DE102005008610A1 - Internet download e.g. articles of newspaper, cost paying method, involves protecting anonymity of user until attempt to fraud is identified, and automatically determining identity of defrauded user and proof for attempt to fraud - Google Patents

Abstract

The method involves providing digital assessing units with security features and protecting an anonymity of a user until an attempt to fraud is identified during testing of the security features. The identity of a defrauded user and a proof for the attempt to fraud are automatically determined during the testing of the features. Independent claims are also included for the following: (1) a computer program for paying cost to internet download (2) a computer program product for paying cost to internet download (3) a data carrier with a program code medium for paying cost to internet download (4) a computer system for paying cost to internet download.

Description

The The present invention relates to a method for payment in computer networks, especially on the internet. About that In addition, the invention relates to a computer program, a computer program product, a disk as well as a computer system.

In In recent years, the internet has become more and more part of ours Become life. Instead of how it used to be laborious in libraries or other institutions for information Many people today use the internet for this. But though the "free" area of the worldwide Network is gaining in importance, so has the other part the Internet (e.g., paid downloads of music, lyrics, other services, ...) so far hardly enforced.

Of the most important reason for This lack of interest is the question of the possibility of payment. Dubious provider and, above all, insecure payment methods (e.g. Computer programs that allow dialing in via 0190 numbers so-called "dialers", ...) have that Shopping on the Internet in disrepute.

This Mistrust across from the method of payment on the Internet is not unjustified. Because often is it with simple tricks (like spying on the credit card number) possible, size Stealing amounts of money. About that In addition, the terms and conditions are becoming more numerous Operators of payment services a result of misuse of passwords Damage to the customer. All in all, a situation that an average user can barely move on the internet with smallest amounts for one desired file, a piece of music or the like to pay.

in the Contrary to normal, real money, "digital" money is not just any object, that one simply hand over to another party can be (such as cash). Rather, it is at a Payment process with "digital" money to the implementation more complicated Data logs to the implementation of which the customer, the seller and the bank (and some other parties) are involved.

digital Money is mainly different by cash, that the Safety not by mechanical but by mathematical factors is determined. While Cash can not be (simply) copied, electronic data can be very slightly duplicated be without leaving a trace.

One Modern payment system must meet the following conditions fulfill: The money may not be fake or can be copied (Safety). An uninvolved (or a bank) may not Can be detected, who paid with whom (anonymity). The money must (without Detour over the bank) can (Transferability). A payment must also can be made without a direct (online) connection to the bank ("offline" payment).

normal Cash met these conditions largely. The currently used "digital" money is from these Ideal, however, far away. For example, with credit cards easily from a criminal Internet retailer the credit card number abused to make payments with foreign money. In addition, anyone can understand who has shopped at whom. Furthermore, without contact with the Bank transferring not possible with money with credit cards. The credit card system Fulfills therefore none of the above conditions. When paying with EC (Eurocheque) cards behaves it is similar.

A The object of the present invention is an improved process to provide for payment in computer networks. This task is done by in the independent Claims described Invention objects solved.

The inventive method is characterized by the fact that digital Value units are provided with security features and the anonymity of a User is maintained until a check of the security features fraud is detected, in which case both the identity the cheating one User as well as a proof of the fraud attempt can be determined automatically.

The Invention relates to this In addition, a computer program for payment in a computer network, in particular User program, with program code means for providing digital Value units with security features and with program code means to maintain anonymity of a user until a check of the security features a scam is detected.

The Invention relates to this In addition, a computer program for payment in a computer network, in particular Bank program, with program code means for automatic determination the identity a cheating one User as well as a proof of the fraud attempt.

The invention also relates to a computer program product on a computer readable medium stored program code means for providing digital value units with security features and stored on a computer-readable medium program code means for maintaining the anonymity of a user when paying in a computer network until a check of the security features fraud detection is detected when the computer program product on a computer, especially on a customer or vendor computer.

The Invention relates to this a computer program product with on a computer readable Medium stored program code means for automatic detection the identity a cheating one User when paying in a computer network as well as a proof for the Fraud attempt when the computer program product on a computer, in particular on a bank computer.

The Invention relates to this also a disk with program code means for providing digital value units with security features and with program code means to safeguard anonymity of a user while paying in a computer network until, until at a review of the Security features a scam is detected.

