Electronic cash implementing method using a trustee

Claim 2

The method of claim 1, further comprising steps: (5) wherein said user shows said anonymous public key, said license and said electronic cash to a shop and uses said anonymous public key to generate a payment signature S assuring the payment of the amount of money spent and provides said signature to said shop; and (6) wherein said shop delivers payment history information H to said bank to settle therewith an account and obtain an amount of money corresponding to said amount spent.

Claim 3

The method of claim 2, further comprising a step wherein said bank makes a check to see if the total amount paid by said electronic cash is smaller than said face value X, and if so, extracts at least said anonymous public key of a history of all payments by said electronic cash and transmits it to said trustee.

Claim 4

The method of claim 1 or 2, further comprising a step wherein when receiving an official order or permission of a third party, said bank and said trustee each retrieve one of identification information and anonymous public key of a user specified by said third party from said communication history placed under the supervision of said band and said correspondence table held under the supervision of said trustee and inform said third party of said retrieved identification information and anonymous public key.

Claim 5

The method of claim 1, further comprising the steps: (5) wherein a first user as said user shows said license and electronic cash C of said first user to a second user; and (6) wherein said first user uses his anonymous public key N 1 to generate a transferring signature which assures the transferring of a divided amount x smaller than said face value X and providing said transferring signature to said second user.

Claim 6

The method of claim 5, further comprising a step wherein said second user shows to a shop a history of said electronic cash at the time of transferring and said license of said second user and uses anonymous public key N 2 of said second user to generate a signature assuring the payment of an amount y smaller than said divided amount and provides it to said shop to make the payment thereto.

Claim 7

The method of claim 1, wherein said digital signature in said step (2) is generated by a digital signature method based on an RSA scheme, and said blind signature in said step (4) is generated by a blind signature method based on said RSA scheme.

Claim 8

The method of claim 2, wherein said payment signature in said step (5) is generated by a digital signature method based on an RSA scheme.

Claim 9

The method of claim 5, wherein said transferring signature in said step (6) is generated by a digital signature method based on an RSA scheme.

Claim 10

The method of claim 1, wherein said digital signature in said step (2) is generated by a digital signature method based on an RSA scheme and said blind signature in said step (4) is generated by a blind signature method based on zero-knowledge interactive proof.

Claim 11

The method of claim 2, wherein said payment signature in said step (5) is generated by a digital signature method based on an ESIGN scheme.

Claim 12

The method of claim 7, wherein: in said step (1), said user: generates two large prime numbers P and Q; uses said prime numbers to calculate a composite number N=P×Q as said anonymous public key; makes the following modular inverse calculation d = e -1 mod LCM(P-1,Q-1) from said prime numbers P and Q and a key e common to all users, LCM(a,b) representing a least common multiple; stores d and N in a memory; and transmits N to a trustee; in step (2), said trustee: keeps the correspondence of said user and said N as said correspondence table in secrecy; generates information I on the term of validity or the like; generates, by one-way function g-calculation and modular exponential calculation, said digital signature expressed by the following equation B = g(N∥I) ​ d W mod n B through use of a secret key (d B ,R B ) for signature of said trustee; and transmits said signature B and said information I to said user; in step (3), said user: stores information (B,I,N) from said trustee as said license in a memory; generates and stores a random value b in said memory; calculates a one-way function g(B∥b) from said random value b and said license (B,I,N) read out of said memory; calculates the following equation Z = g(B∥b)r ​ e C mod n C through use of public information (e C ,n C ) of said bank corresponding to said face value; and transmits said information Z to said bank, together with said amount information of said electronic cash; and in said step (4), said bank: calculates the following equation Θ = Z ​ d C mod n C through use of said Z received from said user and a secret key (d C ,n C ) corresponding to said face value of said electronic cash; and transmits said information Θ to said user; and said user calculates the following equation C = Θ/r mod n C through the use of said information Θ received from said bank and said public key (e C ,n C ), thereby obtaining said electronic cash C of said specified face value.

