Service discovery is essential in wireless communications. However, existing protocols provide limited privacy protection, leaking sensitive device information and opening routes to network attacks. This paper proposes a private service discovery protocol, called PriSrv, which enables both service providers and clients to specify fine-grained authentication policies before establishing connections. PriSrv achieves this via a dual-layer matching architecture: an outer layer filters mismatched entities using public attributes, while an inner layer handles mutual authentication using selectively disclosed private attributes. As a core component, we introduce the primitive of anonymous credential-based matchmaking encryption (ACME), which enables dual-layer matching in a single step to achieve bilateral policy control, selective attribute disclosure, and multi-show unlinkability. To instantiate ACME, we design a fast anonymous credential (FAC) scheme providing constant-size credentials and efficient verification. We demonstrate PriSrv's interoperability by integrating it with popular wireless frameworks including EAP, mDNS, BLE, and AirDrop. Detailed formal security proofs and extensive performance evaluations across desktop, laptop, smartphone, and Raspberry Pi platforms demonstrate that PriSrv provides enhanced privacy guarantees with high usability, achieving secure discovery in less than one second on mainstream mobile devices.

翻译：服务发现是无线通信中的关键环节。然而，现有协议提供的隐私保护有限，会泄露敏感的设备信息，并为网络攻击开辟途径。本文提出了一种名为PriSrv的私有服务发现协议，使服务提供商和客户端在建立连接前能够指定细粒度的认证策略。PriSrv通过双层匹配架构实现该功能：外层利用公共属性过滤不匹配的实体，内层则使用选择性披露的私有属性处理相互认证。作为核心组件，我们引入了基于匿名凭证的匹配加密原语（ACME），该原语可在单一步骤中实现双层匹配，从而达成双边策略控制、选择性属性披露以及多次展示的不可关联性。为实例化ACME，我们设计了一种快速匿名凭证（FAC）方案，该方案提供恒定大小的凭证和高效验证。通过将PriSrv集成到包括EAP、mDNS、BLE和AirDrop在内的主流无线框架中，我们展示了其互操作性。在桌面、笔记本、智能手机和Raspberry Pi平台上进行的详细形式化安全证明及全面的性能评估表明，PriSvr在主流移动设备上可于1秒内完成安全发现，以高可用性提供了增强的隐私保障。