The Invention relates to this also a disk with program code means for automatically determining the identity of a cheating User when paying in a computer network as well as a proof for the Attempted fraud.

The Invention relates to this In addition, a computer system, in particular bank computer trained for execution program code means for automatically determining the identity of a cheating User when paying in a computer network as well as a proof for the Attempted fraud.

The Invention relates to this In addition, a computer system, in particular customer or vendor computer, designed for execution program code means for providing digital value units with security features and program code means to safeguard the anonymity of a user while paying in a computer network until, until at a review of the Security features a scam is detected.

There because of the ease of copying electronic data not possible is a duplication "digital To prevent money " and the new method "offline" payments (ie transactions without Contact with a bank during the Pay) should, is the desired Security of the new method achieved by the anonymity of a User (customer or seller) only as long as he is not cheating. However, a user tries for example, "digital Money "(units of value) to duplicate or while to manipulate data used in the transaction, he gives the Bank both his identity as well as the proof of the attempted fraud.

The Procedure supports thereby on a coin-based Protocol. That is, not - as for example in transfers - a specific Sum is entered in a form. Rather, hands over the customer to the seller Value units in the form of digital coins. The purchase is preferably made in such a way the existence Customer one of a seller provided encrypted Download file from the Internet. To use the file, he has to do this but decrypt it first. The one for this required keys receives he from the seller in return for paying the file by means of a number of digital Coins.

There the security of the new procedure is based on the fact that in Case of fraud attempt his identity and a proof of this Fraud must reveal, must especially big Value to be placed on a secure login. This can therefore not completely "online" expire.As a result, the user receives a special anonymous signature key pair, in its private key the identity the user is saved. The bank can follow the Registration of this key pair However, do not assign this user any more. Signs a user however, twice the same document, the private key can be recalculated and thus his identity be found out.

In detail, the user first acquires a confirmation that he has acquired such a coin for a real monetary value. With this, he can pick up his digital coin at the bank anonymously on the Internet. The bank binds by its signature the anonymous public key of the user to this coin. If the user would now like to purchase an Internet-provided (eg a music file), he can have the anonymous key transmitted by the seller and signs the coin together with the seller's public key. He also signs a coin identifier M _ID , a random number that was randomly selected by the user when the coin was issued. This coin identification feature M _ID can only be signed once without the signer revealing his identity. For this reason, a customer can use a digital coin only once. The seller can now send the digital coin back to the bank for real To receive money.

The inventive method is characterized by the fact that it unlike most other methods too handy for the dealer is anonymous. In other words, the bank or another uninvolved Party do not understand who bought the whom. This is without the help of the customers concerned also with lengthy research not possible.

When Bank can while actual Banks, savings banks or the like occur. It is, however, too possible, that others Companies as provider of the payment system to take over the function of the bank.

The inventive method especially for Paid Internet downloads with relatively low value (cents amounts and low Euro amounts) be used, for example, for downloading pieces of music, articles from online newspapers, online bookstores, scientific Information or the like. It allows a safe, fast and uncomplicated payment process in the prior art not well-known retention of anonymity of users.

Of the Customer has to do not commit to anything and must do not expect unexpected follow-up costs, such as in dialer programs partially the Case is.

to Implementation of the method according to the invention a computer system is provided which has at least one customer computer, a seller computer and comprises a bank computer, wherein the computers for communication or data exchange purposes connectable with each other, for example via the Internet. Customer and sellers computer are preferably designed as standard PCs. The bank computer can also be a standard PC or a more powerful computer, However, preferably by additional security measures (e.g., placing the computer in a secure location, Access controls, ...) is protected against misuse.

Furthermore Computer programs are provided which illustrate the method steps according to the invention carry out, if they are running on a machine. It serves the running on the bank computer Bank software as headquarters and is u.a. for the registration of the users and the conversion of real money into digital coins and vice versa as well as for the investigation of frauds and their settlement trained.

The for the Customer's computer program and the computer program used for the seller are preferably identical and are hereinafter referred to as "user software" Customer only needs to select the desired item during a purchase and the payment system according to the invention If necessary, all further steps are carried out fully automatically ensures easy handling.

The Invention will be described below with reference to a preferred embodiment described. The process steps are in a so-called "protocol for the exchange of digital money ". For one Implementation of the procedure in practice is a programming to the execution on the customer's computer, the seller's calculator and computer programs provided to the bank computer in accordance with Specifications of the protocol.

