JPH1083426A - Electronic cash method with monitoring institution, user device for implementing the method, and monitoring institution device - Google Patents

Abstract

(57) [Summary] [Problem] To enable monitoring of the issuance status of electronic cash for each bank. SOLUTION: A user U sends an issue of electronic cash of an amount X to a bank B together with a signature verification key N _U , and the bank B stores a pair of X and N _U in a user database corresponding to U and monitors the same. feed to the engine, and sends (X, N _U) signature for S _B (X, N _U) to generate the user U. Watchdog registers the monitoring database in correspondence with the total use amount Y of (X, N _U). The user sends the payment amount y, X, N _U , S _B (X, N _U ) and a signature S _U (e, y) to the information e from the retail store to the retail store, and the retail store sends the signature S
Verify _B (X, N _U ) and S _U (e, y) and get paid if correct. The retail store sends all the communication data H with the user to the monitoring organization, and the monitoring organization registers (X, N _U ) in the data H in the monitoring database, and updates the total payment amount Y + y to X.
If not exceed the payment amount of money y to instruct the bank to transfer money to the retail store of the account, to identify the unauthorized person Feed otherwise the (X, N _U) to the bank.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic cash system which can be used in a divided manner via a telecommunication system or via an IC card, guarantees privacy and realizes electronic cash which prevents unauthorized use. The present invention relates to a method and a user and monitoring institution apparatus for performing the method.

[0002]

2. Description of the Related Art Electronic funds transfer using telecommunications systems is becoming widespread. Generally, redeemable certificates (bills, checks, etc.) are symbolic functions of the certificate (the person holding the certificate is granted the rights described in the certificate)
It has. When a certificate is handled by a telecommunications system, the certificate is digitized data, and a copy can be easily created and illegally redeemed a plurality of times. When realizing electronic cash like a prepaid card,
This problem arises. That is, by copying the prepaid card, it is possible to illegally redeem the cash or purchase the product a plurality of times. On the other hand, with credit cards, there is almost no danger of such double use, but instead,
There is a disadvantage that the user's usage history is completely known to the card company (that is, privacy is not guaranteed). As a solution to these problems, there is a method of guaranteeing privacy and detecting double use of a card by devising data exchange between the card reader and the card at the time of cashing with a card having a calculation function. Has been proposed. For example, Chaum, Fiat, Naor: "Untraceable E
electronic Cash ", Proc. of CRYPTO'88.

[0003]

SUMMARY OF THE INVENTION However, Chaum
In the method of equal, the degree of safety (e.g., the probability of fraud is successful 1/2 ³⁰⁾ for securing the question in payment processing by electronic money for the retail user, the 3 steps of the response and the verification Since it is necessary to execute the process repeatedly (for example, 30 times) according to the security, the amount of mutual communication becomes considerably large. Further, the same issued electronic cash cannot be divided and used. The conventionally proposed split use principle of split-use electronic cash is based on mathematically sophisticated logic using a hierarchical structure, as shown in, for example, US Pat. No. 5,224,162. However, when this is actually performed, there are disadvantages in that the number of processing procedures is large and the amount of calculation is large. Originally, in the electronic cash implementation system, since the issuer of electronic cash and the financial institution that manages the user account are the same, it is configured on the assumption that each financial institution will issue electronic cash. The electronic cash is returned from the user to the issuing bank via a retail store and a bank. Accordingly, the amount of electronic cash issued by each financial institution cannot be monitored.

A first object of the present invention is to provide an electronic cash method which guarantees privacy and also prevents unauthorized use, in which the amount of communication in payment processing is small, and divisional use is possible. An object of the present invention is to realize an electronic cash method capable of monitoring the amount of cash issued. A second object of the present invention is to realize a user device and a monitoring institution device for implementing the above electronic cash method.

[0005]

The electronic cash method according to the present invention includes the following steps: (1) The user sends the user information U and the amount X corresponding to the face value of the electronic cash to the bank for use. Requesting that the amount X be withdrawn from the user's account, and (2) the bank shall reduce the amount X from the user's account and obtain the user's signature verification key N
A signature S _B (X, N _U ) of the bank is generated for _U and the amount X and sent to the user, and signature verification key information n including information on the amount X and the signature verification key N _U is provided. Is recorded in the user database in association with the user information U, and the signature verification key information n is sent to the monitoring organization. (3) The monitoring organization transmits the signature verification key information n to the total usage amount. Y
(4) The user registers the remaining amount x, the amount X, the signature verification key N _U ,
The signature S _B (X, N _U) payments and in the retail store the payment amount y using the information as electronic cash C of face value X containing said retail store receives and verifies the validity of said electronic cash, (5) The retail store requests the settlement by transmitting all the communication data H with the user including the information of the electronic cash C to the monitoring organization,
(6) The monitoring organization verifies the validity of the electronic cash C in the received communication data H, and instructs the bank to transfer the payment amount y to the account of the retail store.

[0006] In step (1) of the method, the user watchdog encryption key PK _T using the signature verification key N _U and amount X E set was obtained by encrypting the encryption function E _T containing _T ( X, N
_U ) and the amount X are sent to the bank and the monitoring institution, and the signature verification key N _U is pre-blind-signed and F (N _U ) is sent to the bank. In step (2), the bank corresponds to the user name U. E _T (X, N _U ) instead of recording the signature verification key information n in the database
And instead of directly signing (X, N _U )
Feed F a (N _U) blind signature for Z (N _U) to the user,
In step (4), the user may use the bank signature S _B (N _U ) obtained by the F (N _U ) blind post-processing as a part of the electronic cash.

[0007] A user device according to the present invention comprises a key generation means for generating a user signature key SK _U , a bank signature S _B (X, N _U ) for the amount X and the signature verification key N _U , x, the face value X, the electronic cash C containing the signature verification key N _U , the memory means for holding the signature key SK _U , the payment amount y and any information e received from the retail store. Signing is performed using the signature key SK _U, and a signature generating means for generating a signature S _U (e, y); and a balance updating means for subtracting the payment amount y from the balance x to update the balance. Including.

In the above-mentioned user apparatus, an encryption means is provided, and the amount X and the signature verification key N _U are used by using the encryption key of the monitoring organization.
Is encrypted and sent to the bank. Further, blind pre-processing means and blind post-processing means are provided to obtain the bank's blind signature Z (N _U ) for the signature verification key N _U , and the Z
(N _U) may be obtained bank signature S _B (N _U) from. The monitoring institution apparatus according to the present invention includes a monitoring database for registering the signature verification key information n corresponding to the user who has issued the electronic cash in association with the total usage amount Y, a balance x received from the retail store, and a face value. X, signature verification key N _U , bank signature S _B (X, N
_U ), a history database holding history data H including a payment amount y, and a signature verification key information n corresponding to the amount X and the verification key N _U in the history data H are stored in the monitoring database. If the signature verification key information is registered, means for determining whether or not the electronic cash is fraudulently used if not registered,
Adding means for adding the payment amount y in the history data H to the corresponding total usage amount Y in the monitoring database;
Comparing means for comparing the addition result Y + y by the adding means with the denomination X; and if the comparison result by the comparing means is Y + y <X, the corresponding total usage amount Y in the monitoring database is added to the addition result Y. + y, and if Y + y = X, delete the corresponding signature verification key information n and total usage amount Y in the monitoring database, and if Y + y> X, use the illegally used electronic cash. Control means for determining that there is, deleting said n and Y, and notifying said bank of said signature verification key information n.

