anonymous video rental store

I couldn't sleep last night and, as is often the case, my brain gets a  
mind of its own and starts thinking irrelevant thoughts.  The irrelevant  
thought that occupied my brain's mind last night was "anonymous video  
rental store - Is it possible?"

Ignoring for the moment the "fact" that video rental stores will some day  
go the way of the dinosaurs, would it be possible to structure a video  
rental store with the following properties:

1) The store could not track which customers rented which tapes.

2) The store *could* tell which tapes get rented and which tapes do not  
get rented.  The store would adjust it's selection of tapes based in this  
information. (get more of the popular tapes, remove the unpopular ones)

3) The store could some how penalize customers that returned tapes late,  
or not at all.  The nature of the "penalty" is flexible.  This implies  
that the store could somehow verify that the tape a customer returned is  
the same tape the customer rented, but without discovering which tape it  
is.  (I believe this is the hard part)


I have a partial solution.  Here it is:

The store is arranged like a Blockbuster video store in that there are a  
bunch of shelves with videos on them.  For each video, there is a box  
describing the video and a variable number of tapes co-located with the  
box.  In a Blockbuster video store, the tapes are in plastic cases that  
identify the video on the tape. In the AVRS (Anon Video Rental Store), the  
plastic cases would not contain any identification.  However, the tapes  
themselves *would* contain some kind of identification (stickers with  
video name and bar code, for example)

When a customer enters the AVRS, it (the customer) grabs a random handful  
of tokens from an "available" bin.  These tokens each contain a unique  
identifier.  The customer walks around the store searching for videos.   
When the customer finds a video, it takes one of the plastic cases  
(opening it to verify it really is the movie it wants).  The customer  
inserts one of the tokens into a pocket that exists on the outside of the  
plastic case.  The pocket is transparent and the token's identification  
number can be seen.

The customer selects the videos it wants, inserting tokens into pockets.   
When the customer is done, it returns the unused tokens to the "available"  
bin and proceeds to the check-out counter.

The customer hands the clerk an AVRS id card.  The AVRS id card contains  
information about the customer (TBD).  The clerk at the checkout counter  
scans the id card and the tokens that were placed in plastic case pockets.   
From this information, the AVRS knows that the customer identified by the  
AVRS id card has rented N tapes on a given day.  (Actually, all the clerk  
*really* knows is that the customer has rented N tokens.)  The clerk  
collects some money, the customer leaves with the plastic cases, tapes,  
and tokens.

The customer returns to the store a couple of days later.  The customer  
removes the tokens from the case pockets.  The customer places the plastic  
cases (with tape inside) in a "tape return" bin and places the tokens in a  
"token return" bin, and then leaves.

Periodically throughout the day, a clerk examines the tapes in the "tape  
return" bin.  The clerk opens each case and scans the bar code on the  
tape.  This way the AVRS can track which tapes get rented and which tapes  
do not get rented.  The clerk returns the plastic cases (with tapes) to  
the shelves.

At the end of the day, a clerk collects the tokens from the "token return"  
bin and scans them.  The computer marks the tokens as returned and clears  
the appropriate customer record.  The clerk places the tokens in the  
"available" bin.

----

The most obvious problem with this scheme is that the store has no way of  
knowing if the tape the customer returned is the same tape the customer  
rented.  A customer could return a blank tape without getting caught.

(A less obvious problem with the scheme is that the store could use  
surveillance cameras to identify which tapes the customer selected, but I  
chose to ignore that problem.)

The problem to solve, then is: how can the store catch dishonest  
customers, yet be unable to track which customer rented which video?

There needs to be an additional step at the time a customer returns a  
tape.  The store needs to be able verify that the tape a customer is  
returning is a tape that was rented from that store and is not overdue.   
The store doesn't need to know what tape it is, or who is returning it,  
just that it came from that store and is not overdue.  If the tape *is*  
overdue, then the customer must personally return the tape to a clerk and  
pay a fine. (and risk a bit of anonymity)

Perhaps we could embed some electronics in the tape cassette (or sticker)  
that would enable a clerk to store a signed "due-back" timestamp on the  
cassette without being able to store any information that would identify  
the tape.  The signed timestamp would have to be transferred through the  
plastic case, since opening the case would reveal the tape inside.  Sounds  
sort of like a blind signature.