In order to provide the necessary "basic infrastructure", the Bank publishes on its website a number of public keys (in the so-called public-key procedure) required for the use of the protocol, which are keys for decrypting or checking only Any user (customer or vendor) of the process must first download these keys from the bank's website, and the keys are abbreviated as follows in the following protocol description:
B _s : This key is used to sign the users' public keys.
B _i for iεM, where M represents the set of different denominations, eg M = {1 cent, 2 cents, 5 cents, ...}. With these keys B _i , the bank signs (signs) all issued coins of the given monetary value.

Preferably, "final amounts" are offered as coin values, such as 49 cents, 99 cents or the like.
B: This public key is used by the merchant and the buyer during coin transfer to encrypt some important assets in order to protect against fraud by the other party.

The following additional abbreviations are also used in the following description:
S _P (x): A number x is digitally signed with the associated private (secret) key of the public key P.
E _P (x): A number x is encrypted with the public key P.

In addition, a "blind signature" means that a message is sent before the Un is encrypted in such a way that the signer does not see the actual document, but his signature is nevertheless valid. This procedure is needed in some steps of the protocol to ensure anonymity. A mathematical solution to this problem is given below. The following notation is used for blind signatures: The user software encrypts a message for a public key (another party). This means that the user software selects a random key for the blind signature and encrypts the message according to the procedure given below. This new encrypted message will be sent to the other party for signing. If the user software then retains the signed encrypted message, it can decrypt the signature with the previously selected key, thus obtaining the valid signature for the original message.

Should at some step during the processing of the transaction log, in which a value to its correctness checked If a mistake is found, then the party that ends has detected the error immediately unless otherwise stated. This rule is fundamental to the safety of the process of the invention. It depends on the type of check (syntax check, plausibility check, substantive exam etc.) not on.

The Communication between the parties is done during all protocol parts through a secure connection, e.g. SSL (Secure Sockets Layer), secured, so that bystanders can not intercept important data.

Step One: Registration

following describes how to log in a user at the bank. It's playing It does not matter if the user later than this protocol Buyer, as a seller or both.

In In a first step, the user sends the bank by post a registration form containing: the user's address, a copy of the ID card (to complicate fraud in this step) and his signature.

in the next Step, the bank stores this data in a designated space and database usable by the bank software on the bank computer from. The bank checks, whether already a customer of the same name or another Person with the same address already registered. After successful exam the bank only sends the user to the given address one once valid registration pin, which must be used within a fixed period.

In a next step, the user creates a non-anonymous key pair U _N , ie a non-anonymous public key and a non-anonymous private key, using his user software provided by the bank on CD-ROM or downloaded by the user via the Internet. For this purpose, the user software uses any encryption method, for example PGP or a similar method. The keys are preferably generated by the user software executed on the customer or vendor computer automatically after the entry of the registration pin.

Furthermore, the user software automatically generates another anonymous t _A key pairs U _i, for 1 ≤ i ≤ t _A. The value t _A serves as a safety factor, as will be explained in more detail below. It is determined by the bank and preferably stored in the user software. The value is the same for all users, for example, t _{A has} the value 256. The key pairs U _Ai have the property that after two signatures for a document, the identity of the user can be calculated from this key (a procedure for this is explained below ) indicated. For the generation of these further key pairs an encryption method is used, which ensures this property.

The public keys belonging to the key pairs U _Ai are automatically encrypted by the user software for a blind signature and sent to the bank computer. The bank does not get any insight into the keys.

In the next step, the bank software running on the bank calculates automatically U S = S bs (U N || U ID ) where U _ID includes the identity of the user. Here, U _{S represents} the bank signature of the non-anonymous user key and the user identity, S _BS represents the signature function with the private key portion of the bank key B _S , and U _{N is} the non-anonymous key of the user. U _ID is a number that contains the identity of the user. x || y means that the two values are concatenated (eg 01 || 7 = 017) and then passed to the signing function. Furthermore, the bank software automatically randomly selects from the t _A public keys U _A t _A -1 and requests the user software to send the private keys for them. For this purpose, she sends a message to the customer or seller computer.

In one next Step transmitted the user software automatically requested, the identity of the user containing private key as well as the user keys for the blind signature to the bank computer.

