A Low-Cost Privacy-Preserving Digital Wallet for Humanitarian Aid Distribution

A Low-Cost Privacy-Preserving Digital Wallet for Humanitarian Aid Distribution

Speakers: Eva Luvison, Sylvain Chatel, Justinas Sukaitis, Vincent Graf Narbel, Carmela Troncoso, Wouter Lueks

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=Ifmhmu5tga8

Overview

In this compelling talk from IEEE S&P, Eva Luvison and her co-authors present a novel solution for digitizing humanitarian aid distribution, specifically focusing on budget allocation. The international committee of the Red Cross (ICRC), one of the world's largest NGOs, currently grapples with an antiquated, pen-and-paper system for registering aid recipients and distributing goods, cash, or medication. This traditional approach is plagued by inefficiencies, security vulnerabilities, human error, and a critical lack of privacy for beneficiaries. The presented work introduces a low-cost, privacy-preserving digital wallet designed to overcome these challenges, offering a robust and practical alternative for distributing aid in resource-constrained environments.

The core of the research addresses the digitization of budget allocation, where a "mutual currency" controlled by the ICRC is distributed per household. This system enables multiple household members to spend from a shared budget while maintaining real-time updates and ensuring recipient privacy. The talk highlights the necessity of a solution that functions without constant internet connectivity, leverages low-cost technologies, provides auditable records for donors, and most importantly, keeps recipients indistinguishable from one another. By tackling these intricate requirements, the team delivers a system that not only streamlines aid operations but also significantly enhances the security and dignity of beneficiaries.

This work is particularly significant because it bridges advanced cryptographic research with urgent real-world humanitarian needs. It moves beyond previous efforts to digitize in-kind distribution and cash transfers by focusing on the unique complexities of a shared household budget in offline settings. The proposed digital wallet represents a substantial leap forward, promising to transform how aid is delivered, making it faster, more secure, more accountable, and fundamentally more respectful of the privacy of vulnerable populations.

Background

▶ Watch: Introduction: Problems with current aid distribution (0:00)

The ICRC's current aid distribution methodology, heavily reliant on manual, pen-and-paper processes, presents a myriad of operational and security challenges. The registration of beneficiaries and allocation of aid—whether goods, cash, or medication—is inherently slow. People often gather in large groups at distribution points, creating potential security risks and making them vulnerable targets. The manual nature of data recording is prone to human error, which can lead to misallocations or discrepancies. Furthermore, the need for the ICRC to track monthly distributions or transactional data for cash transfers fundamentally compromises recipient privacy, creating detailed records of individuals' aid consumption.

Recognizing these severe limitations, the ICRC has sought to digitize its processes. While the digitization of in-kind distribution has been addressed by prior work (e.g., by Wong et al.), and cash transfer programming often relies on third-party providers, the specific challenge of allocating a budget through a mutually controlled digital currency remained unsolved. This talk specifically targets this gap, aiming to create a system where the ICRC can allocate a budget per household, allowing multiple members to access and spend from a shared pool of funds. The system needed to be robust, meaning each household would be provided with several tokens (e.g., smart cards) to ensure continued access even if one token was lost or damaged.

Discussions with the ICRC led to the definition of four crucial requirements for the new system:

1. Low Connectivity and Technology: The system must function effectively in environments with limited or no internet connectivity, utilizing low-cost, accessible technologies.
2. Household-based Distribution: Aid should be allocated per household, with multiple token holders able to spend from a shared budget.
3. Auditability: The system must provide verifiable records, allowing the ICRC to demonstrate to external donors that funds have been spent wisely and transparently.
4. Recipient Privacy: Crucially, recipients must remain indistinguishable from one another during transactions and throughout the system's operation, protecting their sensitive personal information.

To align with the ICRC's existing workflow, the system defines five interacting parties:

• Recipient: The individual receiving aid.
• Registration Station: Where recipients register and receive their smart cards (tokens) with an allocated budget.
• Vendor: Merchants where recipients can purchase goods using their smart cards.
• Reclaim Station: Where vendors periodically (e.g., monthly) submit their accumulated transactions to receive real cash.
• Auditor: An entity that verifies transactions made by the reclaim station and, by extension, the vendors.

The primary technical hurdle identified was synchronizing the budget on multiple smart cards within the same household without requiring constant network connectivity, all while preserving recipient privacy and meeting stringent security requirements. This complex interplay of operational constraints, security needs, and privacy imperatives forms the foundational context for the proposed digital wallet system.