[0009] In the above-mentioned surveillance engine device, decoding means is provided.
The encrypted information E from the user_T(X, N _U)
(X, N_U) May be registered in the monitoring database.
No. According to the present invention, the organization that issues electronic cash (silver
Line) and the institution (monitoring institution) that performs the verification process for settlement
Separate and monitor electronic cash flows issued by banks
Monitor traffic volume. On the other hand, the payment process of the user
By using a signing key, installments can be made
ing. In other words, the payment amount is signed by the user
Allows the user to pay more than a certain amount
If so, the wrongdoing can be presented as evidence.

[0010]

FIG. 1 shows an example of the configuration of a system to which the method of the present invention is applied. A device 100 of a monitoring agency that monitors the issuance of electronic cash (information representing this monitoring agency is denoted as T) and a device 200 of an agency that issues electronic cash (information representing this bank is denoted as B) are issued. Of the user using the electronic cash 300 (information representing this user is denoted by U) and a device of a retail store receiving the electronic cash from the user
400 (the information indicating this retail store is denoted by W) is connected via a communication line or the like. These may be connected via an IC card or the like capable of recording information. The digital signature used in the embodiments of the present invention described below is known in various forms as a well-established technique, and any of them may be used.

An electronic cash execution method of the present invention applied in the system configuration shown in FIG. 1 will be described below. First Embodiment (1) Electronic Cash Issuance Processing First, a case in which a user issues electronic cash is shown in FIG.
This will be described with reference to FIG.

[0012] Bank 200, pre-digital signature held in the public key PK _B and the memory 20M to generate a set of secret key SK _B of (Ikeno, Koyama et al., "Modern cryptography theory" of Electronics, Information and Communication Engineers, see, etc.) for I do. The secret key SK _B and a signature generation function S _B for generating a signature using the secret key SK _B are kept secret. Moreover, publishing the signature verification function V _B in order to verify the digital signature, the verification public key PK _B to be used for the signature verification function.

The user performs the following procedure to request that the same amount X as the face value of the issued electronic cash be withdrawn from the account (corresponding to the user information U) of the user 300 of the bank. Step 1: User 300 generates a digital signature key generation unit.
Using 301, a signature generation key SK _U and a signature verification key N _U are generated and recorded in the memory 30M. Therefore, the signature verification key N _U
Corresponds to the user information U.

An amount X equal to the face value of the electronic cash is used by the user 30.
A message requesting the user to withdraw from the account No. 0 and user information (user identification information or account number) U are sent to the bank 200 together with N _U. In this embodiment, a case will be described in which a signature verification key N _U is newly generated, that is, changed every time a user issues a new electronic cash.
As described later, the same signature verification key N _U may be used for a plurality of electronic cash.

Step 2: The bank 200 checks the balance of the account of the user 300, reduces X from the balance, and further associates (X, N _U ) with the user name U as signature verification key information. It is recorded in the user database 201. At that time, if there is a withdrawal request message with a digital signature of the user 300, that message is also recorded. Next, the bank
200 uses the signature creation unit 202 of the signature function S _B to obtain X, N
Digital signature S _B (X, N _U) of the bank 200 for the _U to calculate _{the, S B (X, N U} ) as well as send to the user 300, (X, N _U)
Is sent to the monitoring organization 100. Step 3: The user 300 S _B (X, N _U) of x, X, par with N _U X, electronic cash balance x C = {x, X, N U, S B (X, N U)} And stored in the memory 30M. However, the initial value of the balance x is x = X.

[0016] Step 4: regulators 100 registers (X, N _U) in the monitoring database 101 as a signature verification key information.
Here, the (X, N _U) in the initial value of the sum Y of the payment amount y of the current until the corresponding electronic cash Y = 0 as (X, N _U) is recorded in response to. In the first embodiment, an example is shown in which the user generates the signature verification key N _U.
For example, it may be generated by the monitoring agency 100 or the bank 200. In this case, the monitoring institution or the bank generates the signature verification key N _U in advance in response to the electronic cash issuance request and
Will be sent to 0. (2) Payment of electronic cash Next, the user 300 enters the user's signature verification key N _U and the bank 20
Pay the amount y (y ≦ x) at a retail store W using electronic cash C of published by 0 signature S _B (X, N _U) par X including a set of balance x (initial value x = X) The case will be described with reference to FIG.

Step 1: The user 300 displays the balance x read from the memory 30M on the display unit 30D, confirms that the balance x is equal to or more than the amount y to be used, and checks the electronic cash C = {x, X, N _U , S _B (X, N _U )} to the retail store 400. Step 2: The retail store 400 uses the signature verification unit 401 to
Signature S _B (X, N _U) of the issuer of electronic cash (bank 200) is verified by the signature verification function V _B the validity of. If it is correct, the one-way function calculation unit 402 uses the one-way function f to calculate the time TIM.
E, generates inquiry information e = f (TIME, W) for verification from the information W corresponding to the retail store 400, and sends TIME, W, e to the user 300.

Step 3: The user 300 performs a one-way function
Using the arithmetic unit 306 and the comparing unit 307, the validity of e = f (TIME, W)
Verify the nature. If it is correct, using the signature generation unit 305,
E and the amount of payment y (y ≦ x)
Signature S_U(e, y) is calculated and y, S _U(e, y) to retail store 400
Attached. Step 4: Retail store 400 has user signature S_U(e, y) and payment
Inquiry information e and signature verification key N_U 
The signature is verified by the signature verification unit 404 using
Verify y ≦ x using 3. If both are correct,
Accept payment by electronic cash for applicable payment amount y, reduce
If both are not correct, payment will not be accepted OK / N
Send G to the user. In addition, the user 300
Communication data H = {x, X, N_U, S_B(N_U), TIME, W, e, y, S
_U(e, y)} is stored in the retail store data storage unit 40D.

The retail store 400 uses TIME, W, and e for the user.
After sending to 300, the validity of S _B (X, N _U ) may be verified. Step 5: User 300 OKs decision result from retail store 400
If / NG is OK, the balance x in the memory 30M is updated by the subtractor 302 as x ← xy. (3) Settlement Finally, a settlement method between the retail store 400 and the bank 200 will be described with reference to FIG.

[0020] Step 1: All intercommunication data H = {x between retailers 400 retailers 400 and first user 300 for monitoring engine 100 to _{settle, X, N U, S B} (X, N _U ), TIME, W, e, y, S
_U (e, y)} (or directly) via the bank 200 that has its own account. Step 2: The monitoring organization 100 sets (X, N _U ) the signature verification key N _U and the face value X of the user 300 included in the mutual communication data H.
It is checked whether or not is registered in the monitoring database 101. If registered, the control unit 114 performs the following processing using the addition unit 107 and the comparison unit 103. First, (X, N _U )
The total value Y of the payment amount recorded corresponding to is Y + y → Y
And further checks that the updated Y does not exceed X. Further, the control unit 114 records the mutual communication data H in the history database 108. It is preferable to write data to the history database 108 with a predetermined time limit, and to reduce the data amount by deleting expired data.