Subsequently, the bank software automatically checks the nature of the key pairs and, when the check is completed without any objections, signs the unseen key U _A yet unseen: U AS = S bs (U A ).

In this case, U _{AS is} the signature of the bank of the user's anonymous key, which is still encrypted for the blind signature. In addition, the bank software automatically deletes the customer's one-time activation pin and transmits the encrypted file to the customer or vendor computer.

Finally, the decrypted User software automatically the now ready to use anonymous key of User by opening the blind signature.

Now the user owns all for needed the transactions Key. A non-anonymous key, to be a seller on sale to the buyer across from identify and an anonymous key that is bound to the coin is going to be as a seller or buyer Exclude fraud by multiple use of the coin. At It should be noted that the buyer is only anonymous in transactions key used.

A fraudulently acting user of the system, in the just-described logon procedure, could try to obtain an anonymous key signed by the bank that does not contain his identity. He could use a coin several times more than once before the bank blocks his anonymous key. However, since this key would not contain his identity, the bank can of course take no further action against the fraudster. For this reason, the bank requests that the customer generate t _A key. Since only one of these keys does not check the condition, the cheater has only a tiny chance of 1 / t _A to reach his goal. Since the fraudster must also specify his address (he gives a wrong, so he does not get the activation pin), he can not repeat this registration step as often as you like.

Step Two: Acquisition of a digital coin

following the purchase of a coin is described. It is assumed that a customer buys the coin.

Of the Customer must, so that he can pay, first the digital coins to buy at the bank. However, the customer wants to do this anonymously. Therefore there is the following possibilities:

In a first variant, the customer acquires a one-time coin acquisition point M _P in a shop in accordance with the paid monetary value. The disposable coin acquisition pin M _P is, for example, in the form of a scratch card, analogous to the solution that is also used for mobile phones with prepaid cards. The anonymity of the customer is maintained.

In a second variant, the customer buys one-time coin acquisition pins directly from the bank. For this, the customer's user software automatically selects k random numbers M '' _pi . Where k is the number of coins the customer wants to buy, and i is the value of the desired coin, eg 1 EUR, 2 EUR, etc. Then the customer software automatically encrypts these numbers M '' _Pi for a blind signature the bank key (these new encrypted values are referred to as M ''' _Pi ) and sends them to the bank computer. The customer also transfers the corresponding amount of money to the bank. When the bank has received the money, the bank software signs the data with the key S _{Bi of} the bank and sends the values M ' pi = S Bi (M ''' pi ) back to the customer's computer. The user software now opens the blind signature by decrypting the values M ' _Pi and thus obtains the signature for the values M'' _Pi . In other words, the customer now has k values M _Pi .

In both variants, the customer receives anonymous one-time coin acquisition pins. In the second case, ie the anonymous acquisition over the Internet, the one-time coin acquisition pin consists of two values (M _Pi and M '' _Pi ). Here M '' _{Pi is} a randomly chosen by the user software number and M _{Pi is} the signature of the bank for the values M '' _Pi . In the first case, the anonymity is ensured by the non-traceable cash purchase, in the second case by the blind signature of the bank.

After this step, which ensures anonymity, the customer can now buy his anonymous coin. To do this, he proceeds as follows:
The customer's customer software automatically randomly chooses k numbers M _IDj , 1 ≤ j ≤ k. It sends these numbers, the customer's anonymous key U _AS and the values M _Pi to the bank computer. The Banksoftwa re automatically checks the anonymous user key U _{AS as} to whether the bank-specific signature S _{BS is} contained. In addition, the bank software automatically checks if the values M _Pi or ({M " _Pi , M _Pi }) are valid one-time coin acquisition pins for these coins. In the case of the purchase of the one-time coin acquisition pins in a retail store, the bank software checks whether the one-time coin acquisition pins are contained in a database held accordingly by the bank. In the case where the one-time coin acquisition pins were purchased from the bank, the bank software checks if the calculated bank-own signature M _Pi is valid for the value M " _Pi .

After a successful check, the bank software signs with the key for the respective coin value: M sj = S Bi (M ID j || U AS ) for 1 ≤ j ≤ k and sends the coin signatures to the customer's computer. Thereafter, she saves the one-time coin acquisition pins as already used.