Key Findings

▶ Watch: Key requirements: connectivity, household, auditable, privacy (2:15)

The research successfully designed and evaluated a novel privacy-preserving humanitarian budget allocation workflow that addresses the critical shortcomings of traditional aid distribution methods. The key findings demonstrate a practical and robust solution for the ICRC and similar organizations operating in challenging, low-connectivity environments.

Firstly, the developed system demonstrably meets all the stringent requirements defined in collaboration with the ICRC. It operates effectively without requiring constant internet connectivity, leverages low-cost smart card technology, and facilitates household-based budget allocation with multiple token holders. Crucially, it provides a comprehensive audit trail for donor accountability while ensuring strong recipient privacy, making beneficiaries indistinguishable from one another.

Secondly, the system offers significant advantages over the previous pen-and-paper process. It drastically improves efficiency by digitizing registration and transaction processes, reducing the time recipients spend waiting and mitigating the security risks associated with large gatherings. It minimizes human error inherent in manual record-keeping and provides a more secure and auditable mechanism for tracking aid distribution.

Finally, a rigorous evaluation confirmed the system's practicality in humanitarian settings. The analysis of transaction costs, in terms of both data transfer and time, showed that the approach is viable for common distribution programs. Specifically, for programs serving up to 8,000 households, the total cost of a single transaction was found to be under 20 seconds. Even for larger distribution programs, the transaction time remained under 1 minute, a critical metric for real-world deployment where speed and efficiency are paramount. These findings underscore that advanced cryptographic techniques can be effectively integrated into solutions for resource-constrained environments, delivering tangible benefits for humanitarian operations.

Technical Deep Dive

▶ Watch: Main challenges: synchronization, privacy, no connectivity (4:05)

The core challenge in designing this digital wallet was to synchronize household budgets across multiple smart cards without connectivity, all while preserving privacy and ensuring security. The authors meticulously defined a threat model and then constructed a system leveraging advanced cryptographic primitives to address these complex requirements.

Threat Model

The security and privacy guarantees of the system are predicated on a carefully considered threat model:

• Recipients: Are assumed to be potentially malicious; they might attempt to cheat during registration or transaction phases (e.g., trying to spend more than their allocated budget). However, they also desire to maintain their privacy.
• Registration Station, Reclaim Station, and Vendor: Are assumed to be honest with respect to performing their designated operational roles within the system. They will correctly execute protocols for registration, transactions, and reclaiming funds.
• Financial Malice: The Vendor and Reclaim Station can be malicious with respect to money. For instance, a vendor might collude with recipients to fraudulently reclaim more money than they actually transacted, or a reclaim station might falsely claim funds from the ICRC.
• Privacy Adversaries: The Vendor, Registration Station, Reclaim Station, and even Auditors are all considered potential adversaries with respect to user privacy. They might collude or individually attempt to link transactions to specific recipients or households.
• Communication: All communications are assumed to occur over authenticated communication channels, meaning parties can verify the identity of their communication partners, preventing man-in-the-middle attacks on channel integrity.

Main Challenges

Given the threat model and the ICRC's requirements, several critical challenges emerged:

1. Synchronization without Connectivity: How to ensure that if one member of a household spends from the shared budget, other members' tokens reflect the updated balance, all without real-time network access between tokens or a central online server.
2. Recipient Privacy: Maintaining the indistinguishability of recipients throughout the transaction, reclaim, and audit phases. This is particularly difficult because the system needs to update a household's budget, which implies identifying the household to some degree, but without revealing the specific recipient or linking them to their spending patterns.
3. Security Requirements:

• Recipients must not be able to spend more than their allocated household budget.
• Vendors must not be able to reclaim more money than they have legitimately sold for.
• The entire system must be auditable by the ICRC and external donors.

1. Privacy during Database Access: Because there is no connectivity, the database containing current household budgets must be stored on the vendor's side. Updating this database after a transaction, while ensuring the vendor cannot determine which household's budget is being updated, is a significant privacy challenge.

Core System Components and Cryptographic Building Blocks

To overcome these challenges, the system relies on a combination of hardware security and advanced cryptographic techniques:

1. Smart Cards (Secure Elements): Each recipient token is a smart card, assumed to be a secure element. This means the card can securely store cryptographic keys, perform operations (like signing or encryption) internally, and resist physical tampering attempts to extract secrets. Crucially, all tokens within the same household share a common secret key, which is fundamental for the ORAM instantiation.