Claim 13

The method of claim 8, wherein said step (5) comprises the steps: (5-1) wherein said user information {I,N,B,b,C} to said shop; (5-2) wherein said shop: verifies the validity of said digital signature B for information (I,N) by checking whether said B satisfies B ​ e B ≡ g(N∥I)(mod n B ) through use of a public key (e B ,n B ) for signature of said trustee; verifies the validity of said electronic cash C for information (B,b) by checking whether said C satisfies the following equation C ​ e C = g(B∥b)(mod n C ) through the use of said public key (e C ,n C ) of said bank; when either verification fails, halts subsequent processing; when either verification succeeds, generates a random value E' and sends it to said user together with identification information ID V and a time stamp T; and calculates therefor E=h(ID V ∥T∥E') through the use of a one-way function h; (5-3) said user: calculates the following equation S = g(x∥h(ID V ∥T∥E')) d mod N as a payment signature for the amount spent x of said electronic cash C and sid information received from said shop through the use of a secret key (d,N) of said user; and sends said payment signature S and said information x to said shop; and said step (6) comprises the steps: (6-1) said shop makes a check to see if said amount spent x is smaller than said face value X of said electronic cash C; when said check does not pass, halts subsequent processing; and when said check passes, verifies the validity of said payment signature S by checking whether said S satisfies the following equation S e ≡ g(x∥E)(mod N); and (6-2) when this verification succeeds, said shop regards the payment of the amount corresponding to said amount x as being valid and receives it from said user.

Claim 14

The method of claim 9, wherein: said step (5) comprises the steps: (5-1) said first user sends said license (B 1 ,I 1 ,N 1 ) and said electronic cash (b,C) to said second user; (5-2) said second user: verifies the validity of a signature B1 for said (I 1 ,N 1 ) by checking whether said B1 satisfies the following equation B 1 ​ e B ≡ g(N 1 ∥I 1 )(mod n B ); verifies the validity of said electronic cash C for said (B 1 ,b) by checking whether said C satisfies the following equation C ​ e C ≡ g(B 1 ∥b)(mod n C ); when either one of these checks does not pass, halts subsequent processing; and when the both checks pass, generates a random value E 2 ' and sends it to said first user together with a signature B 2 for said second user, and calculates E=h(B 2 ∥T∥E 2 ') ; and said step (6) comprises the steps: (6-1) said first user: performs calculates a signature for said amount x to be divided from said electronic cash C by the following equation S 1 = g(x∥h(B 2 ∥T∥E 2 ')) ​ d 1 mod N 1 ; and sends said signature S 1 and said amount x to said second user; and (6-2) said user: makes a check to see if said amount x is smaller than the maximum amount X of said electronic cash C; when this check does not pass, halts subsequent processing; when said check passes, verifies the validity of said signature S 1 by checking whether said S 1 satisfies the following equation S 1 ​ e 1 ≡ g(x∥E)(mod N 1 ); and when this check passes, said second user regards the transferring of the amount worth said amount x from said first user as being valid and receives it.

Claim 15

The method of claim 14, further comprising the steps: (7) said second user sends to said shop said second license (B 2 ,I 2 ,N 2 ) and a history H 1 (I 1 ,B 1 ,N 1 ,B 1 ,b,C,x,T,E 2 ',S 1 ) of communications conducted with said first user when electronic cash was transferred; (8) said shop: verifies the validity of said signature B 2 of said second user for (I 2 ,N 2 ) by checking whether said B2 satisfies the following equation B 2 ​ e B ≡ g(N 2 ∥I 2 )(mod n B ); and verifies the validity of said communication history H 1 ; when either one of these checks does not pass, halts subsequent processing; when said checks both pass, generates a random value E' and sends it to said second user together with identification information ID V ' and a time stamp T' and calculates E V =H(ID V ∥T'∥E V ') ; (9) said second user: generates a signature S 2 for an amount y to be divided from said transferred amount x for spending, by the following equation S 2 = g(y∥h(ID V ∥T'∥E V ')) ​ d 2 mod N 2 and sends said signature S 2 and said amount x to said shop; (10) said shop: makes a check to see if said amount y is smaller than the amount x to be divided from said electronic cash C for transferring; when this verification fails, halts subsequent processing; when said verification succeeds, verifies the validity of said signature S 2 by checking whether said S 2 satisfies the following equation S 2 ​ e 2 ≡ g(y∥E V )(mod N 2 ); when this verification succeeds, regards the payment of the amount worth y and receives it from said second user.