If the updated total payment amount Y is the face value X
If not, the issuing bank of the used electronic cash is instructed to transfer the amount y to the bank account designated by the retail store 400. At this time, bank retail store 400 has an account, the user 300 (X, N _U) may not be the bank 200 signed to. Furthermore, if Y + y = X, the monitoring database 10
Delete (X, N _U ) and the corresponding total payment amount Y from 1.

If (X, N _U ) is not registered in the monitoring database 101, it is assumed that the user 300 has made an unauthorized payment, and an unauthorized person identification process is performed. If Y + y> X, the control unit 114 sends X, N _U from the monitoring database 101.
And the corresponding Y are deleted, and again,
Assuming that the fraudulent payment has been made by the user, the fraudulent person identification processing is performed.

[0023] Step 3: In fraudster identification process, the monitoring engine 100, (X, N _U) history database 108 before removing the
Read out the information (all the intercommunication data H concerning the improper payment) that is more proof of wrongdoing, and issue the electronic cash issuing bank
Send to 200. The bank 200 verifies the validity of the proof of wrongdoing by the signature verification unit 203 using N _U, and if correct, uses (X, N _U ) as a keyword in the user database 201.
Then, the unauthorized user 300 corresponding to the corresponding user information U is specified.

[0024] In the above, information users, including the signature verification key N _U remains of the original (X, N _U) has been described a case to send to the bank and monitoring agencies, in general, the information of the signature verification key N _U It may be converted to any form, including the form as it is, and sent. This arbitrary form of transformation is denoted by n = f (N _U ). Therefore,
As a more general expression in the description of the above embodiment,
The user sends the signature verification key information represented by n = f (N _U )
Together with the bank and monitoring agencies. For example, the user uses the one-way function f to send information including the signature verification key N _U to n = f (N _U )
, And (X, n) is converted to the bank 200 and the monitoring agency 100
And send them to the database as signature verification key information.
201, 101 may be written.

In the first embodiment described above, the bank 200 generates compressed data n of n = h (X, N _U ) as signature verification key information using, for example, a one-way hash function h, and this signature verification is performed. The key information n and the name U of the user 300 may be stored in the user database 201 in association with each other. Similarly, the monitoring institution 100 also stores the data n = h (X, N _U ) obtained by compressing (X, N _U ) received from the bank by a one-way hash function in the monitoring database 101 and the total usage amount Y. You may register.
In this case, the monitoring organization 100 shown in FIG. 4 uses the signature verification key information n obtained by compressing (X, N _U ) in the history data H from the retail store 400 by the same one-way hash function h to obtain a database.
Searching 101, the same signature verification key information or n is present, i.e. (X, N _U) it is checked whether it is registered.

The procedure in which the user 300 pays to an arbitrary retail store using the remaining amount x of the electronic cash used as described above is the same as the payment procedure between the user 300 and the retail store 400 described above. The payment procedure between the retail store and the monitoring agency 100 can be performed in exactly the same manner as described above. According to the above-described electronic cash implementation method of the present invention, all the amount X of electronic cash issued by each bank 200 is reported to the monitoring organization 100, so that the total amount of electronic cash issued by each bank can also be monitored. However, the monitoring institution 100 can always grasp the total amount of electronic cash circulating.

According to the present invention, when payment is made by electronic cash, it is only necessary to confirm that the amount of money used is equal to or less than the current remaining amount x. It is significantly simpler than the electronic cash split use procedure shown in 5,224,162, and the amount of communication information therefor is significantly smaller. Furthermore, it is an aspect of the invention, the monitoring engine 100, registration data monitored held in the monitoring database 101 (X, N _U) is
Since the corresponding electronic cash is completely erased when it is used up to its face value X, even if the same electronic cash is used by fraud thereafter, the data of the electronic cash sent to the monitoring organization from the retail store for settlement. (X, N _U) already database 10
Since it has been deleted from 1, unauthorized use is immediately revealed. Further, the characteristic that in this way, registration data (X, N _U) as monitored held in the database 101 as described above so are deleted in the spent or unauthorized uncovered time, the database 101 The stored registration data (X, N _U ) is only valid at that time. Therefore, if the total amount of issued electronic cash is constant to some extent, the amount of registered data that must be stored in the monitoring database 101 is substantially constant and does not accumulate. In contrast, in the conventional e-cash method, each bank must keep a list of e-cash that has been misused and used e-cash (which may be used in the future), There is a problem that the monitoring data amount accumulates together with the amount of electronic cash issued.

Next, the characteristic advantage in the first embodiment described above.
The functional configuration of the user device 300 and the monitoring organization 100 will be described below.
You. FIG. 5 shows the processing of the user 300 in the first embodiment.
Shows a functional block diagram of the user device for performing the procedure.
You. The configuration is executed by the user 300 in FIGS.
The processing function unit 300a when issuing electronic cash and the
The processing function unit 300b is connected to the input unit 311, the control unit 312,
It is configured to share the file 30M. Issuance of electronic money
The functional configuration unit 300a controls the input unit 311 and the operation of each unit.
Control unit 312, a key generation unit 301, and a transmission unit 31
3, a receiving unit 314, and a memory 30M.
You. The control unit 312 receives commands and user information from the input unit 311.
If U and face value X are given, it will be
Transmit user information U and face value X from transmitting unit 313 to bank 200 (B)
In addition, the verification key N_U And the signing key SK
_U Is generated and stored in memory 30M together with X.
Further generated key N_U To the bank 200.

When the control unit 312 receives the signature S _B (X, N _U ) for (X, N _U ) from the bank 200 at the receiving unit 314, the control unit 312 stores it in the memory 30 M. The function configuration unit 300b when using electronic cash includes an input unit 311, a control unit 312, a memory 30M,
It comprises a display unit 30D, a subtraction unit 302, a signature construction unit 305, a one-way function unit 306, a comparison determination unit 307, a transmission unit 315, and a reception unit 316. When the payment amount for the retail store 400 is input from the input unit 311, the balance x is read from the memory 30 M and displayed on the display unit 30 D to confirm that the balance x is equal to or larger than the payment amount. Next, the electronic cash C = {x, X, N _U , S _B (X, N _U )} of the face value X and the remaining balance x is read from the memory 30M, and is transmitted.
315 to the retail store 400. Retail in response to this
When the inquiry information e, TIME, and W are received from the receiver 400 by the receiving unit 316, TIME and W are subjected to a one-way function processing by the one-way function unit 306 to obtain f (TIME, W). The determination is made by the comparison determination unit 307. If they match, the signature generation unit 305 generates a signature S _U (e, y) for the pair of e and y using the signature key SK _U and sends it to the retail store 400 together with the payment amount y. At the same time, the subtraction unit 302 calculates the payment amount y from the remaining amount x.
Is subtracted, and the remaining amount x in the memory 30M is updated with the updated remaining amount x.