The customer now owns his anonymous digital coins. These contain the following:
M _ID : A random coin identification that must be long enough that it can not be dialed a second time, eg 128 bits. This is stored by the bank software when redeeming the coin in a corresponding database to immediately recognize that a coin has already been redeemed.
U _AS : The user's anonymous key. This must be included in the coin, so that the user is forced to use this key when buying. If the user signs the same coin twice, his identity is thereby communicated to the bank.
M _S : the signature of the bank. This later serves the seller to verify the coin.

One Customer who wants to cheat in this part of the protocol can just try by stealing in a store a valid one-time coin acquisition pin to obtain. However, theft on other items is far more lucrative is, it can be assumed that this would rather be the exception becomes.

Step Three: Buying from Online data

In In this part of the report, a seller, for example an internet trader, sells a Customers any data (e.g., music files, online newspaper articles, Access passwords ...). Since both parties are practically anonymous, a step must be taken in this step greater Value to be placed on high security. Both the seller as also the customer can at various points of the protocol try to cheat (e.g. the customer pays, receives but not the consideration etc. These possibilities will be explained in more detail. At first, however the method described

The seller, after having registered with the bank, like the customer, must make two types of preparatory actions. On the one hand, the vendor must encrypt all paid files to be downloaded using a randomly selected key A _K. This is preferably done by means of a special function of the user software of the seller. On the other hand, he must publish an exact article description A _ID on the Internet for the files offered by him. Again, the user software has a corresponding functionality. In addition to an exact brief description of the file, the item description A _ID also includes an identification feature in the manner of a digital fingerprint, which must be created by a cryptographically secure "hash function." The item description also stores the price of the file.

Of the previously created fingerprint is used to ensure that the seller in the Case of a file sale, transfer the file to the customer or which it has previously selected. The seller can so while a transaction the file requested by the customer no longer replace another.

Advantageously, the item description A _{ID is} stored together with the respective file on a common Internet page.

Once these preparatory actions have been taken, the customer can shop. For this purpose, he selects in an article (for example, by clicking on a designated Internet page). Preferably, fully automatic recognizes the user software of the customer that a payment transaction is desired and sends the seller calculator article description A _ID , the digital coin M of the customer and its anonymous (public) key U _A. If the customer does not have matching coins, the user software automatically selects a sum of matching coins and executes the steps given below in parallel for each coin to be transferred. Parallel means that all steps are executed simultaneously, eg if the user software is to transmit a confirmation value for a coin, it transmits the calculated confirmation value for all coins.

The seller's user software now automatically checks to see if coin M has been properly signed by all parties. Each coin has already been signed by the bank in each case. If the coin is from a Ver Buyer is again used for a purchase, so complemented the coin for each transaction in addition to another signature. These signatures, if any, are automatically checked by the user software, otherwise multiple sellers and buyers could work together to cheat another user of the payment system.

In addition, the seller's user software checks to see if the seller is tracking an item with the item description A _ID specified by the customer.

Finally, the seller's user software verifies that the client's anonymous key U _{A has been} valid and has not been revoked by the bank (this happens when a fraudulent action has been taken with it).

If these checks have been completed successfully, the seller's user software calculates a confirmation value C V1 = S Vn (A ID || M || U A ) and sends this confirmation value to the customer's computer. Here, V _N describes the seller's non-anonymous public key (generally referred to as U _N above). S _Vn describes that the value in parenthesis is signed with the private key part of the non-anonymous key of the seller.

In addition, the seller's user software transmits to the customer's computer the seller's anonymous key (called V _A in this protocol part) and a random number r, which will be discussed further below.

The user software of the customer checks whether the confirmation value C _{V1 was} calculated correctly. For this purpose, it checks both the signature S _VN and the content A _ID , M and U _A returned to the user software of the customer for conformity with the original values. In addition, the customer's user software checks to see if the anonymous vendor key V _{A has} not already been revoked by the bank.

Subsequently, the user software of the customer signs with the customer's anonymous key K _A (generally referred to as U _A above) and receives M KS = S ka (M || V A ) such as M ' ID = S r ka (M)

Here, M _{KS is} the signature of the coin, which binds the key of the seller to this. M ' _ID represents the coin signed by the customer's user software and allows the bank to identify the identity of the customer by paying twice (using the same coin). Since this is a special signature that is still described in the text, in this case, the notation (S _Ka (M)) specified at the beginning is deviated, and instead the notation (S ^r _Ka (M) used in the description of this special signature method is used )).

