DE102018009943A1 - Process for creating a blind signature - Google Patents

Abstract

The invention relates to a method for generating a blind signature for an electronic coin data record, eMD, with the method steps: receiving an unsigned, blinded eMD from a subscriber at a signature issuer; Expanding the unsigned, blinded eMD with a publisher information by the signature publisher to obtain an expanded unsigned eMD; Signing the expanded unsigned eMD using a publisher-generated random number and a secret key of the signature publisher to obtain an expanded signed, blinded eMD; and sending the expanded signed blinded eMD and publisher information to the subscriber. The invention also relates to methods for checking the generated and / or received blind signature. Furthermore, the invention relates to a payment system for transmitting an electronic coin data record between at least two participants.

Description

TECHNICAL FIELD OF THE INVENTION

The invention relates to a method for generating a blind signature for an electronic coin data record, eMD . The invention also relates to a method for obtaining a blind signature in a subscriber. The invention also relates to a method for deriving a partial monetary amount from an already blindly signed one eMD by a participant. The invention also relates to several methods for checking the blind signature generated / obtained. Furthermore, the invention relates to a payment system for transmitting an electronic coin data record between at least two participants.

TECHNICAL BACKGROUND OF THE INVENTION

The "DigiCash" process is available for the anonymous exchange of electronic coin data records based on so-called blind signatures. A principle that is similar to the "DigiCash" process with blind signatures is in 1 shown.

Blind digital signatures can be generated, for example, using an elliptic curve digital signature algorithm, ECDSA, a variant of the digital signature algorithm, DSA, in which elliptic curve cryptography is used. For example, an ECDSA is in 2nd shown.

None of the known concepts enables the monetary amount (coin denomination) of the signed digital coin to be duplicated. This means that, for example, if a coin data record has a monetary amount of € 1, then for payment of a monetary amount of € 100, one is forced to send and have one hundred generated electronic coin data records verified. This makes verification difficult and increases the amount of data for transferring large amounts of money.

None of the known concepts enables the monetary amount (= coin denomination) of the signed digital coin to be divided. This means that if a coin data record has a monetary amount of € 1, then it is not possible to pay a fraction of this monetary amount, for example € 0.50 or a mixed fraction, for example € 1.50. Sometimes these concepts prevent appropriate payment.

These known concepts also do not provide for a change in payment, for example if a participant pays an amount to be paid with a larger coin value, the person paid cannot make any monetary amount in the form of change or change based on the amount received eMD generate and send. This makes the previous concepts unattractive and inflexible.

In addition, the known concepts are opaque for a test authority and only the authenticity of a signature can be checked without being sure whether a participant is the eMD manipulated. In fact, blind signatures are not accepted in many retail outlets due to this lack of transparency.

It is therefore an object of the present invention to provide a method and a system in which it can be transparently checked whether a signature issuer of a blind signature actually has one eMD signed. In addition, the monetary amount (coin value) of a signed eMD be easily divisible without a blind signature losing its invalidity. The aim is to create a direct exchange between participants and the corresponding end devices, which is uncomplicated and fast. A participant should also be able to receive appropriate change (change) in the form of one received eMD shared eMD return. The process should remain non-transparent for a third party in order to guarantee anonymous payment.

SUMMARY OF THE INVENTION

The object is achieved with the features of the independent claims. Further advantageous configurations are described in the respective dependent claims.

The object is achieved in particular by a method for generating a blind signature for an electronic coin data record, eMD , solved. The process comprises the following steps: Obtaining an unsigned blinded eMD from a subscriber to a signature publisher; Expanding the unsigned blinded eMD with publisher information by the signature publisher to obtain an expanded unsigned eMD ; Sign the extended unsigned eMD using a publisher-generated random number and a secret key of the signature publisher to obtain an expanded signed blinded eMD ; and sending the expanded signed blinded eMD and the publisher information to the subscriber, the publisher information sent being part of the blind signature.

In the (digital) blind signature process, it is possible to own one eMD to remain anonymous so that payment transactions made by a subscriber are not made by the signature publisher or an inspection body can be checked. The signature editor knows accordingly eMD not because he only blinded one eMD receives. An addition or subtraction of the eMD understood with an integer randomly generated subscriber number. A conclusion about the participant in possession of the blinded unsigned eMD is not possible.

According to the invention, the publisher adds the publisher information, also referred to as the publisher message, to the signature. By expanding according to the invention, this publisher information becomes an invariable part of the blind signature of the eMD . This publisher information is blinded - just like the signed one eMD - made available to the participant, for example in plain text. Any unmanipulable information from a publisher is regarded as publisher information. The publisher information is independent and therefore not dated eMD or depending on the participant. Independent information is therefore independent information that is not dependent on other entities.

In this way, when the signature is checked later, it can be determined whether the publisher information sent corresponds to the publisher information located in the signature or has been changed as part of a manipulation attempt. The blind signature generated with this method enables every participant in the payment system to authorship the signature over a blinded one eMD improved to check. In a check step, the publisher information thus serves to more thoroughly verify the part of the signature that was formed by the publisher information. The publisher information is not secret and can be transmitted as plain text information in the sending step, for example.

The publisher information is preferably independent of the signed blinded eMD is provided as independent information. This independent provision ensures that the publisher information and the eMD is completely separate information and was originally generated by different instances. While the eMD can be generated by the subscriber himself, the publisher information has been generated by the (trustworthy) signature publisher. In this way, anonymity is preserved in the payment system on the one hand, and on the other hand, this information from the publisher provides additional information eMD independent information co-signed. It is also conceivable that the publisher information is made available directly to a test body in an examination procedure.

Preferred is to expand the unsigned blinded eMD publisher information used is the result of a spread value function (hash function) with a publisher value, the publisher value being sent as the publisher information.

A scatter value function (also hash function) is a mapping that maps a large input quantity (for example the publisher value or secret key) to a smaller target quantity (the hash values, for example the publisher information). A hash function is therefore generally not injective. The input quantity can contain elements of different lengths, whereas the elements of the target quantity usually have a fixed length. In this way, the signature can be reduced in size without reducing the level of security.

The scatter value function is preferably a scatter value function that is fundamentally agreed in the signing method, for example when using an ECDSA, in which, in addition to the curve parameters, the scatter value function to be selected is also specified. By using a hash value as publisher information instead of the publisher value itself, security is further increased and manipulation is made more difficult. In addition, the amount of data to be sent consists of publisher information and signed blinded eMD minimized. This is advantageous for M2M applications, for example.

The publisher value can be at least one of the following values: a time value, for example a time stamp or a date; an identification of the publisher, for example an ID, serial number, contract number; and / or an identifier of the publisher in the signing process; and / or a publisher-generated value, for example a random number or some other date generated. The publisher value is preferably transmitted in plain text and placed as a hash value in the blind signature. If you are in possession of the publisher's information, you can check whether the blind signature is correct and thus verify the authenticity of the blind signature in an improved way by calculating the scatter value.

The generation of the blind signature is preferably based on a standard for digital signatures, for example the digital signature algorithm, or DSA for short. The DSA is based on the discrete logarithm in finite fields. As with all signature methods that are based on the discrete logarithm, especially for methods based on elliptic curves, security depends very much on the properties of the random number used by the signature issuer.

A random value must be generated by the signature publisher for each signature. This must have sufficient entropy, be kept secret and may only be used once in the system. These requirements are critical, because if the random number is known, the signature issuer's secret signature key can be calculated from the signature. If the random number has a low entropy, an attacker can calculate a secret key for every possible random number and then use the public verification key to test which one is the right one.

The is preferred eMD the result of a scatter value function from a subscriber-generated serial number and a subscriber-calculated point of an elliptic curve. A variant of a digital signature algorithm, or DSA for short, namely an elliptic curve cryptography, ECDSA, is thus used. The transmission of the DSA on elliptic curves is standardized in ANSI X9.62. This enables a high level of security with a minimal key length. The principle of the ECDSA is in 2nd explained.

The DSA is an exemplary standard for digital signatures. Other algorithms, for example an asymmetric cryptographic method, RSA, can also be used for digital signing. RSA uses a key pair consisting of a private key (the secret), which is used to decrypt or sign data, and a public key, which is used to encrypt or check signatures. The private key is kept secret and can only be calculated from the public key with a great deal of computing effort.