As shown in FIG. 6, the monitoring engine device 100 includes a monitoring database 101, a history database 108, an adding unit 107, a comparing unit 103, an adding unit 107 for controlling these operations, and a history database 108. , A receiving unit 112, a transmitting unit 113, a receiving unit 115, and a control unit 114. In the receiving unit 112 from the bank 200 (X, N _U) and receives a control unit 114 registers the monitoring database (X, N _U), recording the total use amount initial value Y = 0 in the electronic cash correspondingly I do.

Thereafter, the history data H of the payment procedure using the electronic cash C = {x, X, N _U , S _B (X, N _U )} H = {x, X, N _U , by the receiving unit 115 from the retail store 400. Upon receiving S _B (X, N _U ), TIME, W, e, y, S _U (e, y)}, the control unit 114 already registers (X, N _U ) in the received data in the monitoring database 101. If it is not registered, the payment by electronic cash is regarded as improper and (X, N _U ) is notified to the issuing bank of electronic cash. As if it is already registered (X, N _U) monitoring database 101 corresponding to the
The adding unit 107 adds the total usage amount Y in the data and the payment amount y in the data H. The comparison result is compared with the denomination X in the data H by the comparison unit 103. If the comparison result is Y + y> X, it is determined that the use is illegal, and the monitoring database 101
(X, N _U ) and Y corresponding thereto are deleted from (X, N
_U ) to the electronic cash issuing bank. If Y + y <X, it is determined that the use of the electronic cash is not fraudulent, the data H is recorded in the history database, and the monitoring database 10 is used.
The corresponding total usage amount Y in 1 is updated based on the addition result of the addition unit 107. If Y + y = X, face value X of the electronic cash
There means that had been fully used, thus the monitoring database 101 (X, N _U) Remove the corresponding Y.

[0032] In the first embodiment described above, since the same user to generate a different signature verification key N _U for each requesting the issuance of electronic cash, also distinguish between multiple electronic cash the same user at face value X is the same can do. To enable the same user to always use the same signature verification key N _U , a different variable value R (for example, a random number) is generated for each electronic cash and the
(X, N _U , R) may be used instead of (X, N _U ). That is, in the bank 200, the data (X, N _U , R) or
_{n = h (X, N U} , R) is recorded. Also, the monitoring engine 100 data (X, N _U) instead of registering the (X, N _U, R) or _{n = h (X, N U} , R)
Register The user stores the data (X, N _U , R) and
_{S B (X, N U,} R) sends an electronic cash C including. In settlement,
The monitoring agency 100 checks whether (X, N _U , R) in the data H from the retail store or n obtained by converting the data is registered in the monitoring database 101. Other specific procedures are the same as those described above. Second Embodiment By the way, in the embodiment described with reference to FIGS. 2, 3 and 4, when requesting issuance of electronic cash with a bank, the user submits his / her signature verification key N _U to the bank. Knows the correspondence between user information U and (X, N _U ). on the other hand,
At retail stores, users receive payment for electronic cash
(X, N _U ) is received. Therefore, if the bank collaborates with the retail store, the bank can obtain the information U of the user using the electronic cash at the retail store.
Is not sufficient in terms of privacy protection. An embodiment in which this point is improved will be described below with reference to FIGS.

In the second embodiment, the electronic cash issuance processing
At the bank, the user enters the user's (X, N _U) Pair is unknown
(X, N_U) Is encrypted with the encryption key of the monitoring organization
And give it to the bank. In addition, the bank's electronic cash issuing procedure
And N in the bank_U Of the bank to prevent
The signature for the child cash is a blind signature. Below
This will be described in detail with reference to 7, 8, and 9. (1) Electronic cash issuance processing First, a case in which a user issues electronic cash is shown in FIG.
This will be described with reference to FIG.

The monitoring body 100, may be held in the memory 10M to generate a public key PK _T and the secret key SK _T for pre-public-key cryptography, bank 200 corresponding to each of the face value X for the blind signature scheme It is assumed that a pair of public key PK _B and secret key SK _B are generated and held. Monitoring engine 100, as well as to publish the public key PK _T and encryption function E _T for public key encryption, public key PK
And a secret key SK _T for decoding forming a _T pair, holds the decryption function D _T using the same secret.

The bank 200 has a public key PK for blind signature.
As well as publish the _B and the signature verification function V _B, the secret key for the blind signature forms a blind signature for the public key PK _B and the pair SK _B
When, for holding a signature generation function S _B using the same secret.
The user 300 performs a procedure for requesting that the face value X of the electronic cash be deducted from the account of the user 300 of the bank 200 in the following procedure.

However, in this embodiment, the user uses electronic cash.
Is always required to issue the same signature verification key N_U use
The case will be described. Therefore, in this case, the same user
In order to be able to distinguish between electronic cash
Numerical value (for example, random number) R is (X, N _UUse in combination with
You. Step 1: User 300 generates a digital signature key generation unit.
Using 301, the signature generation key SK_U And signature verification key N_U Raw
And a random number R is generated as a variable value by the random number generation unit 30R.
I do. Note that in this embodiment, the use of the random number R
It is more perfect, but instead of random number R
Any variable value may be used.

Next, the public key PK for encryption of the monitoring institution 100 is used._T 
Publicly known cryptographic function E _T The cryptographic unit that calculates
303 by E_T(X, N_U, R) and calculate the amount X of the user 300
A message asking you to withdraw from your account_T(X, N
_U, R) to bank 200. This message is used
Should be authenticated by the digital signature of the
New As described in the first embodiment, the user
N_U Is converted by a desired function to generate n.
Requesting that X be pulled down and encrypting information E
_T(X, n) may be generated and sent to the bank.

Step 2: The bank 200 checks the balance of the account of the user 300, reduces X from the balance, and signs E _T (X, N _U , R) in association with the user name U. It is recorded in the user database 201 as verification key information. User 30
If there is a withdrawal request message with a signature of 0, record it together. Bank 200 has encrypted data E
_{T (X, N U, R} ) does not have a decryption secret key SK _T for decoding the, can not be known _{(X, N U, R)} .

Next, {X, E _T (X, N _U , R)}
Send to Step 3: The monitoring institution 100 decodes the decryption function _DT
2 _{using, E T (X, N U} , R) decodes the seek _{(X, N U, R)} . Next, the comparison unit 103 verifies the identity between X sent from the bank 200 and X obtained by decryption. If it is correct, and stores the (X, N _U, R) and registers in the monitoring database 105 as a signature verification key information, the initial value Y = 0 in the sum Y of spending correspondingly.

Step 4: The user 300 generates F (N _U ) by the blind signature generation unit 304 using the blind signature public key PK _B of the bank corresponding to the face value X (referred to as pre-blind signature processing). ) And send it to Bank 200. Banks 200 inputs F a (N _U) in a blind signature generating unit 203, by using a blind signature secret key SK _B to generate a blind signature Z (N _U), and sends it to the user 300.

