AU722824B2

AU722824B2 - Method of securely storing and retrieving monetary data

Info

Publication number: AU722824B2
Application number: AU18733/97A
Authority: AU
Inventors: Antoon Wilfried Jan Bosselaers; Peter Jacobus Nicolaas De Rooij
Original assignee: Koninklijke KPN NV
Current assignee: Koninklijke KPN NV
Priority date: 1997-02-13
Filing date: 1997-02-13
Publication date: 2000-08-10
Anticipated expiration: 2017-02-13
Also published as: WO1998036386A1; CA2279248A1; EP0961998A1; AU1873397A

Description

Method of securely storing and retrieving monetary data.

BACKGROUND OF THE INVENTION The present invention relates to the storing and retrieving of monetary data. More specifically, the present invention relates to the storing of monetary data, such as data identifying electronic cheques and electronic coins, in a storage medium, and to the later retrieval of the stored data by a means for electronic financial transactions, such as a so-called smart card.

Electronic cheques and coins necessarily take up.a fair amount of memory space, as they comprise various authentication data, such as :0.o.10 a signature from a bank (issuer). As the storage capacity of a smart card is usually limited, the need arises to externally store data which ensure the validity of electronic money. However, it must be assured that the data retrieved from storage can be trusted, i.e. are *e.e valid data. To this end it is possible to arrange for an on-line protocol with the issuer each time data are loaded from storage. This is however time-consuming and often involves communications costs.

European Patent Application EP 0 623' 903 discloses a payment system in which smart cards are used. The smart cards may be recharged by authorisation signals issued by a data center. The authorisation O :20 signals are in the form of an encrypted message which includes control o data identifying the particular smart card, the amount by which the card is to be recharged, and information which is stored in the smart card. Although the smart cards are used as store of value and/or funds equivalent data, there is no possibility in the known payment system to store these data outside the smart card, e.g. in an electronic wallet associated with the smart card.

6 o SUMMARY OF THE INVENTION 0 It is an object of the present invention to provide a method for safely storing and retrieving data, such as monetary data, in which the retrieval of data may be executed off-line. It is a further object of the present invention to provide a method which is independent of the specific type of data, such as electronic cheques or coins. It is a still further object of the invention to provide a method in which the validity of monetary data may be derived from an interactive protocol.

To this end, the present invention provides a method of securely storing and retrieving data, the method comprising a first phase involving an interaction between an issuer and a recipient while storing data in a storage, and a second phase involving an interaction between the storage and the recipient while retfrieving data from the storage, the recipient, the storage and the issuer comprising an integrated circuit card, an electronic wallet and a terminal respectively, the first phase comprising: the issuer generating a commitment and sending the commitment to the recipient and the storage, the storage storing the commitment, the recipient, upon receiving the commitment, generating an identification value, N- the recipient generating a fingerprint of the identification :0000 0 value which identifies the identification value but from which :0.00. the identification value cannot be derived, and sending the fingerprint to the issuer, the issuer producing an authenticating value using the received fingerprint and storing the authenticating value in the storage, and the second phase comprising: the recipient retrieving the commitment from the storage, the recipient regenerating the identification value, the recipient regenerating the fingerprint of the identification value and sending the fingerprint to the storage, the storage verifying the fingerprint, and Soo@ the recipient retrieving the authenticating value from the storage.

By substantially repeating in the second phase the interaction of the first phase, a secure protocol may be achieved. The secure protocol effectively eliminates the possibility of loading incorrect monetary data, such as used or forged electronic cheques, into the recipient.

Additional advantageous features are described in the dependent claims.

The method of the present invention thus allows the validity of (monetary) data to be derived from an interactive protocol between an issuer and a recipient, but does not require an interaction with the issuer while retrieving stored data.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 shows schematically an I.C card and an electronic wallet for interacting with the IC card.

Fig. 2 shows schemyatically a system for electroni.c payments, as 'well as the exchange of data according to a first phase of the method of the present invention.

Fig. 3 shows schematically a system for electronic payments; as S veil as the exchange of data according to a second phase of the method of the present invention.