The is preferred eMD the result of a scatter value function from a subscriber-generated public key and a subscriber-calculated point of an elliptic curve, the subscriber-generated public key being derived from the subscriber-generated serial number. The parties involved agreed on the respective curve parameters in advance of the signing process. In this embodiment, the subscriber-generated serial number remains with the subscriber as a secret (ie a private key) and the signature issuer is provided with a public key derived from the serial number. For example, this public key is generated on the subscriber side in that the serial number is linked to a base point of the elliptic curve, for example a logical link or a simple mathematical operation, for example a multiplication. In this way, according to the invention, parts of a monetary amount can also be eMD transferred from one participant to another participant, which will be explained later. The signature is over the entire monetary amount of eMD created, a second participant authorizes this after transferring the eMD not yet automatically to own the entire amount, since the knowledge of the subscriber-generated serial number remains hidden if only partial amounts are to be transferred.

According to the invention is now also a method for checking a blind signature of a eMD provided, the blind signature was generated according to the previous method. To verify the signature, the unsigned, not veneered (uncovered) eMD and one for generating the eMD serial number used and a signed unblended (unblended) eMD and get the publisher information. This means that the full monetary amount of eMD be checked and, if the check is successful, change the owner based on knowledge of the (secret) serial number. In contrast to the previous verification of blindly signed eMD , now the eMD using the received serial number, the signed unveiled eMD , which calculates publisher information and a public key of the signature publisher. Since the publisher information is also an unchangeable part of the blind signature, the blind signature can now be checked for correctness of the publisher information by receiving the (plain text) publisher information. This compares the calculated eMD with the received eMD and verifying the authenticity of the blind signature if the calculated one eMD with the received eMD matches.

The one obtained is preferred eMD the result of a scatter value function from a combination of a subscriber-generated serial number with a base point and a subscriber-calculated point of an elliptic curve, whereby before the calculation of the eMD a subscriber-generated public key is derived from the subscriber-generated serial number. In this embodiment, the blind signature of the eMD created with the subscriber-generated public key instead of the subscriber-generated serial number. For example, this public key is generated on the subscriber side in that the serial number is linked to a base point of the elliptic curve, for example by a logical link or a simple mathematical operation, for example by multiplication. In this way, according to the invention, parts of a monetary amount can also be a eMD transferred from one participant to another participant, which will be explained later. The blind signature is nevertheless over the entire monetary amount of eMD created. To verify the authenticity of the eMD the subscriber-generated public key must then be provided.

With the previously described eMD is a monetary amount (= maximum amount of eMD ) coupled with the subscriber generated serial number, i.e. the blind signature of the publisher is valid for the total amount of the monetary amount. So far, this has prevented parts of the monetary total amount from being sent eMD , because the signature check for partial amounts is invalid. In addition, the serial number (the secret) of the eMD transferred and upon successful verification the secret is released and the monetary amount can be redeemed - similar to DigiCash. Now it is often desirable that eMD to share and only partial amounts of the signed eMD to hand over.

According to the invention there is now a method for checking a blind signature of a eMD provided, the blind signature was also generated by the previously described method. The will be preserved eMD ; one to generate the eMD subscriber generated public key used; a signed unblended eMD ; a partial monetary amount of eMD ; a (real) signature via a link between the monetary partial amount and another subscriber-generated public key; the participant-generated secret; and the publisher information.

The monetary component is a fraction of that with the eMD associated monetary total. This monetary partial amount can have any value, it can be out of round and / or it can be the change in a payment process. In the process, the subscriber-generated serial number (the secret) is now intentionally not transmitted for checking in order to redeem the total amount of the eMD to prevent. In contrast, a new (further) secret is generated on the subscriber side, which is different from the subscriber-generated serial number. This subscriber-generated secret is transmitted for checking instead of the subscriber-generated serial number. In addition, another public key is derived from this secret on the subscriber side. This derivation is, for example, a mathematical operation or a logical combination of the subscriber-generated secret with a base point (generator point) or an alternative agreed value.

In the checking process, the further public key is calculated from the received subscriber-generated secret after the receiving step. The agreed value, for example a base point, is used for this. In addition, the signature is calculated from the combination of the monetary partial amount and the calculated further public key. The (real) signature can thus be calculated and compared with the (real) signature obtained.

Here the partial amount is authentically signed, i.e. without additional blinding, otherwise a recipient of the partial amount cannot verify the authenticity and the correct derivation.

In the subsequent checking process, the calculated real signature is then compared with the received real signature and thus the ownership of the monetary partial amount is verified. In this way, the authenticity of the received real signature can be checked and it is ensured that the participant-generated secret was actually generated by the participant. The partial amount is therefore valid.

Finally the eMD calculated using the subscriber-generated public key, the signed uncovered eMD , the publisher information and a public key of the signature publisher. Finally, the calculated is compared eMD with the received eMD and verifying the authenticity of the blind signature if the calculated one eMD with the received eMD matches. During this calculation and verification, the subscriber-generated serial number of the eMD be closed so that the blind signature can be checked, but the full monetary amount of eMD cannot be decrypted. Only the partial amount confirmed with the real signature can be transferred and used by the recipient (participant, test authority).

The verification is preferably carried out by the signature publisher or by a test body different from the signature issuer. This can be seen as a major advantage of the procedure, because the participant is now not forced to eMD Have it checked by the signature publisher, which means that less conclusions can be drawn about a participant's payment behavior and anonymity is increased.

The publisher information is preferably also verified during the checking. It can thus be determined whether the publisher information is in the eMD was changed and a manipulation attempt was made.

The blind signature was preferably generated with an ECDSA, the curve parameters of the elliptical curve agreed in the ECDSA being provided for checking the blind signature.

In another aspect of the invention, a payment system for transmitting an electronic coin data record between at least two participants comprises a first participant for generating an unsigned blinded one eMD ; a signature issuer for generating a blind signature according to the previously described method and a second participant for obtaining the generated one eMD , a signed unvarnished eMD and one to generate the eMD serial number used.

In a preferred embodiment, the second participant checks the generated generated eMD , the signed unvarnished eMD and those for generating the eMD serial number used using the previously described verification procedure.

The is preferred eMD the result of a scatter value function from a link between a subscriber-generated public key and a subscriber-calculated point. The subscriber-generated public key is derived from the subscriber-generated serial number. In this way, it is not the subscriber-generated serial number that is sent, but a public key derived from it, which makes a eMD is made possible.

In one aspect of the invention, the object is achieved by a method for obtaining a blind signature for an electronic coin data set, eMD solved in one participant. This method comprises the steps of: generating a public key from a subscriber-generated serial number by the subscriber; Create one eMD using the generated public key by the subscriber; Blending the generated eMD to get a blinded unsigned eMD by the participant; Send the blinded unsigned eMD from the subscriber to a signature publisher; Obtained a signed blinded eMD from the signature publisher by the subscriber; and removing the bezel to obtain a signed unblended eMD by the participant.

The subscriber-side generation of the public key from a subscriber-generated serial number by the subscriber has already been explained several times. A value already agreed in the process between the participants, the signature issuer and / or the testing authority is used. For example, the value is a base point of the elliptic curve. This agreed value is logically linked to the subscriber-generated serial number, for example via a logical link, such as AND; OR; XOR; NAND; NOR, or a simple mathematical operation, such as multiplication or addition.

Preferably, the step of generating the eMD the steps: calculating a point of an elliptic curve using agreed curve parameters; Linking the calculated point with the generated public key; Calculate a scatter value function from the combination of the calculated point and the generated public key, the result of the scatter value function being the eMD is.

The derived public key is now used to obtain the blind signature instead of the subscriber-generated serial number. This subscriber-generated serial number is therefore secret for the signature issuer and remains secret.

This procedure allows the eMD not with its full monetary amount (maximum amount of eMD ) must be transferred between participants, but that any partial amounts can be derived and transferred from the full monetary amount.

In a preferred embodiment, the signed sign is veneered eMD a, with a publisher information expanded signed blinded eMD . In particular, it is blinded to expand the unsigned eMD publisher information used is the result of a spread value function with a publisher value, the publisher value being sent as the publisher information and being part of the blind signature. The publisher value is preferably a time value, an identification of the publisher and / or a publisher-generated value.

In a preferred embodiment, the expanded signed is blinded eMD receive the publisher information, preferably the publisher information regardless of the signed blinded eMD is provided as independent information.

