions to identification and signature problems", CRYPTO '86, pp.186~194 (1986)
- T. P. Pedersen, "Non-interactive and information-theoretic secure verifiable secret sharing", CRYPTO '91, pp.129~140 (1991)
- E. Mays, "Handbook of credit scoring", pp.91~92 (2001), Glenlake Publishing Company
- B. W. Yap, "Using data mining to improve assessment of credit worthiness via credit scoring models", Expert Systems with Applications, 38(10), pp.13274~13283 (2011)
- P. S. Barreto, "Pairingfriendly elliptic curves of prime order", Selected Areas in Cryptography 2005, pp.319~331 (2005)
- E. Kiltz, "Quasi-adaptive NIZK for linear subspaces revisited", EUROCRYPT 2015, pp.101~128 (2015)
- M. Ajtai, "Generating hard instances of lattice problems (extended abstract)", ACM Symposium on Theory of Computing '96, pp.99~108 (1996)
- A. Kosba, "C∅C∅ : a framework for building composable zero-knowledge proofs", IACR (2015)
- Korea Internet & Security Agency, "Guideline for using cryptographic algorithms and key lengths", KISAGD-2018-0034, ~ (2018)
- Korea Internet & Security Agency, "Subscriber identification based on virtual ID", KCAC.TS.SIVID, ~ (2009)
- E.B. Sasson, "Zerocash: decentralized anonymous payments from Bitcoin", IEEE Symposium on Security and Privacy 2014, pp.459~474 (2014)
- "libsnark: a C++ library for zkSNARK proofs" (2019)[URL]
- "xJsnark" (2019)[URL]