Fig. 4 shows schematically a first phase of the method accordling to the present invention.

Fig. 5 shows schematically a second phase of the method according to the present invention.

EXMPLPRY EMODIh!ENTS The so-called electronic wallet 2 shown in Fig. 1. is a device OS 60 for interacting with an ic card i. The wallet has a keyboard S, a slot 4 for inserting the card 1, means for coummunicating with the inserted card via the card contacts 3, and means for commnicating with an external terminal, such as a cash register (not shown). Such a terminal may comprise a card reader and/or an infra..red card interface for couuunicatinag with the -Ard, preferably via the wallet. The terminal may further comprise means for establishing an on-line connection with a money issuing institution, such as a bank, and/or a secure module for securely storing monetary values or the like.

The wallet 2 allows a user to interact with the card 2. via a Gos WO 98/36386 PCT/EP97/00688 3 keyboard 5 and a display 6. The wallet 2 allows the user to e.g. check balances, transfer balances between accounts, authorize payments, and the like. The wallet also provides a storage for storing electronic cheques, coins and the like, and thus acts as a storage extension for the card. The card 1 is provided with an integrated circuit (IC) arranged under the contacts 3. The integrated circuit may comprise a processor, a memory and I/O (input/output) means. As the memory size of present day smart cards is limited, a wallet may advantageously be used to store for later retrieval payment data which cannot be stored on the card.

The system shown schematically and by way of example in Fig. 2 comprises a recipient 10, a storage 20 and an issuer 30. The recipient and the storage 20 may correspond with the card 1 and the wallet 2 of Fig. 1 respectively. The issuer 30, which may be a bank or another monetary data providing institution, comprises a terminal suitable for interaction with the storage (wallet) In the following text, it will be assumed that the issuer (e.g.

bank terminal) 30 issues electronic money, such as electronic cheques and coins represented by suitable data, while the recipient (e.g.

smart card) 10 receives the electronic money. The storage (wallet) is used both as an intermediary between the issuer 30 and the recipient 10 and as a storage proper for electronic money not stored on the card. It will be understood that the word "money" in this text is meant to comprise various representations of monetary and other values, and specifically comprises electronic cheques and coins. In the following, the terms "monetary data" or just "data" will be used to indicate data related to "money", and especially data representing electronic cheques and coins. However, the method of the present invention may also be applied to other data, such as confidential data.

In the method of the invention, the issuer 30 and the recipient exchange messages as indicated in Fig. 2. In summary, the recipient generates an identification value, performs an interactive protocol with the issuer while storing the relevant data in the storage, and discards most of the data while keeping sufficient data to regenerate the identification value. When retrieving the data, the identification value is regenerated, the interactive protocol is performed with the storage 20 rather than with the issuer 30 as indicated in Fig. 3, and WO 98/36386 PCT/EP97/00688 4 the relevant data are stored in the recipient 10. The identification value and the initial value (seed) for regenerating the identification value may then be discarded. It will be understood that instead of a value for regenerating the identification value, the identification value itself may be temporarily stored.

In the following, it will be assumed that the data exchange between the issuer 30 and the recipient 10 takes place via the storage i.e all data pass through the storage 20. It will be understood that it is just as well possible for the issuer 30 and the recipient 10 to communicate directly and to copy the relevant exchanged data to the storage Reference will now be made to Fig. 4 in conjunction with Fig. 3.

It is noted that in Figs. 4 and 5 the recipient, storage and issuer are denoted by R, S and I respectively. In the method as depicted in Fig. 4, the generation of monetary data (such as electronic cheques) is initiated in step 100, for instance by the recipient 10 sending a relevant request to the issuer 30. In step 101, the issuer (I) generates a commitment A associated with one or more groups of monetary data (electronic cheques and/or coins). This commitment A may be produced by generating and using a suitable cryptographic function

F

1 operating upon a random value W: A F 1 An example of a suitable function F 1 is discrete exponentiation modulo p with generator g of the order q, where q divides p-l and where p and q are predetermined (prime) numbers: A FI(W)= gW mod p. The random value W may be predetermined or may be produced in step 101 using a random number generator.