The customer's software also encrypts E _B (M _KS || M ' _ID ) and signs this value with the customer's anonymous key K _a . E _B denotes that the values in the bracket are encrypted with the public bank key B. Subsequently, this value pair by the user software of the customer as confirmation C 1 = {E B (M KS || M ' ID ), S ka (e B (M KS || M ' ID )) sent to the seller computer. It should be noted that K _a denotes the key of the buyer and S _Ka (x) means that the value x is signed with the private key part of the key K _a .

However, the seller can not yet use the contents of the acknowledgment C ₁ because C ₁ is encrypted with the bank key B. The seller's user software checks to see if the signature S _Ka (E _B (M _KS || M ' _ID )) is valid. It also calculates the confirmation C 2 = {E B (A K A || ID ), S Vn (e B (A K A || ID )) and in turn sends this confirmation to the customer's computer.

The user software of the customer checks in turn the dealer signature S _Vn of C ₂ . If this is valid, it will sign the acknowledgment and return this value S _Ka (C ₂ ) to the seller computer, together with M _KS , M ' _ID and S _Ka (M _KS || M' _ID )

The seller's user software checks these values and, in return, transmits the password A _K required for decrypting the purchased file to the customer's computer. With this the customer has purchased the article. He can now use the password to display the already downloaded file. For this purpose, the file is preferably decrypted automatically with the aid of the password provided by the customer's user software. The seller owns the digital coin, which now has the following form M New = {M, V A , M KS 'M' ID }.

there is the anonymous key of the seller to the coin bound.

These Coin can the seller with the help of his user software to the bank computer and swap it for real money, as described below. Of course it is, too conceivable that the Seller the coin used to pay an article in turn.

Some possible Attacks for this protocol section will be discussed below. It is also stated how the person affected and the bank has to behave in each case.

In the event that the seller terminates the transaction after receipt of the digital coin without handing over the password A _K to the customer's computer, the customer turns to the bank and transmits to the banker the values C ₁ , C ₂ , S _Vn (C ₁ ), S _Vn (A _ID || M || K _A ), M, V _N and A _ID and its own anonymous key K _A. For this purpose, the user software of the customer can have a corresponding special function. The bank software checks all values and decrypts, if all were calculated error-free, the customer the file password A _K from C ₂ and transmits it to the customer computer. Since the seller has already received his money, from which the customer can convince the bank with the transmitted values, the bank can also decrypt the file password for the customer.

In the event that the customer ends the transaction after the seller has sent him C ₂ , and the customer also claims that he has paid, but has not received any goods, the customer must the bank computer V _A , M, M _KS , M ' _ID , K _A and C ₁ and C ₂ submit. Again, the user software of the customer may have a corresponding special function. The bank software checks the coin M and M _KS and M ' _ID . If these are valid, they encrypt these values with the anonymous public key of the seller and deposit them with the seller for download on a dedicated website. In addition, the bank software decrypts the customer the file password A _K from C ₂ and transmits it to the customer's computer. Thus, despite everything, the seller receives his money and also the customer the goods, although he originally wanted to acquire them by fraud (without payment).

In another case, the user software of the customer, for example, due to a manipulation, C _{1 has} not calculated correctly. In other words, the user software did not encrypt the coin data correctly, but signed the wrong value despite everything with the customer's key (this must have been done or the seller's user software would have checked the signature S _Ka (E _B (M _KS || M ' _ID )) in the next step, the transaction ends). Nevertheless, the customer tries to contact the bank to get the file password A _K from this. In the two cases described above, the bank software checks all data transmitted by the customer and therefore determines this manipulation immediately. However, as the criminal user has already sent his anonymous key to the bank, it can revoke the relevant key. The bank software stores the user's anonymous key as revoked on their website. This list must be downloaded by each user of the protocol (customer or seller) at regular intervals. The cheater can therefore no longer carry out a transaction in the future without logging in again. It is particularly advantageous if the user software automatically establishes communication links to the bank computer for checking the list of revoked keys and updates the data stored in the customer or vendor computer. Of course, it is also possible that this query is always carried out by the user software transactional.