This publisher information and the corresponding expansion of the signed blinded eMD have already been described in detail above. Reference is expressly made to this description. The publisher information thus serves to make blind signing more transparent by making non-manipulable, non-secret publisher information (which can be manipulated by the subscriber) part of the blind signature and can be checked.

In a preferred embodiment, there is a method for deriving a monetary partial amount a signed blinded eMD provided in a participant. Of the eMD is obtained according to the previously described method. This deriving method comprises the steps: generating a subscriber-generated secret and a further public key from the subscriber-generated secret by the subscriber; Determination of a monetary part of the eMD ; and calculating a signature via a link between the monetary partial amount and the further public key.

The partial amount can be determined arbitrarily. It can be the change in a payment transaction or it can be any value.

The subscriber-generated secret is different from the subscriber-generated serial number and is used instead of the serial number in order to transfer monetary amounts between subscribers. In this case, instead of the full monetary amount of the eMD only a partial amount can be transferred. With this derivation, one is already blindly signed eMD set up for the transfer of non-cash partial amounts.

The generation of the participant-generated secret can be done by a first participant if he wants to divide a partial amount from the total amount. This generation is preferably carried out by a further subscriber who has not generated the subscriber-generated serial number. Thus, a partial amount can also be divided by any other participant who is the eMD legitimately acquired. In this way, eMDs can be shared, although the blind signature of the eMD remains valid. In addition, payment transactions can now be made using eMD be made possible where the eMD Recipient (Paid) a compartmentalized eMD can return, for example, comparable to change or change in cash transactions or as part of a discount campaign.

The further public key is preferably a link between a base point of the elliptic curve and the subscriber-generated secret. This link is, for example, a logical link or a simple mathematical operation, as a result of which the computation effort is minimized without endangering the security and manipulation resistance of the method. As an alternative to the base point, another agreed value can be used.

In a preferred embodiment, the derivation further comprises generating a second subscriber-generated secret and a second further public key from the second subscriber-generated secret by the subscriber or another subscriber; Determination of a second partial monetary amount of the eMD , wherein the second monetary partial amount is smaller than the monetary partial amount and calculating a second signature via a combination of the monetary partial amount and the second further public key.

The second participant-generated secret can be generated by the first participant if he wishes to further divide a partial amount. This generation is preferably carried out by a subscriber who has not generated the (first) subscriber-generated secret. This means that the partial amount can also be shared by any other participant. In this way, eMDs can be shared several times, although the blind signature remains valid. In addition, payment transactions can now be made using eMD be made possible where the eMD Recipient (Paid) a shared eMD can return, for example, comparable to change or change in cash transactions or as part of a discount campaign. The second partial amount can be set as desired, i.e. it can be any value less than the (first) partial amount.

The second further public key is preferably a link between a base point of the elliptic curve and the second subscriber-generated secret. This link is, for example, a logical link or a simple mathematical operation, as a result of which the computation effort is minimized without endangering the security and manipulation resistance of the method. As an alternative to the base point, another agreed value can be used.
In a preferred embodiment, a method for checking a blind signature is a eMD provided, the blind signature was obtained according to the method described above. Verification involves the following steps: Obtaining the eMD , one to generate the eMD used serial number and a signed unvarnished eMD . Since the serial number and not the public key derived from it is received, the entire monetary amount of the eMD checked, decrypted and transmitted. The transfer of the serial number generally enables the disposal of the entire monetary amount. For checking purposes, the public key is calculated from the subscriber-generated serial number. In addition, the eMD using the calculated public key, the signed uncovered eMD and a public key of the signature publisher. It should be noted that the calculated public key is used for verification instead of the serial number, because in this aspect of the invention the serial number remains hidden from the signature issuer and the blind signature is created using the public key. The calculated public key must then be used to check the signature.

Finally the calculated one eMD with the received eMD compared and verified the authenticity of the blind signature when the calculated one eMD with the received eMD matches.

In a preferred embodiment there is a further method for checking a blind signature of a eMD provided, in which the blind signature was also generated / obtained according to a previously described method. The further procedure includes: obtaining the eMD , the subscriber-generated public key, a signed uncovered eMD , a partial monetary amount of eMD , a signature via a combination of the monetary partial amount and another subscriber-generated public key; and a subscriber-generated secret. The partial amount is preferably the above-mentioned (first) partial amount of the total monetary amount. Now the further public key is calculated from the subscriber-generated secret; calculating the signature via the link from the monetary partial amount and the calculated further subscriber-generated public key; comparing the calculated signature with the received signature and verifying the authenticity of the monetary partial amount; and the calculation of the already described above eMD using the received public key, the signed unveiled eMD and a public key of the signature publisher, so that - as already mentioned - the calculated one eMD with the received eMD can be compared and the authenticity of the blind signature is compared when the calculated eMD with the received eMD matches.

The further method thus enables the authenticity of the eMD based on the total amount of money, as it was signed by the signature issuer (blind). In addition, the partial amount can be verified and used for further payment processes. The subscriber-generated secret need not have been generated by the subscriber who generated the serial number, which means that a transmitted one eMD is further divisible without having to be re-signed.

In a preferred embodiment, yet another method for checking a blind signature of a eMD provided, in which the blind signature was also generated / obtained according to a previously described method. The still further process comprises the process steps: obtaining the eMD , the subscriber-generated public key, a signed unblended eMD , a partial monetary amount of eMD , a signature via a link between the monetary partial amount and another subscriber-generated public key, the further subscriber-generated public key; a second partial monetary amount of eMD ; a second signature via a combination of the second monetary partial amount and a second further subscriber-generated public key; and a second subscriber-generated secret. It should be noted that the (first) subscriber-generated secret and also the serial number are not received, since their disclosure would also enable the (first) monetary partial amount or the total monetary amount to be held. The second partial amount is preferably the above-mentioned second partial amount of the total monetary amount, which is smaller than the (first) partial amount.

The second further public key is calculated from the second subscriber-generated secret; calculating the second signature via the link from the monetary partial amount and the calculated second further subscriber-generated public key; comparing the calculated second signature with the received second signature and verifying the authenticity of the second monetary partial amount.

In addition, the aforementioned calculation of the signature takes place via the link from the monetary partial amount and the calculated further subscriber-generated public key; comparing the calculated signature with the received signature and verifying the authenticity of the monetary partial amount; computing the eMD using the received public key, the signed uncovered eMD and a signature publisher public key; comparing the calculated eMD with the received eMD and verifying the authenticity of the blind signature if the calculated one eMD with the received eMD matches.

The (first) monetary partial amount and the (first) signature are created by a subscriber using a combination of the monetary partial amount and another subscriber-generated public key in accordance with the derivation method described above. The participant does not have to be the participant who generated the serial number. This enables sharing of eMD with the blind signature fully valid.

The second monetary partial amount and the second signature are preferably generated by a subscriber by linking the second monetary partial amount and a second further subscriber-generated public key in accordance with the derivation method described above.

The publisher information is also preferably obtained in the receive step and this is used in the calculate step to calculate the eMD can also be used.

The verification is preferably carried out by the signature issuer or a testing entity other than the signature issuer, for example also another participant.

The publisher information is preferably also verified during the checking.

The blind signature is preferably generated with an elliptical curve signing algorithm, ECDSA, and agreed curve parameters of the elliptical curve are provided for checking the blind signature.

In a further aspect of the invention is a payment system for transmitting an electronic coin data record, eMD provided between at least two participants. The payment system includes a first participant to receive a blind signature for one eMD according to the described receiving method; a signature publisher to generate the blind signature and a second participant to receive the generated one eMD , a signed unvarnished eMD and one to generate the eMD serial number used.

The payment system also includes that the second participant generates the received one eMD , the signed unvarnished eMD and those for generating the eMD used serial number checked. It is provided that the second participant generates the secret and derives the partial amount and the one belonging to the partial amount. This partial amount is used in a payment process, the blind signature over the eMD remains valid.

A eMD is, in particular, an electronic data record that represents a monetary amount and is colloquially referred to as “digital coin” or “electronic coin”. The right to this monetary amount changes in the process from a first account to another account. In the following, a monetary amount is understood to be a digital amount that can be credited to an account of a financial institution. Of the eMD therefore represents cash in electronic form.

The eMD differ significantly from electronic data records for data exchange or data transfer, since, for example, a classic data transaction takes place on the basis of a question-answer principle or on intercommunication between the data transfer partners. In contrast, EMD are characterized by uniqueness, uniqueness and security features (signatures, encryption). In one eMD In principle, all data is contained that is required for a receiving instance with regard to verification, authentication and forwarding to other instances. Intercommunication is therefore generally not necessary with this type of data record. Exceptions are the change payment transactions.