1. Cryptographic Building Blocks:

• Digital Signatures: Used for authentication and non-repudiation, ensuring that transactions are signed by legitimate parties (e.g., vendors signing receipts, smart cards signing spending requests) and cannot be later denied.
• Homomorphic Commitments: These allow a party to commit to a value without revealing it, and later open the commitment, proving that the committed value was indeed the one agreed upon. This can be used for privacy-preserving budget updates or proofs of solvency.
• Authenticated Encryption (AE): Combines confidentiality and integrity, ensuring that data is both encrypted (private) and tamper-proof. This is vital for protecting sensitive budget data stored on potentially untrusted vendor systems.
• Message Authentication Codes (MACs): Provide data integrity and authenticity without encryption. They ensure that a message has not been altered and originated from a trusted source.

1. Oblivious RAM (ORAM): This is the most innovative and critical component for achieving privacy in the face of disconnected operations and vendor-side database storage. An Oblivious RAM allows a client (in this case, the smart card acting on behalf of a recipient) to access or update data on an untrusted server (the vendor's system) in such a way that the server learns nothing about the client's access patterns. That is, the server cannot tell which specific data item is being accessed or updated.

• Application: When a recipient wants to buy goods, their smart card needs to update the household's budget stored on the vendor's system. ORAM ensures that the vendor cannot observe which household's budget is being accessed or how frequently. This directly addresses the privacy requirement that recipients (and their households) remain indistinguishable.
• Instantiations: The authors explored two ways to instantiate the ORAM:
• Naive ORAM: In this simpler version, for each transaction, the entire database of household budgets is retrieved from the vendor, decrypted by the smart card (using the common secret key shared by the household's tokens), the relevant budget is updated, and then the entire database is re-encrypted and sent back to the vendor. This is feasible because the tokens within a household share a common secret key, allowing them to collectively manage the household's budget state, and the database sizes are manageable.
• Recursive Tree-Based ORAM: This is a more sophisticated and generally more efficient ORAM construction, especially for larger databases. While the talk mentions it, the specifics of its implementation within this system are not detailed, but it offers better asymptotic performance in terms of communication and computation overhead compared to the naive approach. The evaluation compares both.

By integrating these components, the system creates a robust framework where a recipient can present their smart card to a vendor. The smart card, using ORAM, interacts with the vendor's local budget database to deduct the purchase amount, ensuring the vendor cannot link the transaction to a specific household. The updated budget is then securely stored back on the vendor's system. The smart card also records the transaction for the recipient, and the vendor records it for later reclamation. This intricate design ensures both security (no overspending, auditable records) and privacy (recipients indistinguishable, access patterns hidden) even in environments lacking constant network connectivity.

Demo / Proof of Concept

▶ Watch: Technical building blocks including Oblivious RAM (5:10)

While the talk did not present a live demonstration in the traditional sense, the authors provided a rigorous evaluation of their system to demonstrate its practical viability in humanitarian settings. This evaluation serves as the critical proof of concept, illustrating that the proposed cryptographic architecture is not merely theoretical but can perform efficiently under realistic constraints.

The evaluation focused on two key metrics:

1. Cost per transaction: Measured in terms of data transfer volume.
2. Time per transaction: The duration required to complete a single purchase and budget update.

The team compared the performance of both the naive ORAM instantiation and the more advanced recursive tree-based ORAM instantiation. These comparisons were made across varying numbers of households in the system, simulating different scales of aid distribution programs.

The results of this evaluation were highly encouraging:

• For common distribution programs involving up to thousands of households, the approach proved to be eminently practical.
• Specifically, for programs serving up to 8,000 households, the total cost of a single transaction (including all cryptographic operations and data transfers) was consistently under 20 seconds. This is a crucial benchmark for real-world usability, as long transaction times can lead to bottlenecks and frustration at distribution points.
• Even for significantly larger distribution programs, the transaction time remained under 1 minute. While not as fast as the smaller-scale performance, a sub-minute transaction time is still highly acceptable in many humanitarian contexts, especially when compared to the multi-hour or multi-day delays often associated with manual, paper-based systems.

These findings validate the system's design, demonstrating that the overhead introduced by advanced privacy-preserving techniques like Oblivious RAM, when carefully implemented with secure elements like smart cards, does not render the system impractical. The ability to achieve sub-minute transaction times for thousands of households, without relying on constant network connectivity, underscores the significant potential for this digital wallet to revolutionize humanitarian aid distribution. It provides concrete evidence that the system can scale and perform reliably in the very environments it is designed to serve.

Defensive Implications

▶ Watch: Evaluation results: practicality and performance (6:30)

The digital wallet system presented by Luvison et al. offers profound defensive implications for humanitarian organizations like the ICRC, as well as broader lessons for secure and private data management in disconnected or low-resource environments.

