Achieving Rights Untransferability with Client-Independent Servers

This article presents a scheme for enforcing access rights untransferability in a client-server scenario. Assumptions include a central authority and servers which are trusted and hold no access information about clients. For a client sharing none of her rights, usurpation of a right seems as hard as the discrete logarithm. Also, rights sharing between clients does not compromise their non-shared rights when a sound public-key cryptosystem is used. Transferring rights between clients without the authority’s contribution cannot be done if a sound public-key cryptosystem is used. However, only control on partial rights transfers is addressed in this paper, which does not deal with total identity transfer or alienation.