A security element can be provided in a subscriber's terminal for transmission. A security element is preferably special software, in particular in the form of a secure runtime environment within an operating system of a terminal device, English Trusted Execution Environments, TEE. Alternatively, the security element is designed, for example, as special hardware, in particular in the form of a secured hardware platform module, English Trusted Platform Module, TPM or as an embedded security module, eUICC, eSIM. The security element provides a trustworthy environment and also secures, for example, a machine-2-machine, M2M application.

The communication between two end devices or security element can take place without contact or with contact and can be designed as a secure channel. Thus the exchange of the eMD by cryptographic keys, for example a session key negotiated for an exchange of coin records or a symmetrical or asymmetrical pair of keys.

Any terminal processing a program code with user input / output is excluded as a terminal, for example a PC, a smartphone, a tablet. In addition, the terminal can also be part of an M2M environment, for example a machine, tool, machine or container and vehicle understood. A terminal device according to the invention is thus either stationary or mobile. M2M stands for the (fully) automated exchange of information between these devices, for example using the Internet and the corresponding access networks, such as the mobile network.

Figure list

The invention and further embodiments and advantages of the invention are explained in more detail below with reference to figures, the figures merely describing exemplary embodiments of the invention. Identical components in the figures are provided with the same reference symbols. The figures are not to be regarded as true to scale, individual elements of the figures can be shown in an exaggeratedly large or exaggeratedly simplified manner.

• 1 Prinzip des Digi-Cash Verfahrens mit blinden Signaturen;
• 2 ein bekanntes Beispiel zum Erstellen und Prüfen einer Signatur mittels ECDSA;
• 3 ein Ausführungsbeispiel eines Verfahrensablaufdiagramms eines erfindungsgemäßen Signatur-Erzeugen Verfahrens;
• 4 ein Ausführungsbeispiel eines Verfahrensablaufs zum Erzeugen und Überprüfen einer blinden Signatur für einen eMD gemäß der Erfindung;
• 5 ein Ausführungsbeispiel eines Verfahrensablaufdiagramms eines erfindungsgemäßen Verfahrens;
• 6 ein Ausführungsbeispiel eines Verfahrensablaufs zum Erzeugen und Überprüfen einer blinden Signatur für einen eMD mit ganzem geldwerten Betrag und davon abgeteilten geldwerten Teilbeträgen gemäß der Erfindung; und
• 7 ein Ausführungsbeispiel eines Verfahrensablaufs zum Erzeugen und Überprüfen einer blinden Signatur für einen eMD mit ganzem geldwerten Betrag und davon abgeteilten geldwerten Teilbeträgen gemäß der Erfindung.

Show it:

• 1 Principle of the Digi-Cash process with blind signatures;
• 2nd a well-known example of creating and verifying a signature using ECDSA;
• 3rd an embodiment of a process flow diagram of a signature generating method according to the invention;
• 4th an embodiment of a process flow for generating and checking a blind signature for a eMD according to the invention;
• 5 an embodiment of a process flow diagram of a method according to the invention;
• 6 an embodiment of a process flow for generating and checking a blind signature for a eMD with the whole monetary amount and the monetary partial amounts divided therefrom according to the invention; and
• 7 an embodiment of a process flow for generating and checking a blind signature for a eMD with a whole monetary amount and monetary partial amounts divided therefrom according to the invention.

FIGURE DESCRIPTION

1 shows the principle of the "DigiCash" process with blind signatures. Here, a first participant (buyer) transmits T1 , a second participant (seller) T2 one from the signature editor H signed coin. To do this, the first participant swaps T1 a monetary amount through a digital coin, the unique identifier, for example a serial number, he himself in the step 1 generated. The unique identifier is in the step 2nd encrypted and in step 3rd the signature editor H transferred along with the value of the digital coin. The signature editor H confirms the validity of the digital coin by signing the encrypted unique identifier in step 4th and sends the signed digital coin in step 5 back to the first participant T1 . In step 6 decrypts the first participant T1 the signature and transfers (paid) in step 7 the digital coin consisting of the unique identifier and the decrypted signature to the second participant T2 . The second participant T2 requests the signature editor H in step 8th to redeem the digital coin. The signature editor H verifies the authenticity of the digital coin based on the signature in the crotch 9 and thus enables the monetary amount of the digital coin to be redeemed in step 10th .

In 2nd becomes a process flow 100 consisting of a process S to create a signature between a first participant T1 or its first terminal M1 and an editor H and a process P to check the signature created between a first participant T1 and an inspection body PI shown.

In the signing process S agree in step 101 all involved instances T1 , H and P about the curve parameters, f , p , a , b , G , n , H an elliptic curve. These curve parameters describe a curve used, where f is the order of the body on which the curve is defined; p is the indication of the basis used; a , b two body elements that describe the equation of the curve; G is the generator point (generator point, base point) of the curve; n, the order of the point G is; and h is the cofactor. In addition, an agreement is reached on a cryptographic scatter value function to be used H() , also referred to as a hash function, for example a SHA-2 algorithm.

In step 102 the publisher generates H a cryptographic key pair d , D based on the base point G and shares the public part D the first participant T1 and the reviewing body PI in step 103 , 103 ' With. The public key part D is also used as a verification key D designated. The private key part d is not given out as a secret.

In step 104 creates the first participant T1 a serial number m and links this with a monetary amount to the electronic coin record, eMD . The first participant also creates T1 two integer random numbers γ , δ . In step 105 the publisher creates H a random number r , and calculates a point R the curve leading to the first participant T1 is transmitted.

In step 106 the first participant calculates T1 a point of the curve with equation (1): $$A=R+\gamma \cdot G+\delta \cdot D$$

The point A is through an x coordinate A _x and a y coordinate A _y represents. The x coordinate A _x comes with the serial number m as input parameters of the hash function H() in equation (2) used an unsigned unshielded eMD c to obtain: $$c=H\left(m\Vert A_x\right)$$

The unsigned face-to-face eMD c is faded into an unsigned one with equation (3) eMD c 'implemented: $$c\text{'}=c-\delta$$

In step 107 this unsigned is blinded eMD c 'to the editor H sent and there in step 108 Equation (4) blinds the signed eMD s' received and in step 109 to the first participant T1 transfer: $$s\text{'}=r-c\text{'}\cdot d$$

In steps 110 the signed, blinded eMD s' by means of equation (5) into an unblended signed eMD s implemented: $$s=s\text{'}+\gamma$$

As a result of the signing process S is a eMD c received its subscriber-generated serial number m the signature ( s , c ), see equation (6): $$siG\left(m\right)=\left(s,c\right)$$

$$c==H\left(m\Vert A_x\right)$$

In the test procedure PR Anyone who is familiar with the above curve parameters and the verification key can now D (publisher's public key H ) is the blind signature of the eMD c check what, for example, by means of an inspection body PI or any participant T1 , T2 , T3 , all not the editor H must be done. This is done in step 111 the unsigned blunt eMD c , the signed unvarnished eMD s and the subscriber generated serial number m from the participant T1 and the reviewing body PI transfer. There is in the crotch 112 verified the blind signature using the following equations (7) to (10): $$\begin{array}{l}\left(c\cdot D\right)+\left(s\cdot G\right)\hfill \\ =\left(c\cdot d\cdot G\right)+\left(r\cdot G\right)-\left(c\cdot d\cdot G\right)+\left(\delta \cdot d\cdot G\right)+\left(\gamma \cdot G\right)\hfill \\ =R+\delta \cdot D+\gamma \cdot G)=A\hfill \end{array}$$

$$c==H\left(m\Vert A_x\right)$$

If the one calculated in equation (10) eMD c the one in step 111 sent (received) eMD c corresponds, the blind signature is considered confirmed and the eMD as real.

3rd shows an embodiment of a process flow diagram of a signature generating method according to the invention 100 . In 4th is an embodiment of a process flow for generating and checking a blind signature for a eMD shown according to the invention. The procedure in 3rd is used in conjunction with 4th explained.