Needless to say, it should be difficult for the customer to tamper with  
the information on the cassette.

Any comments or better ideas?


Jim_Miller@suite.com

> 
> 
> 
> I couldn't sleep last night and, as is often the case, my brain gets a  
> mind of its own and starts thinking irrelevant thoughts.  The irrelevant  
...
> 1) The store could not track which customers rented which tapes.
> 
> 2) The store *could* tell which tapes get rented and which tapes do not  
> get rented.  The store would adjust it's selection of tapes based in this  
> information. (get more of the popular tapes, remove the unpopular ones)
> 
> 3) The store could some how penalize customers that returned tapes late,  
> or not at all.  The nature of the "penalty" is flexible.  This implies  
> that the store could somehow verify that the tape a customer returned is  
> the same tape the customer rented, but without discovering which tape it  
> is.  (I believe this is the hard part)
...
> Jim_Miller@suite.com

One easy way around this is to have completely anonymous customers:
The store doesn't record any id at all.  The simplest way to do this
is to have customers make a cash deposit large enough to cover
replacement costs of the videos.  You would have to limit the number
of videos, especially/only for those without a track record.

You could even leave an anon email id to allow them to remind you to
return an overdue video, etc.

The only risk here is that someone besides the account owner might
'close' the account and take the deposit.  A good 'id' card/number
should solve that.

Actually, around here, that isn't too far from what you end up with
after being a customer for a year: I've moved, changed phone numbers
and have a new VISA, since the old one expired.  I'm sure they still
have my dr. lic. num and maybe even my ssn though.

Not even knowing that you're a customer seems better than trying not
to track which videos you have.

How about an anon deposit service that multiple companies (utilities,
etc.) could put claims on, similar to VISA holds.

sdw
-- 
Stephen D. Williams  Local Internet Gateway Co.; SDW Systems 513 496-5223APager
LIG dev./sales       Internet: sdw@lig.net CIS 76244.210@compuserve.com
OO R&D Source Dist.  By Horse: 2464 Rosina Dr., Miamisburg, OH 45342-6430
GNU Support          ICBM: 39 34N 85 15W I love it when a plan comes together

-----BEGIN PGP SIGNED MESSAGE-----

> How about an anon deposit service that multiple companies (utilities,
> etc.) could put claims on, similar to VISA holds.

The ideal implementation would be as a cash pool: you put in a total
of $X to cover your utility and service deposits, then provide
potential claimants with blinded withdrawal tokens.

So, when I go to Huntsville Utilities and ask them to turn on the
power at my house, rather than writing a check or giving them personal
information, I just tell give them a blinded token which they could
use to withdraw $X from my account at the Austin-Internet Credit
Union.

One potential problem is that some services (phone, gas, water)
require physical location information as part of their service. You
have to give the correct physical address for infrastructure services,
but you could give a false name. Other services, though, like the video
rental store, probably wouldn't care. 

Another problem is how you ensure security of transactions: you don't
want the service provider to debit the account unnecessarily, and the
service provider will want to keep you from closing the account and
leaving them without payment. I suspect that a properly blinded
protocol would work but haven't brainstormed one yet.

- -Paul

- -- 
Paul Robichaux, KD4JZG     | Richard Davis was twice convicted of kidnapping. 
Intergraph Federal Systems | He was released twice; then he killed Polly Klass.
Not speaking for Intergraph| Why wasn't he in jail? Why's he still alive? 


-----BEGIN PGP SIGNATURE-----
Version: 2.3a

iQCVAgUBLQ8vPyA78To+806NAQEdhgQAjm6DkMBN+S9UTgN1bSPruCVcFOQS1Rer
wmqjAYQITvSWNMVanV9x852BbM4JMo6cWrbrN6ArUzBd1LBf5uE/3kzeMzTM4Nbn
2u+NRl64AzBo84BXH/MBjU7g1G9e98Qb/HrrMKvPeC3BpZhiF3vW+vwYu2lBp2vM
l+v0ReWcGQc=
=drlP
-----END PGP SIGNATURE-----