Claim 16

The method of claim 10, wherein: in said step (1), said user: generates two large prime numbers P and Q; uses said prime numbers to calculate a composite number N=P 2 ×Q as said anonymous public key; stores d and N in a memory; and transmits N to a trustee; in step (2), said trustee: keeps the correspondence of said user and said N as said correspondence table in secrecy; generates information I on the term of validity or the like; calculates the following equation B ≡ g(N∥I) ​ d B mod n B through use of a secret key (d B ,n B ) for signature of said trustee; and transmits said B and said information I to said user; in said step (3), said user: (3-1) stores information (B,I,N) from said trustee as a license in a memory; (3-2) said bank responds to a request of said user for withdrawal of said electronic cash to generate a random value r, calculates the following equation a' = r ​ L C mod n C and transmits it to said user; (3-3) said user generates random value r' and b , calculates the following equation a = a'r' ​ L C hc b mod n C and stores it in a memory, calculates the following equation c = g(B∥a)mod n C and stores it in a memory, and calculates the following equation c' = c+b mod L C and transmits it to said band; in said step (4), said bank: (4-1) calculates the following equation y' = rx C C mod n C trough the use of a public key (h C , L C ,n C ) corresponding to the face value of said electronic cash and a secret key x C , transmits it to said user, and at the same time, withdraws the amount concerned from the account of said user, or receives said amount from said user by some other means; and (4-2) said user calculates d which satisfies the following equation c' = c+b+dL and calculates the following equation y = y'r'h -d mod n C and store it in a memory together with a and c in the form of electronic cash C=(a,c,y) .

Claim 17

The method of claim 11, wherein: said step (5) comprises the steps: (5-1) said user sends I, N, B, C to said shop; (5-2) said shop verifies the validity of a signature B for (I,N) by checking whether said B satisfies the following equation B ​ e B ≡ g(N∥I)(mod n B ) through the use of a public key (e B ,n B ) for signature of said trustee and verifies the validity of said electronic cash for said signature B by checking whether said C satisfies the following equation y ​ L C ≡ ah c (mod n C ) c = g(B∥a) when this verification fails, halts subsequent processing; when this verification succeeds, said shop generates a random value E' and sends it to said user together with identification information ID V and a time stamp T and calculates E=h(ID V ∥T∥E') by using a one-way function h; and (5-3) said user: determines that he spends an amount x in said electronic cash C, calculates the following equation m = x∥h(ID V ∥T∥E') and generates an ESIGN signature S by the following equation S = E SIG (m, p, q) through the use of a secret key (p,q) of said user and sends said amount x and said signature S to said shop; and said step (6) comprises the steps: (6-1) said shop makes a check to see if said amount x is smaller than the maximum amount X of said electronic cash C; when this check fails, halts subsequent processing; when the check passes, verifies the validity of said ESIGN signature S by the following equation E VER (m,S,N) = OK/NG through the use of said pieces of information m, S and N; and when this verification succeeds, said shop regards the payment of an amount worth said x as being valid and receives it from said user.

Claim 18

The method of claim 17, further comprising the steps: (7) said shop presents to said bank a history H of communication conducted with said user for the spending of said electronic cash; (8) said bank verifies the validity of said communication history H and, when this verification succeeds, stored the history H and pays an amount concerned into an account of said shop, or pays said amount to said shop by some other means; (9) said bank places said history H under its supervision to prevent said electronic cash C from being spent in excess of the maximum amount X and, if said cash C is spent in excess of the maximum amount X, presents a history of all payments by said electronic cash C as evidence of an attack; and (10) said trustee finds out said user's name from said correspondence table on the basis of said N contained in said communication history H and identifies the attacker.

Claim 19

The method of claim 1, wherein said turstee is composed of a plurality of institutions, and said step (2) is a step of storing the correspondence of said user identification information ID V and said anonymous public key N as information distibuted among said plurality of institutions.

Claim 20

The method of claim 19, wherein in said step (2), said plurality of institutions store the correspondence of said user identification information ID U and said anonymous public key N in a sequentially corresponding manner by different pairs of sequentially associated pieces of information so that only when said plurality of institutions cooperate, the correspondence of said anonymous public key N and said identification information ID U can be detected from said associated pieces of information.