The procedure 100 to create a blind signature according to 3rd and 4th is about to create a blind signature with a corresponding review by an inspection body PI according to the 2nd based on and reflects a procedure in an ECDSA procedure. It should be noted that testing with the steps 111 and 112 also from another participant T2 , T3 can be made, for example, to verify the monetary amount or partial amount. It should also be noted that testing PR with the steps 111 and 112 also between two participants T2 , T3 can take place that is not the serial number m of eMD c have generated. These participants then want to verify and transmit, for example, a total monetary amount or a partial amount derived therefrom or a second partial amount derived therefrom.

The use of the ECDSA is only exemplary and any method for generating a blind signature, for example DAS or RSA based, can be operated with the basic idea according to the invention, namely the addition of publisher information, possibly in connection with the derivation of monetary partial amounts. This is indicated by the dashed lines of the steps 101 to 105 in the 4th indicated, which are therefore to be regarded as optional steps. On repeating the explanation of these steps 101 to 105 of the 2nd is therefore dispensed with, even though you are part of the method according to the invention when using an ECDSA method.

The procedural steps 101 to 107 of the 3rd and 4th same as the procedural steps 101 to 107 of the 2nd and for further explanations is on this 2nd referred.

In step 107 the unsigned one described with equation (3) is blinded eMD c 'to the editor H sent.

There is in the crotch 113 a publisher value w generated. The publisher value w is, for example, a timestamp or a random value. This publisher value w is by means of a scatter value function H() converted into a publisher information u. This scatter value function H() is preferably the scatter value function that in step 101 was agreed. This simplifies the process regarding the compatibility and agreement of the cryptographic functions to be used.

With this publisher information u, the unsigned is blended in equation (11) eMD c 'according to step 113 extended: $$c\text{'}+u$$

In step 108 is the extended signed blinded using equation (12) eMD s "received: $$s\text{'}\text{'}=r-\left(c\text{'}+u\right)\cdot d$$

In step 109 the expanded signed is blinded eMD s "along with the editor value w to the first participant T1 transfer.

In steps 110 the signed is blinded eMD s "unblended using equation (13): $$s=s\text{'}\text{'}+\gamma$$

As a result of the signing process S has a eMD c with the subscriber generated serial number m the signature ( s , c , w ), see equation (14): $$siG\left(m\right)=\left(s,c,w\right)$$

According to the invention, the participant generates T1 the eMD c and blinds this in c 'with the random number γ so that the eMD c not with the publisher H becomes known.

The eMD c is next to the unique serial number m also assigned a monetary maximum amount.

The Publisher H signed the blinded unsigned eMD c 'without him eMD c or the serial number m knows. This is called blind signing. The Publisher H adds a publisher-generated value according to the invention w in the form of publisher information u. This publisher information u becomes an unchangeable part of the signed blinded eMD s "and according to equation (13) as editor value w also part of the signed unvarnished eMD s.

In the test procedure PR Anyone who is familiar with the curve parameters and the verification key D is the signature ( s , c , w ) of eMD c with the serial number m and the publisher value w check what, for example, by means of an inspection body PI , T2 , T3 who is not necessarily the editor H is done. When checking in the process PR of the 4th a check is then carried out to determine whether m has been changed and whether w has been changed, which is described below.

$$A=s\cdot G+\left(c+u\right)\cdot D$$

$$c==H\left(m\Vert A_x\right)$$

This is done in step 111 the unsigned blunt eMD c , the signed unvarnished eMD s, the subscriber generated serial number m and the editor value w from the participant T1 and the reviewing body PI , T2 , T3 transfer. There is in the crotch 112 verified the signature using the following equations (15) to (17): $$u=H\left(w\right)$$

$$A=s\cdot G+\left(c+u\right)\cdot D$$

$$c==H\left(m\Vert A_x\right)$$

It is determined with equation (17) that the step 111 preserved unsigned unblended eMD c the calculated eMD corresponds, the blind signature is considered genuine.

5 shows an embodiment of a process flow diagram of a signature obtaining method according to the invention. In 6 is an embodiment of a process flow for obtaining S a blind signature and also for checking PR a blind signature for one eMD shown according to the invention. The review process PR shows three different scenarios PR1 , PR2 , PR3 on. The procedure in 5 is used in conjunction with 6 explained.

The procedure for obtaining a blind signature according to 5 and 6 is about to create a blind signature with a corresponding review by an inspection body PI , T2 , T3 according to the 2nd based on and reflects a procedure in an ECDSA procedure. It should be noted that testing PR1 , PR2 , PR3 with the steps 111 , 111 ' , 111 " and 112 , 112 ' , 112 " also from another participant T2 , T3 can be made, for example, to verify the monetary amount or partial amount. It should also be noted that testing PR1 , PR2 , PR3 with the steps 111 , 111 ' , 111 " and 112 , 112 ' , 112 " also between two participants T2 , T3 can take place that is not the serial number m of eMD c have generated, for example, by a total monetary amount or a partial amount derived from it υ or a second partial amount derived from it ε to verify and get transmitted. Below is the reviewer PI another participant T2 , T3 equated.

The use of the ECDSA is only exemplary and any method for generating / receiving a blind signature, for example DAS or RSA-based, can be carried out with the basic idea according to the invention, namely the derivation of partial monetary amounts, if necessary using publisher information from the signature publisher H respectively. On repeating the steps 101 to 105 of the 2nd is therefore dispensed with, even though you are part of the method according to the invention when using an ECDSA method.

The procedural steps 101 to 105 of the 5 and 6 same as the procedural steps 101 to 105 of the 2nd and for further explanations is on this 2nd referred.

In step 114 a public key is generated as described in equation (18) M in the participant T1 : $$M=m\cdot G$$

Here is the subscriber generated serial number m to be regarded as a secret and the public key G is calculated using the (agreed) basis point G derived from the elliptic curve. Alternatively, other agreed values for generating the public key can be used M be used.

In step 106 the first participant calculates T1 a point of the curve with equation (1) the point A is through an x coordinate A _x and a y coordinate A _y represents. The x coordinate A _x comes with the public key M as input parameters of the hash function H() in equation (19) used an unsigned unblended eMD c to obtain: $$c=H\left(m\Vert A_x\right)$$

The unsigned face-to-face eMD c is faded into an unsigned one with equation (20) eMD c '(M) implemented: $$c\text{'}\left(M\right)=c-\delta$$

In step 107 the unsigned one described with equation (20) is blinded eMD c '(M) to the editor H sent. In step 108 the signed is blinded using equation (21) eMD s' received and in step 109 to the first participant T1 transfer: $$s\text{'}=r-c\text{'}\left(M\right)\cdot d$$

In steps 110 the signed, blinded eMD s' obtained using equation (5). As a result of the signing process S is a eMD c get whose public key M the signature ( s , c ), see equation (22): $$siG\left(M\right)=\left(s,c\right)$$

According to 5 and 6 the participant generates T1 the eMD c using a public key M instead of the serial number m . This serial number m is the signature editor H secret. This enables the monetary amount of the eMD c to divide and installments u or second installments ε between participants T1 , T2 , T3 to be transmitted without the blind signature becoming invalid. This simplifies the administrative work for the signature publisher H and enables a payment system with eMD c in which change can also be paid or in which non-circular amounts can be transferred or whose monetary value can be sent to different instances. In 6 three scenarios are now shown, one with the one in 6 obtained signature process S divisible eMD is transferable, but the blind signature remains valid.

• Im Prüfverfahren PR1 der 6 ist zunächst dargestellt, dass der gesamte geldwerte Betrag eines eMD geprüft und ggf. bei einem zweiten Teilnehmer T2, T3 eingelöst werden soll.

With the test procedures PR1 , PR2 , PR3 non-circular amounts can now be transferred very precisely or corresponding change (change) can be generated. For example, the maximum monetary amount could be one eMD c in the test procedure PR1 from a first participant T1 to a second participant T2 be sent. In the test procedure PR2 is then from the second participant T2 a partial amount u as change to the first participant T1 retransfer. The first participant T1 can now further split the partial amount u and the second partial amount ε to the third participant T3 in the test procedure PR3 transfer:

• In the test procedure PR1 of the 6 It is initially shown that the total monetary amount is one eMD checked and possibly with a second participant T2 , T3 to be redeemed.

In the test procedure PR1 of the 6 can every instance ( PI , T2 , T3 ), knowing the curve parameters mentioned above and the verification key D (publisher's public key H ) is the blind signature of the eMD c check what, for example, by means of the test authority PI who is not necessarily the editor H is done.