The commitment A, by means of which the issuer commits himself to the monetary data, is sent to the recipient in the present example via the storage which stores the commitment A. The commitment A may be (temporarily) stored in the recipient as well.

In step 102, upon receiving the commitment A, the recipient generates an identification value C. This is for example a random number, generated on the basis of a seed X using a second (random) function F 2 C F 2 Optionally, the seed.X is the result of combining a (fixed) base seed X 0 and an index Y. The index Y, which may have a considerably shorter length than the seed X, may e.g. indicate an entry in a table of seeds. Preferably, the index Y indicates how many times the function F 2 is tobe applied, starting from the base WO 98/36386 PCTIEP97/00688 seed X 0 to obtain the desired seed X. For example, if Y is equal to 3, the seed X may be obtained by applying the (random) function F 2 three times: X F2(F2(F2(X))).

The seed X is stored in the recipient If a base seed X 0 is used, this base seed is preferably permanently stored in the recipient, while the index Y may be stored in the recipient or the storage Instead of storing the seed X or the index Y, it is also possible to store the value C. In practice, C will comprise more bits than Y and will thus require more storage space, making the storing of Y more economical.

Preferably, the relevant value X or X 0 is stored in such a way so as to be directly linkable to a value A. That is, the storage may comprise a plurality of values A each corresponding with a cheque), a relevant value X or X 0 being stored for each value A.

Subsequent to the computation of the identification value C, the recipient generates a "fingerprint" E of the identification value C using a third function F 3 E F 3 Preferably, the fingerprint E also involves the value A: E F 3 The function F 3 may for example involve subjecting the combination of the identification value C and the commitment A to a so-called hash function H: E This fingerprint E, which identifies the identification value C but from which the value C cannot be derived, is sent to the issuer.

In step 103, the issuer uses the received fingerprint E to produce a value B using a fourth function F 4 B F 4 Such a function involves, for example, multiplying the fingerprint E by a secret key Ks modulo q and adding the result to the previously used random value W: B W E.K s mod q. The value B thus derived is stored in the storage The value B, which is the authenticating value of monetary data, may optionally be sent to the recipient e.g. for verification purposes, but this is not essential.

It should be noted that the above scheme serves to produce data cheques) to which both the issuer and the recipient have contributed. The final value B is derived by the issuer from the value E, which is in turn derived by the recipient from the value A. As the value A was produced by the issuer, the values concerned are mutually linked.

In a first embodiment of the present invention, the value B is WO 98/36386 PCT/EP97/00688 6 not passed on to the recipient but stored in the storage for later retrieval. In a second embodiment of the present invention, the value B is not only stored in the storage but also sent to the recipient for verification purposes. In the second embodiment, an additional step 104 (not shown in Fig. 4) is carried out in which additional data D may be derived from the values A, B, C and the public key Kp associated with the secret key Ks. These data D, which are associated with the value B, provide additional information with respect to the monetary values concerned. The data D may further be verified using the same values, for example by verifying whether

F

5 O, where D i.e. the combination of A, B and E (or In actual implementations, it may be verified whether gB A.KpE mod p. The seed X, or alternatively the identification value C, is stored by the recipient R. Further data, including the data D and the values A, B and C (or may now be discarded, as the generation part of the method is completed.

Reference will now be made to Fig. 5 in conjunction with Fig. 3, in which figures the reconstruction phase is depicted. The reconstruction phase of the method of the present invention is initiated by the recipient in step 110. In step 111 the commitment A is retrieved from the storage S. If an index Y was used in step 102 to determine the seed X, this index Y is also retrieved. It should be noted that the storage should not contain both Y and X 0 or X, as that would allow the storage to produce monetary data without the involvement of the recipient.

In step 112, the identification value C is regenerated on the basis of the seed X. The fingerprint E of the identification value C is also regenerated, for example by subjecting the combination of the identification value C and the commitment A to a so-called hash function: E This fingerprint E, which identifies the identification value C but from which the value C cannot be derived, is sent to the storage S.

In step 113, the stored value B is retrieved. Optionally, the fingerprint E can be checked by verifying whether F 5 O. In actual implementations, it may be verified whether gB A.KpE mod p.