The user 300 receives the blind signature public key PK _B
Is used to obtain the bank signature S _B (N _U ) from Z (N _U ) by the blind signature extraction unit 308 (generally called post-blind signature processing). For how to implement blind signature,
The method using the RSA method is described in Chaum, Fiat, Naor's "Un-
traceable Electronic Cash ", Proc. of CRYPTO'88", and a blind signature using the Schnorr method has been introduced by T. Okamoto in "Provably Secure and Practical".
Identification Schemes and Corresponding Signature
Schemes ", Proc. Of CRYPTO'92, pp.31-53, 1993 App
It is introduced in endix B.

Here, the user 300 has C = {x, X, N _U , R, S
_B (N _U )} is stored in the memory 30M as electronic cash having a face value X and a balance x. However, the initial value of the balance x is x = X. In the second embodiment, an example is shown in which the user 300 generates the signature verification key N _U , but it may be generated by another institution, for example, the monitoring institution 100. In that case, the user 300 creates an encryption key K _U , sends E _T (K _U ) to the monitoring agency 100 via the bank 200, and the monitoring agency 100 decrypts E _T (K) to obtain K, The generated N _U is encrypted with K to obtain E _K (N _U ), and the E _K
(N _U ) is sent to the user via the bank. The user 300 decrypts the received E _K (N _U ) using the encryption key K to obtain N _U. (2) Payment of electronic cash Next, the user 300 enters the user's signature verification key N _U and the bank 20
0 and the signature S _B (N _U ) issued from
A case in which the retailer W pays the amount y (y ≦ x) using the electronic cash C of (initial value x = X) will be described with reference to FIG. Generally, in the blind signature, it is possible to generate a unique pair of keys SK _B and PK _B corresponding to a desired type of face value X, respectively. Therefore, if the face value is presented, the blind signature verification key PK _B to be used can be known. That is, the signature
S _B (N _U ) is the same as including information on both the signature verification key N _U and the face value X.

Step 1: The user 300 has the memory 30M
Display the balance x read out on the display unit 30D and use it
Make sure that the amount is more than y
C = {x, X, N_U, R, S_B(N_U)} To the retail store 400. Step 2: Retail store 400 is denominated by signature verification unit 401
Public key PK corresponding to X _B Using the electronic cash issuer
(Bank 200) Signature S_B(N_U) Is verified by the signature verification function V_B 
Verify by If it is correct, the one-way function operation unit 402
Using the one-way function f for time TIME and retail stores 400
Inquiry information e = f (TIME,
W), and sends TIME, W, and e to the user 300.

Step 3: The user 300 verifies the validity of e = f (TIME, W) by using the one-way function calculator 306 and the comparator 307. If it is correct, using the signature generation unit 305,
Calculate the user's signature S _U (e, y) for the sent e and the payment amount y (y ≦ x), and substitute y, S _U (e, y) for the retail store 400
Send to Step 4: The retail store 400 uses the signature verification unit 401 to
The validity of the user signature S _U (e, y) and the payment amount y is verified using the inquiry information e and the signature verification key N _U.
403 is used to verify y ≦ x. If both are correct, payment of the payment amount y by electronic cash is permitted.
Also, communication data with the user 300 for later settlement
H = {x, X, N _U , R, S _B (N _U ), TIME, W, e, y, S _U (e, y)} are stored in the retail store data storage unit 40D. If at least one of them is incorrect, the payment is not accepted. The judgment result OK / NG is sent to the user.
In addition, communication data H with the user 300 is used for later settlement.
= {x, X, N _U , R, S _B (N _U ), TIME, W, e, y, S _U (e, y)} are stored in the retail store data storage unit 40D.

[0045] The retail store 400 uses TIME, W, and e for the user.
After sending to 300, the validity of S _B (N _U ) may be verified. Step 5: User 300 OKs decision result from retail store 400
If / NG is OK, the balance x in the memory 30M is updated by the subtractor 302 as x ← xy. (3) Settlement Finally, the settlement method between the retail store W and the bank B is shown in FIG.
This will be described with reference to FIG.

[0046] Step 1: All intercommunication data H = {x between retailers 400 retailers 400 and first user 300 for monitoring engine 100 to _{settle, X, N U, R,} S B (N _U ), TIME, W, e, y, S _U (e,
y)} with the clearing bank name. Step 2: The control unit 114 of the monitoring engine 100, and the key N _U for signature verification of the user 300 included in intercommunication data H, and the random number R, the face value X set (X, N _U, R) is monitored Detabesu Check if it is registered in 105. If registered
The control unit 114 performs the following processing using the addition unit 107 and the comparison unit 103. First, to check that it is not exceeded (X, N _U, R) and updates the total value Y of the usage amounts are recorded in correspondence with the Y + y → Y, it is further updated Y is a X. The control unit 11
4 records the mutual communication data H in the history database 108.

If the updated total payment amount Y does not exceed the face value X, the issuing bank 200 of the used electronic cash is instructed to transfer the amount y to the account of the designated bank of the retail store 400. . At this time, the bank in which the retail store 400 has an account need not be the bank 200 (the bank that issued the electronic cash) that blind-signed the verification key N _U of the user 300. Further, if Y + y = X, from the monitoring database 105
(X, N _U, R) and to remove the Y corresponding thereto.

If (X, N _U , R) is not registered in the monitoring database 105, it is assumed that an unauthorized payment has been made by the user, and an unauthorized person identification process is performed. Also, if Y + y> X, the control unit 114 monitoring database _{105 (X, N U, R} ) and deletes the corresponding Y to, again, as fraudulent payment by the user is performed, Perform unauthorized person identification processing.

Step 3: In the unauthorized person identification process, the control unit
114 reads out the information H as evidence of fraud from the history database 108, and (X, N _U , R) in the information H is encrypted by the encryption unit 116.
Obtaining the public key PK using the _T encrypted to _{E T (X, N U,} R) and by, be sent to the issuing bank 200 of the electronic money with the information H. The bank 200 determines that S in the information H
The validity of _U (e, y), S _B (N _U ) is verified by signature verification unit 203 using keys N _U , PK _B, and if correct, E _T (X, N _U , R) is used as a key An unauthorized user 300 corresponding to the corresponding unauthorized user information U is specified from the user database 201. Alternatively, instead of providing the encryption unit 116 in the monitoring organization 100, an encryption unit is provided in the bank 200, and (X, N _U , R) received from the monitoring organization 100 is encrypted to obtain E _T (X, N _U , R ) May be obtained.

Further, the retail store 400 transmits the real name W to the monitoring organization 100.
If the retailer does not want to teach, the pseudonym W ′ is not used in the communication data H sent by the retail store to the monitoring organization so that the real name W 2 is not used. In addition, since the retail store 400 notifies the settlement bank of the correspondence between 400 and W, the bank determines that the transfer request to W received from the monitoring organization is a transfer request to the retail store 400.