Finally, in another fraud case, the seller, for example with the help of a manipulated user software, has given the customer an incorrect file password. The customer turns to the bank and transmits the encrypted file as well as A _K , C ₂ , V _N , K _A and S _Vn (A _K | K _A ) to the bank computer by means of his user software. The bank software checks all submitted data for their validity. Subsequently, it decrypts the file password A _K from C ₂ and tests it on the file sent by the customer of the bank. If this test is successful, the bank software transmits the working password to the customer's computer. However, if the test is not successful, it is immediately apparent that the seller wanted to cheat the customer. For this reason, his non-anonymous key is revoked. Further notification of the seller by the bank is not necessary as the original software of the bank can not be deviated from the described protocol. For that reason, the seller must be a cheater.

This is a selection of different attempts to outsmart the payment mechanism presented here. It would go beyond the scope of this description to state other possibilities. However, it should be noted that even in cases of fraud, anonymity can be maintained as long as no party takes appropriate action. It should also be noted that all cases that could result from technical failure (eg breakdown of the internet connection during payment) (but can also be deliberately brought about by one party) for both the seller and the buyer per can be solved without a problem. In this case, the anonymity is preserved.

There transfer only small sums of money with this money transfer procedure the damage in the case of fraud is not very great. Lots fraudulent actions can Furthermore without harm to all parties simply solved become. Furthermore, fraud (e.g., double payment with a coin) only once (or very few times) possible, until the bank discovers this. For that reason, it is perfectly sufficient if the bank excludes the corresponding customer from this service. Legal cases, in If a customer claims that a Trojan stole his password, etc., they can avoid it become.

Step Four: Redeem the Coin at the bank

Of the Seller would like to after the sale, credit the received digital coin to his (real) account but still keep your anonymity at this step. This will last Part of the protocol accomplished as follows.

The Bank software first sends the user's computer a random number to. This value will be later explained in more detail in the description of the special signature method.

The user software of the seller (or the customer, if he wants to return his digital coin unused to the bank) selects for each coin to be redeemed a random number G _j and encrypts this for a blind signature with the bank key B _i , where i again here stands for the coin value. It sends these encrypted values G ' _j and the associated digital coins, as well as the numbers M' _ID = S ^r _Ka (M) (this is again the same special signature that was already used when selling a file) then to the bank computer.

The bank software checks whether the coins are valid and whether this is the first time that the coins are to be redeemed. For this check, the bank software stores the coin identification M _ID for each coin deposit in a dedicated database. However, if the bank software finds the coin identification M _ID , then this coin must have been redeemed once at the bank. If this check is successful, the bank software uses the respective key B _i to sign the numbers G ' _j and sends these signatures B _S (G' _j ) to the seller (or customer) computer.

The user software decrypts the numbers B _S (G ' _j ) (and thus obtains the signature B _S (G _j )), waits for a while and sends the bank computer G _j with the associated signature B _S (G _j ) and the account number the user. The wait time is important because otherwise the bank software could check who has cashed a coin in the last few seconds and could deduce which identity belongs to which anonymous key.

The bank software checks the signatures of G _j and causes the appropriate amount to be transferred to the specified account. For this purpose, the bank software is preferably connected directly to the corresponding, already known from the prior art software solutions for banks. In addition, the G _j values are stored by the bank software so that they can not be used a second time.

Of the User now has real money instead of digital coins his account. The bank may charge a processing fee at this step. Preferably, the processing fee is automatically calculated from the coin value of redeemed coins deducted (i.e., for example, a 1 euro coin is redeemed, so will the customer's account only e.g. 90 cents credited)

For this Logs are not aware of any attacks because all the values are on theirs Validity to be checked and these are not fake can be.

Blind signature

The Principle of the blind signature is known per se and u.a. described in "Applied cryptography, second edition ", Bruce Schneier, John Wiley & Son, Inc., 1996, as well as in Handbook of applied cryptography ", A. Menezes, P. van Oorschot, S. Vanstone, CRC Press, 1996.

With the help of these signatures, it is possible to digitally sign a document so that the signer does not see the document. This is an important part of the protocol of the invention to ensure anonymity. For key generation, the key holder (ie the person who will later sign with this key) first selects two random primes p and q and calculates n = p · q as well φ = (p-1) · (q-1).

Then the keyholder chooses a random number e =] 2, φ [, so that gcT (e, φ) = 1 and calculates d = e -1 Mod φ, where "gcd" denotes the largest common divisor, the public key consists of n and e, the private key from n and d. To sign the number m, the person who wishes to sign something first chooses a random number v ∈] 0; p [and calculates m '= m · v e Mod n.