For humanitarian aid organizations, this work provides a robust blueprint for transitioning from vulnerable manual processes to a secure and privacy-preserving digital framework.

• Enhanced Security: By digitizing the registration and allocation process, the system inherently reduces the security risks associated with large gatherings of people waiting for aid. The use of smart cards as secure elements significantly mitigates fraud, as tokens are difficult to counterfeit or tamper with. The cryptographic protocols, including digital signatures and authenticated encryption, prevent unauthorized spending by recipients and fraudulent claims by vendors, addressing both recipient-side and vendor-side financial malice identified in the threat model.
• Improved Auditability and Accountability: The system's design incorporates mechanisms for auditors to verify transactions, ensuring transparency to external donors. This strengthens accountability, allowing the ICRC to prove responsible and wise expenditure of funds, which is critical for maintaining donor trust and securing future funding.
• Recipient Privacy and Dignity: Perhaps one of the most significant defensive implications is the inherent protection of recipient privacy. By making recipients indistinguishable among each other and hiding their access patterns using Oblivious RAM (ORAM), the system prevents the creation of detailed, centralized records of individual aid consumption. This protects vulnerable populations from potential exploitation, discrimination, or stigmatization based on their aid status, fostering trust and preserving their dignity.
• Operational Efficiency and Resilience: The system's ability to operate without constant internet connectivity, leveraging low-cost technologies, makes it resilient in remote or disaster-stricken areas where infrastructure is minimal or compromised. This ensures that aid distribution can continue effectively even in the most challenging operational environments, reducing delays and human error.

More broadly, for cybersecurity professionals and system architects, this research demonstrates how sophisticated cryptographic primitives can be applied to solve complex real-world problems, particularly in contexts with severe resource and connectivity constraints.

• Practical ORAM Deployment: The successful deployment and evaluation of ORAM in this context highlight its potential beyond theoretical discussions. It provides a concrete example of how to protect data access patterns when sensitive databases must reside on potentially untrusted local systems. This could inspire similar solutions for other edge computing or disconnected scenarios where privacy is paramount.
• Secure Element Integration: The reliance on smart cards as secure elements underscores their importance in building trust anchors in distributed systems, especially when dealing with physical tokens and offline operations.
• Threat Modeling for Hybrid Adversaries: The detailed threat model, considering both financial and privacy adversaries, and acknowledging the potential for insider collusion, serves as an excellent example for designing robust security architectures. It emphasizes that a comprehensive approach must account for various motivations and capabilities of different actors within a system.

In essence, this work provides both a specific, actionable solution for humanitarian aid and a powerful case study for integrating advanced security and privacy technologies into practical, low-resource applications, offering valuable lessons for defenders across various domains.

Key Takeaways

• The talk presents a practical and privacy-preserving digital wallet system for humanitarian aid budget allocation, directly addressing the inefficiencies and security risks of traditional pen-and-paper methods used by organizations like the ICRC.
• The system is designed to operate in low-connectivity environments, support household-based budgets with multiple token holders, provide full auditability for donors, and ensure strong recipient privacy by making beneficiaries indistinguishable.
• Core technical innovations include the use of smart cards as secure elements and Oblivious RAM (ORAM) to hide access patterns to the budget database stored on vendor systems, thereby protecting recipient privacy without requiring constant network synchronization.
• Evaluation results demonstrate the system's practicality, with transaction times under 20 seconds for up to 8,000 households and remaining under 1 minute for larger distribution programs, making it viable for real-world humanitarian deployment.
• This work significantly improves upon existing aid distribution methods by enhancing speed, reducing human error, bolstering security against fraud, and critically, preserving the privacy and dignity of aid recipients.
• It serves as a compelling example of how advanced cryptographic research can be successfully applied to solve urgent, real-world problems in resource-constrained settings, offering valuable lessons for secure system design in similar contexts.

About the Speaker(s)

The primary presenter of this work was Eva Luvison, who introduced herself at the beginning of the talk. While specific titles and affiliations for all speakers were not detailed in the transcript, the collaborative nature of the research, involving multiple authors (Sylvain Chatel, Justinas Sukaitis, Vincent Graf Narbel, Carmela Troncoso, Wouter Lueks), suggests a team of dedicated researchers, likely from academic institutions (such as EPFL, where Professors Troncoso and Lueks are known for their work in privacy engineering) and potentially in partnership with humanitarian organizations like the ICRC, given the direct relevance and engagement mentioned in the talk. Eva Luvison's clear articulation of the problem, the technical solution, and its practical implications highlights her role as a key contributor to this important research in privacy-preserving technologies for social good.