Next, a description will be given below of the functional configuration of the user apparatus 300 and the monitoring organization 100 which are characteristic in the second embodiment. FIG. 10 is a functional block diagram of a user device for executing the processing procedure of the user 300 in the first embodiment. In the configuration, the processing function unit 300a for issuing electronic cash executed by the user 300 in FIGS. 7 and 8 and the processing function unit 300b for using electronic cash share the input unit 311, the control unit 312, and the memory 30M with each other. It is configured to be.

The function configuration unit 300a at the time of issuing the electronic money payment includes an input unit 311 and a control unit 312 for controlling the operation of each unit.
Key generation section 301, encryption section 303, blind signature pre-processing section 304, blind signature post-processing section 308, and transmission section 31
3, a receiving unit 314, and a memory 30M. When a command, user information U, and face value X are given from the input unit 311, the control unit 312 transmits the user information U and face value X from the transmission unit 313 to the bank 200 (B) for an electronic cash issuance request, Verification key N _U and signature key SK are sent to key generation section 301.
_U is generated and stored in the memory 30M together with X.
Also, the encryption unit 303 using a cryptographic public key PK _T of the monitoring engine 100 X, N _U, transmits E _T obtained by encrypting the _{R (X, N U, R} ) and the bank 200. In addition, the public key for the bank's blind signature
The blind signature pre-processing unit 304 pre-processes the verification key N _U using PK _B , and sends the obtained F (N _U ) to the bank 200.

The control unit 312 is a signature from the bank 200 bank using F (N _U) blind signature Z (N _U) receives the public blind signature of the bank by the blind signature postprocessing unit 308 key PK _B for S _B Extract (N _U ) and keep it in memory 30M. The function configuration unit 300b when using electronic cash is an input unit 311
, A control unit 312, a memory 30M, a display unit 30D, a subtraction unit 302, a signature construction unit 305, a one-way function unit 306, a comparison determination unit 307, a transmission unit 315, and a reception unit 316. Be composed. When the payment amount for the retail store 400 is input from the input unit 311, the balance x is read out from the memory 30 M and the display unit 30 is read.
Display on D and confirm that the balance x is equal to or greater than the payment amount. Next, the electronic cash C of the face value X and the balance x from the memory 30M =
{x, X, N _U , S _B (N _U )} is read out, and the transmission
Send to When the inquiry information e, TIME, and W are received by the receiving unit 316 from the retail store 400 in response to this,
And W are processed by a one-way function by a one-way function unit 306 to obtain f (TI
ME, W), and the comparison / determination unit 307 determines whether or not this matches the received e. If they match, the signature generation unit 305 generates a signature S _U (e, y) for the pair of e and y using the signature key SK _U and sends it to the retail store 400 together with the payment amount y. At the same time, the subtractor 302 updates the balance x in the memory 30M with the updated balance x by subtracting the payment amount y from the balance x.

The monitoring engine device 100 is, as shown in FIG.
Memory 10M, monitoring database 101, decoding unit 102
, A comparison unit 103, a history database 108, and an addition unit 10.
7, a comparison unit 103, and an addition unit 10 for controlling these operations.
7, the history database 108, the receiving unit 112, and the transmitting unit
113, a receiving unit 115, and control operations of these units.
And a control unit 114. Bank 20 in the receiver 112
0 to X and E_T(X, N_U, R), the decoding unit 102
Secret key SK_T Using (X, N_U, R) and the resulting gold
The comparison unit 103 checks whether the received X matches the sum X
And if they match, N _U And (X, N_U, R) pair and its corresponding
The initial value Y = 0 of the total usage amount is registered in the monitoring database 101.
Record.

Thereafter, the history data H = {x, X, N _U , of the payment procedure using the electronic cash C = {x, X, N _U , R, S _B (N _U )} from the retail store 400 by the receiving unit 115. Upon receiving R, S _B (N _U ), TIME, W, e, y, S _U (e, y)}, the control unit 114 stores (X, N _U , R) in the received data in the monitoring database 101. already or search has been registered, the payment by the electronic cash if it is not registered to notify the issuing bank of electronic cash (X, N _U, R) as illegal. If it is already registered its (X, N _U, R) is added by an adder 107 and a payment amount y in total use amount Y and the data H in the monitoring database 101 corresponding to the.

The result of the addition is compared with the denomination X in the data H by the comparing unit 103. If the result of the comparison is Y + y> X, it is determined that the unauthorized use has occurred.
(X, N _U, R) and (X, N _U deletes the corresponding Y therewith,
R) to the electronic cash issuing bank. If Y + y <X, it is determined that the use of the electronic cash is not fraudulent, the data H is recorded in the history database, and the monitoring database 10 is used.
The corresponding total usage amount Y in 1 is updated based on the addition result of the addition unit 107. If Y + y = X, face value X of the electronic cash
There means that had been fully used, thus the monitoring database _{101 (X, N U, R} ) to remove the Y corresponding thereto.

In the above-described second embodiment, the user is ET
Instead of sending (X, N _U , R) to banks and monitoring agencies,
(X, N _U) converts the signature verification key information in the hash function _{n = h (X, N U} ) , the bank (n, R) E _T obtained by encrypting the (X, N _U, R) and And may be sent to a monitoring agency. In that case, the bank E _T (n, R) recording paper in the user database as the signature verification key information, monitoring agencies E _T (n, R) or (n, R) to respect database as the signature verification key information register.

As described in the first embodiment, the variable R may or may not be used if the signature verification key N _U of the user is changed every time the electronic cash is issued. If not used, the bank records (X, N _U ) in the user database 201 corresponding to the user name U, and the monitoring agency 100 registers (X, N _U ) or E _T (X, N _U ) I do. When using the variable R, the variable R is
It may be handled in exactly the same way as in the embodiment, or the variable R is used only for enhancing the security of communication between the user, the bank and the monitoring organization. In the latter case, the variable R is not included in the electronic cash C to be paid to the retail store 400.
User's signature verification key N _U included in information H from 400
Is checked in the monitoring database 105 beforehand, (X, N _U ) and E _T (X, N
_U , R) pair is registered. At the time of payment, (X, N _U ) is searched as a keyword, and if it is registered, the detected E _T (X, N
_U , R) to the bank.

[0059]

According to the first embodiment of the present invention, there is a disadvantage that the privacy of the user cannot be guaranteed when the bank and the retail store are collocated. However, the privacy of the user is guaranteed if the bank does not cheat. It is characterized by the ability to detect unauthorized use. The second embodiment of the present invention has a feature that, similarly to the method of Chaum et al., The privacy of a user can be guaranteed even if a bank is consigned with a retail store, and unauthorized use can be detected.

Further, in any of the methods of the present invention, Ch
The communication volume in the payment process can be reduced compared to the method of aum et al. In addition, divisional use is possible, and the financial institution that manages the issuer of the electronic cash and the user's account can be hierarchically separated. For example, in the method of Chaum et al., The probability of successful fraud in electronic cash payment is 1 /
When 2 ^30, it is necessary to perform the processing frequency 30 times, when the output size of the one-way function 128 bits requires at least (3 × 128 × 30) = 11520 traffic bits.