This is done in step 111 the unsigned blunt eMD c , the signed unvarnished eMD s and the subscriber generated serial number m from the participant T1 to the inspection body PI transfer. There is in the crotch 112 the blind signature verified. With equation (23) the subscriber generated public key is first M calculated. $$M=m\cdot G$$

According to equations (7) to (9), the eMD c is calculated and with equations (24) it is then checked whether it is calculated eMD of the received eMD c corresponds to: $$c,s==b.siG\left(M\right);c==H\left(M\Vert A_x\right)$$

Is the calculated eMD c with the received eMD c match, the blind signature is valid and the eMD c can be from the test body PI , or the other participants T2 , T3 , can be used for further payment processes.

If the one obtained in equation (24) eMD c the one in step 111 sent eMD c corresponds, the blind signature is considered confirmed and the eMD as real.

In the test procedure PR2 of the 6 is now with step 115 the derivation of a partial amount u from the monetary total amount is shown. To do this, the participant generates T1 (or another participant who owns the eMD c It's a secret p and another public key P using the subscriber generated secret p . The secret p is from the serial number m different. The further subscriber generated key P is from the subscriber generated public key M different. For example, the subscriber generated public key P by multiplying by the base point G can be obtained, see equation (25): $$P=p\cdot G$$

For deriving 115 becomes a real signature with equation (26) σ _m created: $${\sigma }_m=si{G}_m\left(P\Vert \upsilon \right)$$

• • der eMD c
• • der teilnehmergenerierte öffentliche Schlüssel M
• • der signierte unverblendete eMD s
• • die echte Signatur σ_m
• • der Teilbetrag υ
• • das teilnehmergenerierte Geheimnis p

It is υ the partial amount to be derived, which is smaller than the total monetary amount of eMD c . The real signature σ _m here is a logical OR link from the public key P and the partial amount υ . Other logical links or mathematical operations are for creating the real signature σ _m also conceivable. In step 111 ' are the following variables between two participants T1 , T2 , T3 exchanged:

• • of the eMD c
• The subscriber-generated public key M
• • the signed unblended eMD s
• • the real signature σ _m
• • the partial amount υ
• • the participant-generated secret p

gilt der Teilbetrag υ als verifiziert und ist durch das Übertragen des Geheimnisses p auch übertragen. Es gilt zu beachten, dass die Prüfinstanz PI, T2, T3 nicht im Besitz der teilnehmergenerierten Seriennummer m ist und somit zwar die blinde Signatur verifizieren kann (durch den Schlüssel M) aber nicht in den Besitz des geldwerten Gesamtbetrags gelangt.In step 112 ' can now check the authenticity of the blind signature and the authenticity of the real signature σ _m be checked, whereby the partial amount u as - between the participants T1 , T2 , T3 -transfer applies. To do this, first use the participant-generated secret p and the agreed base point G the other public key P calculated, see equation (25). In addition, the blind signature is checked according to equations (7) to (9) and (24). In addition, the real signature σ _m from the calculated further subscriber-generated public key P and the partial amount received υ calculated and if equation (27) matches $${\sigma }_m==si{G}_m\left(P\Vert \upsilon \right)$$

the partial amount applies υ as verified and is by transmitting the secret p also transferred. It should be noted that the inspection body PI , T2 , T3 does not have the subscriber generated serial number m and can thus verify the blind signature (using the key M ) but did not get the total monetary amount.

In the test procedure PR3 of the 6 is now with step 116 deriving a second partial amount ε of the partial amount υ shown. To do this, the participant generates T1 (or another participant who owns the eMD c is) a second secret q and a second further public key Q using the subscriber generated secret q . The second secret q is from the serial number m and the secret p different. The second further subscriber generated key Q is from the subscriber generated public key M and the further subscriber generated key P different. For example, the second additional subscriber-generated public key Q by multiplying by the base point G can be obtained, see equation (28): $$Q=q\cdot G$$

For deriving 116 equation (28) also becomes a second real signature σ _p created: $${\sigma }_p=si{G}_p\left(Q\Vert \epsilon \right)$$

• • der eMD c
• • der teilnehmergenerierte öffentliche Schlüssel M
• • der signierte unverblendete eMD s
• • die echte Signatur σ_m
• • der Teilbetrag υ
• • der weitere teilnehmergenerierte öffentliche Schlüssel P
• • die zweite echte Signatur σ_p
• • der zweite Teilbetrag ε
• • das zweite teilnehmergenerierte Geheimnis q

It is ε the second partial amount to be derived, which is less than the total monetary amount and also less than the partial amount u der eMD c . The real signature σ _p here is a logical OR link from the public key Q and the partial amount ε . Other logical links or mathematical operations are for creating the real signature σ _p also conceivable. In step 111 " are the following variables between two participants T1 , T2 , T3 exchanged:

• • of the eMD c
• • the subscriber generated public key M
• • the signed unblended eMD s
• • the real signature σ _m
• • the partial amount υ
• • the further subscriber-generated public key P
• • the second real signature σ _p
• • the second partial amount ε
• • the second subscriber generated secret q

gilt der Teilbetrag ε als verifiziert und ist durch das Übertragen des zweiten Geheimnis q auch übertragen. Es gilt zu beachten, dass die Prüfinstanz PI, T2, T3 nicht im Besitz der teilnehmergenerierten Seriennummer m oder des teilnehmergenerierten Geheimnisses p ist. Somit kann zwar die blinde Signatur und die echte Signatur σ_m verifiziert werden (durch die teilnehmergenerierten öffentlichen Schlüssel M und P), aber die Prüfinstanz PI, T2, T3 gelangt nicht in den Besitz des geldwerten Gesamtbetrags oder des (ersten) Teilbetrags υ.In step 112 " can now the authenticity of the blind signature, the authenticity of the real signature σ _m and also the authenticity of the second real signature σ _p be checked, reducing the second installment ε as - between the participants T1 , T2 , T3 - applies. To do this, first use the second subscriber-generated secret q and the agreed base point G the second further subscriber-generated public key Q calculated, see equation (28). In addition, the blind signature is checked according to equations (7) to (9) and (24). It also becomes the second real signature σ _p from the calculated second further subscriber-generated public key Q and the second partial amount received ε calculated and if equation (30) matches $${\sigma }_p==si{G}_p\left(Q\Vert \mathrm{\epsilon }\right)$$

the partial amount applies ε as verified and is by transmitting the second secret q also transferred. It should be noted that the inspection body PI , T2 , T3 does not have the subscriber generated serial number m or the subscriber-generated secret p is. Thus, the blind signature and the real signature can σ _m be verified (by the subscriber generated public key M and P ), but the reviewing body PI , T2 , T3 does not come into possession of the total monetary amount or the (first) partial amount υ .

With the test procedures PR1 , PR2 and PR3 it was demonstrated that any monetary (partial) amounts between any participants υ , ε can be transferred, with the authenticity of the blind signature and that with the respective partial amounts at all times υ , ε associated real signatures σ _m and σ _p can be checked. The receiving instance receives the appropriate choice of the variables to be transmitted PI , T2 , T3 then the full access rights to the respective partial amounts, whereby the eMD is considered transferred.

In 7 is another embodiment of a process flow for generating and checking a blind signature for a eMD represented with the whole monetary amount and the monetary partial amounts divided therefrom according to the invention. The procedures of the 4th and 6 combined with each other. In addition to the use of publisher information u, w according to the invention, this now also enables the monetary amounts according to the invention to be shared.

In 7 is an embodiment of a process flow for obtaining S a blind signature and also for checking PR a blind signature for one eMD shown according to the invention. The review process PR shows three different scenarios PR1 , PR2 , PR3 on.

The procedure for obtaining a blind signature according to 7 is about to create a blind signature with a corresponding review by an inspection body PI according to the 2nd based on and reflects a procedure in an ECDSA procedure. It should be noted that testing PR1 , PR2 , PR3 with the steps 111 , 111 ' , 111 " and 112 , 112 ' , 112 " also from another participant T2 , T3 can be made, for example, to verify the monetary amount or partial amount. It should also be noted that testing PR1 , PR2 , PR3 with the steps 111 , 111 ' , 111 " and 112 , 112 ' , 112 " also between two participants T2 , T3 can take place that is not the serial number m of eMD c have generated, for example by a total monetary amount or a partial amount u derived therefrom or a second partial amount derived therefrom ε to verify and get transmitted. Below is the reviewer PI another participant T2 , T3 equated.