Subsequently, in step 114 the retrieved value B is used to regenerate the data D from A, B, C and the public key Kp of the issuer I. The validity of the thus regenerated data D may further be verified using WO 98/36386 PCTIEP97/00688 7 the same values, for example by verifying gR A.KpE mod p.

In the above method, data D) are generated on-line and regenerated off-line. The method thus offers the possibility of regenerating data without the need to involve the issuer. The issuer only "signs" the data (in a challenge-signed response exchange involving E and B) in the first phase. The method uses a controlled replay of the first phase to regenerate data in the second phase, where the recipient verifies the data. With the aid of the keys Ks and Kp, a further protection of the data is achieved.

As the first (generation) phase may be considered to constitute an interrupted withdrawal of monetary) data, which withdrawal is substantially repeated by the recipient in the second (reconstruction) phase, the recipient is capable of using identical protocols in both phases. As a result, there is no need for storing in the recipient additional code (software) for the second phase, thus effectively saving memory space.

In the above example, an electronic wallet has been shown as an example of an external storage. The invention may also be used with other types of storage, such as another card or other terminal.

It will be understood by those skilled in the art that the embodiments described above are given by way of example only and that many modifications and additions are possible without departing from the scope of the present invention.

Claims

1. A method of securely storing and retrieving data, the method comprising a first phase involving an interaction between an issuer and a recipient while storing data in a storage, and a second phase involving an interaction between the storage and the recipient while retrieving data from the storage, the recipient, the storage and the issuer comprising an integrated circuit card, an electronic wallet and a terminal respectively, the first phase comprising: the issuer generating a commitment and sending the commitment to the recipient and the storage, C* 00 00 0° S* the storage storing the commitment, 0*o0@ the recipient, upon receiving the commitment, generating an identification 0@ eg •value, 15 the recipient generating a fingerprint of the identification value which identifies the identification value but from which the identification value cannot be derived, and sending the fingerprint to the issuer, the issuer producing an authenticating value using the received fingerprint and storing the authenticating value in the storage, 5 and the second phase comprising: @550 the recipient retrieving the commitment from the storage, the recipient regenerating the identification value, 25 the recipient regenerating the fingerprint of the identification value and sending the fingerprint to the storage, the storage verifying the fingerprint, and the recipient retrieving the authenticating value from the storage.

2. recipient. A method according to claim 1, wherein the identification value is stored in the

3. A method according to claim 1, wherein the identification value is generated or regenerated from a seed stored in the recipient. [H:]00854.doc:jls

4. A method according to claim 3, wherein the seed is the result of combining a fixed base seed and an index, the index indicating how many times a function is to be applied to the base seed.

A method according to claim 3 or 4, wherein the first phase comprises the additional step of discarding the identification value.

6. A method according to any of the preceding claims, wherein the first phase io comprises the additional step of the recipient discarding the commitment and the authenticating value. 00 S•

7. A method according to any of the preceding claims, wherein the recipient o. produces the fingerprint by subjecting the combination of the identification value and the S 15 commitment to a function, preferably a hash function. 000000

8. A method according to any of the preceding claims, wherein the issuer produces the authenticating value using the fingerprint and a secret key. S 20

9. A method according to any of the preceding claims, wherein in the second Sphase the recipient uses the retrieved data to regenerate monetary data. A method according to claim 9, wherein the regenerated data are verified by means of the issuer's public key.

S S..i

11. A method according to any of the preceding claims, wherein the recipient is a smart card and the storage is an electronic wallet.

12. Use of a method according to any of the preceding claims to regenerate an electronic cheque.

13. Use of a method according to any of claims 1-12 in a system for electronic monetary transactions, the system being arranged for storing and retrieving monetary data. [H:]00854.doc:jls

14. A method of securely storing and retrieving data substantially as herein described with reference to the accompanying drawings. DATED this Twenty-third Day of July, 1999 Koninklijke PTT Nederland N.V., Patent Attorneys for the Applicant SPRUSON FERGUSON 1008 54. doc~j Is