Privacy - Preserving Credit

Typically, when a borrower (Bob) wishes to establish a tradeline (e.g., a mortgage, an automobile loan, or a credit card) with a lender (Linda), Bob is subjected to a credit check by Linda. The credit check is done by having Linda obtain financial information about Bob in the form of a credit report. Credit reports are maintained by Credit Report Agencies, and contain a large amount of private information about individuals. Furthermore, Linda’s criteria for loan qualification are also private information. We propose a “privacypreserving” credit check scheme that allows Bob to have his credit checked without divulging private information to Linda while protecting Linda’s interests. We give protocols for achieving the above while: i) protecting Bob’s private information, ii) making sure that Bob cannot lie about his credit (thus Linda is assured that the information is accurate), iii) that Linda’s qualification criteria are protected, and iv) that the CRA does not learn from the protocols anything other than “Bob requested a loan from Linda”. What distinguishes this work from the traditional two-party privacy-preserving framework is (i) the need for secure and privacy-preserving third-party verification of the accuracy of the inputs used, and (ii) the fact that the function being computed is private to the lender and should not be revealed to either the borrower or to the above-mentioned third-party verifier. Although we choose to present the techniques of this paper for the credit checking application domain, they have much broader applicability and in fact work for any situation where there is a repository of public and private information about individuals, that is subsequently used for making decisions that impact the individuals (a credit rating agency is but one example of such a repository). Portions of this work were supported by Grants IIS0325345, IIS-0219560, IIS-0312357, and IIS-0242421 from the National Science Foundation, Contract N00014-02-10364 from the Office of Naval Research, by sponsors of the Center for Education and Research in Information Assurance and Security, and by Purdue Discovery Park’s eenterprise Center. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. EC’05, June 5–8, 2005, Vancouver, British Columbia, Canada. Copyright 2005 ACM 1-59593-049-3/05/0006 ...$5.00.