The use of the ECDSA is only exemplary and any method for generating / receiving a blind signature, for example DAS or RSA-based, can be carried out with the basic idea according to the invention, namely the derivation of monetary partial amounts using publisher information u, w of the signature publisher H respectively. On repeating the steps 101 to 105 of the 2nd is dispensed with, even though you are part of the method according to the invention when using an ECDSA method.

The procedural steps 101 to 105 of the 7 same as the procedural steps 101 to 105 of the 2nd and for further explanations is on this 2nd referred.

In step 114 becomes the generation of a public key described by equation (18) M in the participant T1 described.

In step 106 the first participant calculates T1 a point of the curve with equation (1) the point A is through an x coordinate A _x and represents a y coordinate A _y . The x coordinate A _x is with the public key M as input parameters of the hash function H() in equation (19) used to be an unsigned unvarnished eMD c to obtain. The unsigned face-to-face eMD c is faded into an unsigned one with equation (20) eMD c '(M) implemented.

In step 107 the unsigned one obtained with equation (20) is veneered eMD c '(M) to the editor H sent. There is in the crotch 113 a publisher value w generated. The publisher value w is, for example, a timestamp or a random value. This publisher value w is by means of a scatter value function H() converted into a publisher information u. This scatter value function H() is preferably the scatter value function that in step 101 was agreed. This simplifies the process regarding the compatibility and agreement of the cryptographic functions to be used. The unsigned blinded eMD c 'is then according to equation (11) with this publisher information u in step 113 expanded.

In step 108 is the extended signed blinded using equation (31) eMD s "received: $$s\text{'}\text{'}=r-\left(c\text{'}\left(M\right)+u\right)\cdot d$$

In step 109 the expanded signed is blinded eMD s "along with the editor value w to the first participant T1 transfer. In steps 110 the signed is blinded eMD s "unblended using equation (13).

As a result of the signing process S is a eMD c get whose public key M the signature ( s , c , w ), see equation (32): $$siG\left(M\right)=\left(s,c,w\right)$$

According to 7 the participant generates T1 the eMD c using a public key M instead of the serial number m . This serial number m is the signature editor H secret. The signature publisher also generates H the publisher information u, w and adds this as an integral part of the blind signature.

This enables the monetary amount of the eMD c to share and partial amounts υ or second installments ε between participants T1 , T2 , T3 to be transmitted without the blind signature becoming invalid. It is every test authority PI allows to also check the publisher information u, w. Especially with multiples eMD and the corresponding monetary amounts derived several times υ , ε trustworthiness and security are significantly improved.

The possibility of one eMD c sharing simplifies the administrative work for the signature publisher H and enables a payment system with eMD c where change can be paid or where non-circular monetary amounts can be transferred electronically. In 7 three scenarios are now shown, one with the one in 7 shown signing process S received divisible eMD is transmitted and the blind signature remains valid.

• Im Prüfverfahren PR1 der 7 ist zunächst dargestellt, dass der gesamte geldwerte Betrag einer eMD c geprüft und ggf. bei einem zweiten Teilnehmer T2, T3 eingelöst werden soll.

With the test procedures PR1 , PR2 , PR3 non-circular amounts can now be transferred very precisely or corresponding change (change) can be generated. For example, the maximum monetary amount could be one eMD c in the test procedure PR1 from a first participant T1 to a second participant T2 be sent. In the test procedure PR2 is then from the second participant T2 a partial amount υ as change to the first participant T1 retransfer. The first participant T1 can now pay the partial amount υ further split and the second installment ε to the third participant T3 in the test procedure PR3 transfer:

• In the test procedure PR1 of the 7 it is initially shown that the total monetary amount is one eMD c checked and possibly with a second participant T2 , T3 to be redeemed.

In the test procedure PR1 of the 7 Anyone who is aware of the above curve parameters and the verification key D (publisher's public key H ) is the blind signature of the eMD c check what, for example, by means of an inspection body PI who is not necessarily the editor H is done.

This is done in step 111 the unsigned blunt eMD c , the signed unvarnished eMD s, the subscriber generated serial number m and the publisher information w from the participant T1 and the reviewing body PI transfer. In the test procedure PR1 of the 7 a check is then carried out to determine whether the public key M was changed and whether w was changed, which is described below.

wird geprüft, ob die Bedingung der Gleichungen (24) erfüllt ist. Stimmt die errechnete eMD c mit der erhaltenen eMD c überein, so ist die blinde Signatur gültig und die eMD c kann von der Prüfinstanz PI, oder beispielsweise auch den anderen Teilnehmern T2, T3 für weitere Bezahlvorgänge verwendet werden.In step 112 the blind signature is verified. With equation (23) the subscriber generated public key is first M calculated. The publisher information u is obtained with equation (15) and with equation (33) $$A=s\cdot G+\left(c\text{'}\left(M\right)+u\right)\cdot D$$

it is checked whether the condition of equations (24) is fulfilled. Is the calculated eMD c with the received eMD c match, the blind signature is valid and the eMD c can be from the test body PI , or for example the other participants T2 , T3 be used for further payment processes.

In the test procedure PR2 of the 7 is now with step 115 the derivation of a partial amount u from the monetary total amount is shown. To do this, the participant generates T1 (or another participant T2 , T3 who owned the eMD c It's a secret p and another public key P using the subscriber generated secret p . The secret p is from the serial number m different. The further subscriber generated key P is from the subscriber generated public key M different. For example, the further subscriber-generated public key P by multiplying by the base point G can be obtained, see equation (25). For deriving 115 becomes a real signature with equation (26) σ _m created.

• • der eMD c
• • der teilnehmergenerierte öffentliche Schlüssel M
• • der signierte unverblendete eMD s
• • die echte Signatur σ_m
• • der Teilbetrag u
• • das teilnehmergenerierte Geheimnis p
• • die Herausgeberinformation w

U is the partial amount to be derived, which is smaller than the total monetary amount eMD c . The real signature σ _m here is a logical OR link from the public key P and the partial amount υ . Other logical links or mathematical operations for creating the real signature σ _m are also conceivable. In step 111 ' are the following variables between two participants T1 , T2 , T3 exchanged:

• • of the eMD c
• • the subscriber generated public key M
• • the signed unblended eMD s
• • the real signature σ _m
• • the partial amount u
• • the participant-generated secret p
• • the publisher information w

In step 112 ' can now check the authenticity of the blind signature and the authenticity of the real signature σ _m be checked, reducing the partial amount υ as - between the participants PI , T1 , T2 , T3 -transfer applies. To do this, first use the participant-generated secret p and the agreed base point G the other public key P calculated, see equation (25). In addition, the blind signature is checked according to equations (15), (33) and (24). In addition, the real signature σ _m from the calculated further subscriber-generated public key P and the partial amount received υ calculated and if equation (26) matches, the partial amount applies υ as verified and is through the secret p transfer. It should be noted that the inspection body PI , T2 , T3 does not have the subscriber generated serial number m and can thus verify the blind signature (using the key M ) but not in possession of the total monetary amount of eMD c reached. When checking in the process PR2 of the 7 So there is a check whether the public key M was changed whether w was changed and whether the real signature σ _m was changed.

In the test procedure PR3 of the 7 is now with step 116 deriving a second partial amount ε shown by the partial amount u. To do this, the participant generates T1 (or another participant who owns the eMD c is) a second secret q and a second further public key Q using the second subscriber generated secret q . The second secret q is from the serial number m and the secret p different. The second further subscriber generated key Q is from the subscriber generated public key M and the further subscriber generated key P different. For example, the second additional subscriber-generated public key Q by multiplying by the base point G can be obtained, see equation (28). For deriving 116 equation (29) also becomes a second real signature σ _p created.