On the other hand, in the payment processing according to the present invention,
The communication volume is y, e, and the size of the user's signature for it. It is sufficient that the total of the sizes of y and e (and TIME, W) is at most about 200 bits. Signature size 10
If it is 24 bits, it will be around 1200 bits at most. Therefore,
According to the communication amount of the present invention, the communication amount at the time of payment processing is 10
It can be reduced about twice.

Further, according to the present invention, the issued electronic cash can be divided and used any number of times until the total amount becomes the denomination. Further, an institution that issues electronic cash (bank) and an institution that performs verification processing for settlement (monitoring institution) are separated from each other, so that the monitoring institution can monitor the distribution amount of electronic cash issued by the bank. That is, the monitoring institution can know the total amount of electronic cash issued by the bank and the total amount of electronic cash returned to the bank, so that it is possible to monitor the amount of electronic cash circulating at each time.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a system configuration to which the present invention is applied.

FIG. 2 is a block diagram functionally showing an electronic cash issuing method according to the first embodiment of the present invention.

FIG. 3 is a block diagram functionally showing an electronic cash payment method according to the first embodiment of the present invention.

FIG. 4 is a block diagram functionally showing an electronic cash settlement method according to the first embodiment of the present invention.

FIG. 5 is a block diagram showing a functional configuration of the user device according to the first embodiment of the present invention.

FIG. 6 is a block diagram showing a functional configuration of the monitoring engine device according to the first embodiment of the present invention.

FIG. 7 is a block diagram functionally showing an electronic cash issuing method according to a second embodiment of the present invention.

FIG. 8 is a block diagram functionally showing an electronic cash payment method according to a second embodiment of the present invention.

FIG. 9 is a block diagram functionally showing an electronic cash settlement method according to a second embodiment of the present invention.

FIG. 10 is a block diagram showing a functional configuration of a user device according to a second embodiment of the present invention.

FIG. 11 shows a functional configuration of a monitoring engine device according to a second embodiment of the present invention.

──────────────────────────────────────────────────の Continuation of the front page (51) Int.Cl. ⁶ Identification code Agency reference number FI Technical indication location G09C 1/00 640 7259-5J G09C 1/00 640D 660 7259-5J 660C 7259-5J 660B H04L 9 / 32 G06F 15/30 Z H04L 9/00 675D 675B

Claims (18)