Claim 21

The method of claim 20, wherein said plurality of institutions are t institutions 40T 1 to 40T t , and said step (1) comprises the steps: (1-1) wherein said user generates keys k 1 to k t in a one-to-one correspondence with said t institutions 40T 1 to 40T t when he registers said anonymous public key N with said t institutions; (1-2) wherein said user uses a public key cryptography function E i of each institution 40T i to recursively calculate φ=E i (k i ∥φ i-1 ) for 1≤i≤1 to ultimately obtain φ t , φ 0 being the identification information ID U of said user; and (1-3) wherein said user recursively calculates Φ 1 =E 1 o··· oE t (N∥φ t ) , where E i oE j (x) represents E i (E j (x)), said Φ 1 being transmitted to said first institution 40T 1 ; and said step (2) comprises the steps: (2-1) said first institution uses a public key decryption function D 1 to calculate Φ 1 =D 1 (Φ 1 ) and transmits it to said second institution 40T 2 , and for i=1,...t-1 , said each institution 40T i uses the public key decryption function D i to calculate Φ i+1 =D i (Φi) and transmits it to said institution 40T i+1 so that said institution 40T t ultimately obtain Φ t ; (2-2) said institution 40T t uses said public key decryption function D t to calculate (N∥φ t )=D t (Φ t ) from Φ t and (k t ∥φ t-1 )=D t (φ t ) from φ t and finally obtains (N,φ t-1 ,k t ); (2-3) said institution 40T t generates a digital signature for said anonymous public key N, encrypts said digital signature B into Ψ t =ε kt (B) , using k t as a secret key, stores N, B and φ t in a memory and transmits (φ t-1 ,φ t ) to said institution 40T t-1 ; (2-4) wherein said institution 40T i calculates (k i ∥φ i - 1 )=D i (φ i ) from φ i , encrypts Ψ i+1 into Ψ i =e ki (Ψ i+1 ) by using k i as a secret key, then stores a pair off associated pieces of information (Ψ i , Ψ i+1 ) and transmits (φ i-1 , Ψ i ) to said institution 40T i-1 , this sequence of operations being repeated for i=t-1,t-2, ...,t so that said institution 40T t ultimately obtains (φ 1 , Ψ 2 ); (2-5) wherein said institution 40T 1 calculates (k 1 ∥I D U )=D 1 (φ 1 ) from φ 1 , identifies said user on the basis of said identification information ID U , calculates Ψ 1 =ε k1 (Ψ 2 ) from k 1 and Ψ 2 , stores ID U , Ψ 2 and Ψ 1 in a memory 40M 1 and transmits Ψ 1 to said user; and (2-6) wherein said user obtains said digital signature B from said trustee by the following equation B = δ kt o···oδ k1 (Φ 1 )=g(N) ​ d T mod n T through the use of decryptors for (k 1 ,...,k t ) and ε.

Claim 22

The method of claim 1, wherein said trustee is composed of t independent institutions 40T 1 to 40T t , t being an integer equal to or greater than 2, and which further comprises the step wherein, when getting electronic cash issued by said bank, said user generates a random value λ corresponding to said electronic cash C and t-1 random values λ 1 ,..., λ t-1 and calculates E 1 (λ(1)), ..., E t (λ(t)) for said t institutions by using public key encryptors E 1 , ..., E t , where λ(x)=λ+λ 1 x+...+λ t-1 x t-1 mod r , said E 1 (λ(1)), ..., E t (λ(t)) being transmitted to each of said t institutions.

Claim 23

The method of claim 22, further comprising the step where, when receiving an official request or permission from a third party, said t institutions cooperates to decrypt said random values λ and write them into a database.

Claim 24

The method of claim 23, wherein said random value decryption processing comprises processing by which said t institutions respectively extract pieces of secret information λ(1), ..., λ(t) from said E 1 (λ(1)), ..., E t (λ(t)) by the corresponding public keys and calculate, from said pieces of secret information and a parameter r, λ 1 , ..., λ t-1 which satisfy the following equation λ(x) = λ+λ 1 x+...+λ t-1 x t-1 mod r