• • der eMD c
• • der teilnehmergenerierte öffentliche Schlüssel M
• • der signierte unverblendete eMD s
• • die echte Signatur σ_m
• • der Teilbetrag υ
• • der weitere teilnehmergenerierte öffentliche Schlüssel P
• • die zweite echte Signatur σ_p
• • der zweite Teilbetrag ε
• • das zweite teilnehmergenerierte Geheimnis q
• • die Herausgeberinformation w

It is ε the second partial amount to be derived, which is smaller than the total monetary amount and also smaller than the partial amount υ of the eMD c . The real signature σ _p here is a logical OR link from the public key Q and the partial amount ε . Other logical links or mathematical operations are for creating the real signature σ _p also conceivable. In step 111 " are the following variables between two participants T1 , T2 , T3 exchanged:

• • of the eMD c
• • the subscriber generated public key M
• • the signed unblended eMD s
• • the real signature σ _m
• • the partial amount υ
• • the further subscriber-generated public key P
• • the second real signature σ _p
• • the second partial amount ε
• • the second subscriber generated secret q
• • the publisher information w

In step 112 " can now the authenticity of the blind signature, the authenticity of the real signature σ _m and also the authenticity of the second real signature σ _p be checked, reducing the second installment ε as - between the participants T1 , T2 , T3 - applies. To do this, first use the second subscriber-generated secret q and the agreed base point G the second other public key Q calculated, see equation (28). In addition, the blind signature is checked according to equations (15), (33) and (24). It also becomes the second real signature σ _p from the calculated second further subscriber-generated public key Q and the second partial amount received ε calculated and if equation (30) matches, the partial amount applies ε as verified and is by transmitting the second secret q also transferred. It should be noted that the inspection body PI , T2 , T3 does not have the subscriber generated serial number m or the subscriber generated secret p is. Thus, the blind signature and the real signature can σ _m , are verified (by the subscriber generated public key M and P ), but the auditor does not get the total monetary amount or the (first) partial amount υ .

With the test procedures PR1 , PR2 and PR3 it was demonstrated that between any participant now any monetary amounts υ , ε can be transferred, the authenticity of the blind signature and that of the respective partial amounts at all times υ , ε associated real signatures σ _m and σ _p can be checked. Through a suitable choice of the variables to be transmitted, the receiving instance then receives full access rights to the respective partial amounts, which means that the eMD is considered transferred. By integrating participant-independent publisher information u, w in the test procedure PR1 , PR2 , PR3 it determines whether the public key M , P , Q were manipulated by an instance and thus an attempt at fraud was detected. The publisher information u, w is not secret and can be used by any entity regardless of eMD c being checked.

In the context of the invention, all the elements described and / or drawn and / or claimed can be combined with one another as desired.

Reference symbol list

1-10

Process steps for classic blind signature

100-116

Procedural steps

M1

first terminal

M2

second terminal

M3

third terminal

T1

first participant

T2

second participant

T3

further participants

H

editor

PI

Test authority

m

subscriber generated serial number of the eMD

M

subscriber generated public key from m and G

p

subscriber generated secret

P

subscriber-generated further public key p and G

q

second subscriber-generated secret

Q

second subscriber-generated further public key q and G

γ, δ

subscriber-generated random numbers (integer)

f, a, b, G,

n, h agreed curve parameters

H()

cryptographic scatter function

R

edited point

A

participant-calculated point

d

secret key of the publisher

D

Verification key (publisher's public key)

G

Generator point (generator point, base point) of the elliptic curve

S

Signing process

PR

Review process

r

publisher-generated random number

w

Publisher information,

c

electronic coin record, eMD

c '

unsigned blinded eMD

c '+ u

expanded unsigned blinded eMD

s

signed unvarnished eMD

s'

signed blinded eMD

s ''

extended signed blinded eMD

υ

non-cash partial amount

ε

second monetary component

σ _m

Signature of the partial amount u and the public key P

σ _p

Signature of the partial amount ε and the public key Q

Claims (15)

A method (100) for generating a blind signature for an electronic coin data record, eMD (c), with the method steps: - Receiving (107) an unsigned, blinded eMD (c ') from a subscriber (T1) at a signature issuer (H); - expanding (113) the unsigned, blinded eMD (c ') with a publisher information (u, w) by the signature publisher (H) to obtain an expanded unsigned eMD (c' + u; c '+ w); - Signing (108) the extended unsigned eMD (c '+ u; c' + w) using a publisher-generated random number (r) and a secret key (d) of the signature issuer (H) to obtain an extended signed blinded eMD ( s "); and - Sending (109) the extended signed blinded eMD (s ") and the publisher information (u, w) to the subscriber (T1), the sent publisher information (u, w) being part of the blind signature. The procedure (100) according to Claim 1 , the publisher information (u, w) being provided independently of the signed, blinded eMD (s ") as independent information. The method (100) according to one of the preceding claims, wherein the publisher information (u) used to expand (113) the unsigned, blinded eMD (c ') is the result of a scatter value function (H ()) with a publisher value (w), the Publisher value (w) is sent as the publisher information (u, w) and is part of the blind signature. The method (100) of FIG. 3, wherein the publisher value (w) is at least one of the following values: - a current value; - an identification of the publisher; and or - a publisher-generated value. The method (100) according to one of the preceding claims, wherein the eMD (c) is the result (106) of a scatter value function (H ()) from a subscriber-generated serial number (m) and a subscriber-calculated point (A) of an elliptic curve. The method (100) according to one of the preceding claims, wherein the eMD (c) is the result of a scatter value function (H ()) from a subscriber-generated public key (M) and a subscriber-calculated point (A) of an elliptic curve, the subscriber-generated public Key (M) is derived from the subscriber-generated serial number (m). A method for checking a blind signature of an electronic coin record, eMD (c), the blind signature according to the method (100) of the previous one Claims 1 to 6 with the process steps: - Receiving (111) from: ◯ the eMD (c), ◯ a serial number (m) used to generate the eMD (c), ◯ a signed unblended eMD (s), and ◯ the publisher information ( u, w); - Calculating (112) an eMD using the received serial number (m), the signed uncovered eMD (s), the publisher information (w) and a public key (D) of the signature publisher (H); and comparing the calculated eMD with the received eMD (c) and verifying the authenticity of the blind signature if the calculated eMD matches the received eMD (c). The procedure after Claim 7 , the eMD obtained (c) being the result of a scatter value function (H ()) from a link (M) of a subscriber-generated serial number (m) with a base point (G) and a subscriber-calculated point (A) of an elliptic curve, and before Calculate the eMD (c) a subscriber-generated public key (M) is derived from the subscriber-generated serial number (m). A method for checking a blind signature of an electronic coin data set, eMD (c), the blind signature according to a method of Claims 1 to 6 was generated, with the method steps: - Obtaining (111) from: o the eMD (c); o a user-generated public key (M) used to generate the eMD (c); ◯ a signed uncovered eMD (s); ◯ a monetary portion of the eMD (υ); ◯ a signature (σ _m ) via a link between the monetary partial amount (υ) and another subscriber-generated public key (P); ◯ the subscriber generated secret (p); and ◯ the publisher information (w); - Calculating the further public key (P) from the received subscriber-generated secret (p); - Calculating a signature (σ _m ) via the link from the monetary partial amount (υ) and the calculated further public key (P); - Comparing the calculated signature (σ _m ) with the received signature (σ _m ) and verifying the authenticity of the monetary partial amount (υ); - Calculating an eMD using the subscriber-generated public key (M), the signed uncovered eMD (s), the publisher information (w) and a public key (D) of the signature publisher (H); Comparing the calculated eMD with the received eMD (c) and verifying the authenticity of the blind signature if the calculated eMD matches the received eMD (c). The procedure according to one of the Claims 7 to 9 , wherein the verification is carried out by the signature publisher (H) or a testing entity (PI) different from the signature publisher (H). The procedure according to one of the Claims 7 to 10th , whereby the publisher information (u, w) is also verified when checking. The procedure according to one of the Claims 7 to 11 , wherein the blind signature is generated with an elliptical curve signature algorithm, ECDSA, and agreed curve parameters (f, p, a, b, G, n, h, H ()) of the elliptical curve are provided for checking the blind signature. A payment system for transmitting an electronic coin data record, eMD (c) between at least two participants (T1, T2, T3), the payment system comprising: - a first participant (T1) for generating an unsigned, blinded eMD (c '); - a signature issuer (H) for generating a blind signature according to the method (100) one of the preceding Claims 1 to 6 ; - And a second participant (T2) to receive the generated eMD (c), a signed unblended eMD (s) and a serial number (m) used to generate the eMD (c). The payment system according to Claim 13 , wherein the second participant (T2) the received generated eMD (c), the signed unblended eMD (s) and the serial number (m) used to generate the eMD (c) using the method of Claims 7 to 12 checked. The payment system according to Claim 13 or 14 , wherein the first participant (T1) for generating (106) the eMD (c) is the result of a scatter value function (H ()) from a link between a participant-generated public key (M) and a participant-calculated point (A), the participant-generated public Key (M) is derived from the subscriber-generated serial number (m).

Images