[Claims] 1. A monitoring organization for monitoring issuance of electronic cash;
An electronic cash system with a monitoring system for an electronic cash system, comprising a bank that issues electronic cash, a user who uses electronic cash, and a retail store that is paid by electronic cash, includes the following steps: (1 The user sends the user information U and the amount X corresponding to the face value of the electronic cash to the bank, and sends the amount X from the user's account.
It requested that pulling down the, (2) The Bank, reduced the amount of money X from the account of the user, of the bank to the signature verification key N _U and the amount X of the user's signature S _B ( X, N _U ) and sends it to the user, and stores the amount of money X and the signature verification key information n including the information of the signature verification key N _{U in} the user database in association with the user information U. Record, and further send the signature verification key information to the monitoring organization. (3) The monitoring organization registers the signature verification key information n in a monitoring database. (4) The user receives the amount X and The signature verification key N _U
And, the signature S _B (X, N _U) and using the information as electronic cash C of face value X, including the payment of the amount of payment y to the retail store, the retail stores to verify the validity of the electronic cash (5) The retail store sends all the communication data H with the user including the information of the electronic cash C to the monitoring organization for settlement, and (6) the monitoring organization receives the communication data The validity of the electronic cash C in H is verified, and the bank is instructed to transfer the payment amount y to the account of the retail store. 2. The method of claim 1, wherein the steps are
In (1), the monitoring organization records the total usage amount Y in the monitoring database in association with the signature verification key information, and in the step (2), the user stores the remaining amount x in the electronic cash in the electronic cash. And send it to the above retailers. 3. The method of claim 2, wherein the steps are
(4) includes the following steps: (4a) The retailer generates arbitrary information e and sends it to the user, and (4b) the user receives the payment amount y and the signature of the user for information e S _U (e, y) to generate, and the electronic cash C, the signature of the payment amount y and the user S _U (e,
(4c) the retailer verifies the validity of the bank's signature S _B (X, N _U ) and reconciles the user's signature S _U (e, y) The validity is verified using the verification key N _U, and the payment amount y is verified to be equal to or less than the remaining amount x of the electronic cash. If all the verifications are correct, the payment amount y is calculated using the electronic cash. Accept payment. 4. The method according to claim 2 or 3, wherein said step (6) includes the following steps: (6a) The monitoring authority determines that the signature verification key information n obtained from the intercommunication data H is (6b) If it is registered, update the total usage amount Y corresponding to the signature verification key information to Y + y, and (6c) update the total usage amount. Check that the amount Y + y does not exceed the face value X, and if the check is correct, instruct the bank to transfer the amount y to the bank account of the retail store; (6d) Further, Y + y = X Then, the signature verification key information and the corresponding total usage amount Y are deleted from the monitoring database, and (6e) If any of the above inspections does not pass, it is assumed that the user has made unauthorized payment, The signature verification from the monitoring database The key information and the total usage amount Y corresponding thereto are deleted, the signature verification key information is sent to the bank, and the unauthorized user name is specified from the user database. 5. The method of claim 1, 2 or 3, wherein the step (1) comprises the step of the user generating a variable value R and sending it together with the verification key N _U to the bank and the monitoring agency. The step (2) includes a step in which the bank records information including the signature verification key N _U and the variable value R as the signature verification key information.
Includes a step in which the monitoring organization registers the information including the signature verification key N _U and the variable value R as the signature verification key information in the monitoring database. 6. A monitoring organization for monitoring issuance of electronic cash,
It consists of a bank that issues e-cash, a user who uses e-cash, and a retailer that receives e-cash,
The monitoring agency publishes the cryptographic function E _T and the bank publishes the signature verification function V _B in the electronic cash method of the electronic cash system, which includes the following steps: (1) The user is provided to the bank by the user The information U and the amount X corresponding to the face value of the electronic cash are transmitted to request the bank to withdraw the amount X from the user's account.
And the signature verification key information including the signature verification key N _U is encrypted to obtain the encrypted information E _T and send it to the bank. (2) The bank reduces the amount X from the user's account. , the amount X and the encrypted information E _T as well as sent to the monitoring agency, the encrypted information E _T recorded in the user database as the signature verification key information in correspondence with said user information U, (3 The monitoring organization decrypts the encrypted information E _T to obtain signature verification key information, and registers at least one of the signature verification key information and the encryption information E _{T in} a monitoring database. The user requests the bank to perform a blind signature for the signature verification key information and the face value X, obtains a bank signature S _B (n) corresponding to the face value X, and (5) information including the above signature S _B (n), and the face value X, and the signature verification key n _U The payment amount y is paid to the retail store using the electronic cash C of the face value X, and the retail store verifies and receives the validity of the electronic cash. (6) The retail store includes the information of the electronic cash C. (7) The monitoring organization verifies the validity of the electronic cash C in the received communication data H, and sends the data to the bank. An instruction is given to transfer the payment amount y to the account of the retail store. 7. The method of claim 6, wherein said steps are:
(3) comprises the step of the monitoring authority to register to the at least one of them in correspondence with the total use amount Y the monitoring database of said signature verification key information and the encrypted information E _T, the step (4) above The user includes the electronic cash balance x in the electronic cash information and sends it to the retailer. 8. The method of claim 7, wherein said steps are:
(4) includes the following steps: (4a) The retailer generates arbitrary information e and sends it to the user, and (4b) the user receives the payment amount y and receives the information. A signature S _U (e, y) of the user for the information e is generated, and the electronic cash C = {x, X, N _U , S _B (n)} and {y, S _U (e, y) )} To the retail store. (4c) The retail store verifies the validity of the bank signature S _B (n) using the signature verification function V _B , and furthermore, the user signature S B
The validity of _U (e, y) is verified using the signature verification key N _U , and if all verifications are correct, payment of the corresponding payment amount y by electronic cash is permitted. 9. The method according to claim 7, wherein the step (7) includes the following steps: (7a) The monitoring authority sends the signature verification key information and the encryption code obtained from the intercommunication data H. of the one of the information E _T examines whether it is registered in the monitoring database, (7b) if it is registered, corresponding to the at least one of the signature verification key information and the encrypted information E _T (7c) Inspect that the updated total usage amount Y + y does not exceed the above-mentioned face value X, and if this inspection is correct, enter the retail store bank account. instructs the bank to transfer money amounts y, (7d) further, if Y + y = X, said at least one and the sum of its corresponding said signature verification key information and the encrypted information E _T from the monitoring database Delete usage amount Y, (7e) If any of the above inspections do not pass, it is assumed that the user has made an unauthorized payment, and the signature verification key information and the encrypted E _T
At least one of the above and the total usage amount Y corresponding thereto
Remove the, the signature verification key information n and sends the above-mentioned at least one of the encrypted information E _T to the bank, to identify the unauthorized user name from the user database. 10. The method according to claim 4, wherein the signature verification key information comprises a pair of the face value X and the signature verification key N _U. 11. The method of claim 1, 2, 3, 6, 7 or 8, wherein said step (1) comprises the step of said user generating said verification key N _U. 12. The method of claim 6, 7, or 8,
The step (1) includes a step in which the user generates a variable value R and uses information including the verification key N _U and the variable value R as the signature verification key information. 13. The method of claim 1, 2, 3, 6, 7, or 8, including the step of the monitoring authority generating and sending the signature verification key N _U for the user to the user. . 14. The method of claim 1, 2, 3, 6, 7, or 8, wherein the signature verification key information is a combination of the face value X and the signature verification key N _U by a predetermined one-way hash function h. Get by processing. 15. An electronic cash system comprising a monitoring organization for monitoring issuance of electronic cash, a bank for issuing electronic cash, a user using electronic cash, and a retail store receiving payment by electronic cash. a user device that executes, user and key generating means for generating a signature key SK _U, the amount X and the signature verification key N signature bank for the _U S _B (N _U)
An electronic cash C including a balance x, a face value X, a signature verification key N _U, and a memory for holding the signature key SK _U ; a payment amount y and any information received from the retail store e is signed using the signature key SK _U , and the signature S
Signature generating means for generating _U (e, y); and balance updating means for updating the balance by subtracting the payment amount y from the balance x. 16. An electronic cash system comprising a monitoring organization for monitoring issuance of electronic cash, a bank for issuing electronic cash, a user using electronic cash, and a retailer receiving payment of electronic cash. A monitoring database that registers the signature verification key information corresponding to the user who owns the issued electronic cash in association with the total usage amount Y; a balance x received from the retail store; , The signature verification key N _U ,
A history database that stores history data H including a bank signature S _B (X, N _U ) and a payment amount y, corresponding to the amount X and the verification key N _U in the history data H Means for retrieving whether the signature verification key information is registered in the monitoring database and, if not registered, determining that the electronic cash is fraudulently used; and, if the signature verification key information is registered, the history data Adding means for adding the payment amount y in H to the corresponding total usage amount Y in the monitoring database; comparing means for comparing the addition result Y + y by the adding means with the face value X; If Y + y <X, the corresponding total usage amount Y in the monitoring database is updated with the addition result Y + y. If Y + y = X, the corresponding signature verification key information in the monitoring database is updated. And the total usage amount Y If Y + y> X, it is determined that the electronic cash is fraudulently used, and the signature verification key information and the total usage amount Y are deleted, and the signature verification key information is notified to the bank. Means. 17. An electronic cash system comprising a monitoring organization for monitoring issuance of electronic cash, a bank for issuing electronic cash, a user using electronic cash, and a retailer receiving payment by electronic cash. a user device to be executed, the user and the signature key SK _U and the signature verification key N key generating means for generating a _U, the amount of money X and said signature verification key using the public encryption key PK _T of monitoring bodies N _U Means for generating encrypted information E _T by encrypting the signature verification key N _U and providing it to the bank; blind signature pre-processing means for performing the blind signature pre-processing on the signature verification key N _U and providing it to the bank; Blind signature post-processing means for processing the received blind signature Z (N _U ) for the signature verification key to obtain the bank's signature S _B (N _U ); and the balance x, face X, signature verification key N _U and Electronic cash C including signature S _B (N _U ) A memory for holding the user signature key SK _U and the public encryption key PK _T of the monitoring organization; and a signature for the payment amount y and any information e received from the retail store. _Done with _U and signed S
Signature generating means for generating _U (e, y); and balance updating means for updating the balance by subtracting the payment amount y from the balance x. 18. A monitoring organization for monitoring issuance of electronic cash
And a bank that issues e-cash
Users and retailers receiving electronic cash payments.
The surveillance authority has a cryptographic function E_T And the above bank
Signature verification function V _B Implement an electronic cash system that has released
Public cryptographic function E_T Secret key SK for decrypting_T Keep
Memory and the signature verification key information including the signature verification key generated by the user
Information E for _T(n) with the secret composite key SK_T To
Decryption means for obtaining the signature verification key information by decryption using the signature verification key information,
A monitoring database for registering the amount of money Y, the balance x received from the retail store, the face value X, and the signature verification key N_U,
Bank Signature S_B(N_U) And the payment amount y
A history database holding history data H including the amount of money X and a verification key N in the history data H._UThe station corresponding to
Name verification key information is registered in the monitoring database
Search, and if not registered, the unauthorized electronic
Means for determining that the data is gold, and if the signature verification key information is registered, the history data
The payment amount y in the data H in the monitoring database
An adding means for adding to the total usage amount Y to be added, and a ratio for comparing the addition result Y + y by the adding means with the face value X.
If the result of comparison by the comparing means and the comparing means is Y + y <X, the monitoring is performed.
Add the corresponding total usage amount Y in the database to the above
Update with Y + y, and if Y + y = X, the above monitoring database
Delete the corresponding signature verification key information and total usage amount Y in
If Y + y> X, it is determined that the electronic cash is fraudulently used.
And delete the signature verification key information and total usage amount Y
And notify the above-mentioned bank of the signature verification key information.
Control means.