This Step has been referred to in the present specification as follows: a value for a blind signature for the public key X (= {n, e} for encrypt this procedure). The one who requests the signature, so stores until he the blind signature gets the value back v as a key for the blind signature.

This number m 'is sent to the key holder, ie the one who is to sign, for signing. This signature owner calculates s '= m' d Mod n and send the signature back. Now the person who requested the signature can calculate s = s' · v -1 Mod n.

This Step was in the present description as decrypting or opening the blind signature.

This is now a valid signature for m. To check the signature, one checks, so anyone who wants to check the signature, whether s e Mod n = m.

Of the special anonymous user keys

If you pay twice with the same digital coin, the identity of the user should be disclosed. This is done as follows:
The user software first selects a random prime number p, so that p - 1 also contains a large prime factor q. Then the user software selects a random number r ε] 0; p [and calculates α = (rc (P-1) / q ) Mod p.

If α = 0, the user software repeats this step. Finally, the user software selects a random number g ε] 0; q [and a number h in the same interval containing the identity of the user and a random fraction, and calculates y 1 = α G Mod p as well y 2 = α H Mod p.

P, α and q are public parameters that all users can use. The private key consists of g and h, the public key of y ₁ and y ₂ . The user software also selects for each coin a random number s ε] 0; q [and calculates U = α s Mod p.

This value (U) is provided by the user software prior to each transaction or coin acquisition of the other party together with the user's anonymous key. The value s must be further stored by the user software, otherwise the coin signature M ' _ID = S ^r _Ka (M) can not be calculated.

The seller's user software now hands over to the customer's computer a random number r ε] 0; q [as described above] when transmitting the anonymous vendor key. Thus, the user software of the customer can now calculate the special signature M ' _ID = S ^r _Ka (M) as follows M ' ID = (M * g + r * h + s) Mod q.

The number r passed from the seller's user software is with others Words a part of the signature and is passed on with the coin. Would the If you do not use the component, you could also use the private key do not recalculate twice.

The signature can be checked as follows: α M'ID Mod p = y 1 M · y 2 r · U Mod p.

If this equation is fulfilled is, the signature is valid.

If the bank software then determines that a coin has been paid twice, it determines the anonymous key with which this signature was calculated twice and thus obtains the system of equations M ' ID1 = (M * g + r 1 · H + s) Mod q and M ' ID2 = (M * g + r 2 · H + s) Mod q.

Subsequently, the bank software calculates M ' ID1 - M ' ID2 = (r 1 - r 2 ) · H Mod q.

There all values except h, and thus the customer's identity, can be easily calculated become.

Claims (9)

Method for payment in a computer network, especially the Internet, where digital value units with security features be provided and the anonymity of a user is maintained until a check of the Security features a scam is detected, being in this Case both the identity the cheating one User as well as a proof of the fraud attempt can be determined automatically. Computer program for payment in a computer network, in particular user program, with program code means for oversight of digital value units with security features and with program code means to preserve the anonymity of a User until a security check a scam is detected. Computer program for payment in a computer network, in particular bank program, with program code means for automatic Determination of identity a cheating one User as well as a proof of the fraud attempt. Computer program product, with on a computer readable Medium stored program code means for providing digital Value units with security features and with on a computer readable Medium stored program code means to maintain the anonymity of a User when paying in a computer network until, when checking the Security features a scam is detected when the computer program product on a computer, especially on a customer or vendor computer, accomplished becomes. Computer program product, with on a computer readable Medium stored program code means for automatic detection the identity a cheating one User when paying in a computer network as well as a proof of the fraud attempt, if the computer program product on a computer, in particular on a bank computer, executed becomes. disk with program code means for providing digital value units with security features and with program code means to safeguard the anonymity of a user while paying in a computer network until, until at a review of the Security features a scam is detected. disk with program code means for automatically determining the identity of a cheating User when paying in a computer network as well as a proof for the Attempted fraud. Computer system, in particular bank computer trained for execution program code means for automatically determining the identity of a cheating user when paying in a computer network as well as a proof of the attempted fraud. Computer system, in particular customer or vendor computer, designed for execution program code means for providing digital value units with security features and program code means to safeguard the anonymity of a User when paying in a computer network until, when checking the Security features a scam is detected.