JP3558544B2 - Electronic cash system - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an electronic cash system for paying with electronic cash, and more particularly to an improvement for paying to a plurality of recipients.
[0002]
[Prior art]
As a conventional electronic cash method, for example, the one described in Moribatake, Akaka, Suganuma, Takahashi “Hierarchical Electronic Cash Method”, IEICE, Information and Security Symposium, 1998 is known. FIG. 1 shows this conventional electronic cash payment protocol.
[0003]
After agreement between the payer and the receiver is reached on the payment amount x, first, the payer's machine 1 (hereinafter simply referred to as “payment machine”) receives the electronic cash C for the payment amount x and the payer's The license L in which the electronic signature of the secret key of the electronic cash issuing institution is added to the public key and the payment amount x are sent to the recipient machine 3 (hereinafter simply referred to as “reception machine”) (step S1). . After checking the received payment amount x and the electronic cash C, the receiving machine 3 generates a challenge range Call from the user number IdU of the recipient and an appropriate random number (S2), and sends the challenge Call to the payment machine 1 It transmits (S3). This challenge Chall has a role as identification data for indicating that the recipient is a valid recipient. Upon receiving the challenge Call, the payment machine 1 creates an electronic signature S from the challenge Call, the payment amount x, and the electronic cash C using the payer's public key (S4), and transmits the electronic signature S to the receiving machine 3. (S5). The electronic signature S is data indicating that the payer has recognized that the electronic cash C is intended for the creator (that is, the receiver) of the challenge CALL. The receiving machine 3 verifies that the received electronic signature S is correct, and when the verification is completed, stores the electronic cash C in the storage medium.
[0004]
[Problems to be solved by the invention]
In the conventional electronic cash method described above, a challenge is transmitted from one recipient to one payer for one payment. That is, the challenge is unique for one recipient and one payer per payment. Therefore, if one payer pays multiple recipients, the payer must execute the above payment protocol separately for each recipient, since there must be as many challenges as there are recipients. Must.
[0005]
As a result, for example, when a customer purchases a plurality of items from different sellers on an electronic mall where a plurality of sellers sell the item, the customer must pay each dealer separately. No. In order to eliminate this trouble, it is possible to operate the electronic mall so that even if the customer purchases how many items from which merchandise, they can collect them and pay them once to the representative company, One-to-one payment protocol has to be performed between each merchant for the distribution of money on the electronic mall side. In addition to the sales proceeds, for example, payment of a tenant fee between a store operator of a telecommunications mall and a management company of an electronic mall must also be performed on a one-to-one basis.
[0006]
The above problem is solved if the electronic cash paid by the customer at one time is automatically distributed to each trader according to their share.
[0007]
In addition, in the conventional electronic cash method, the payer cannot make a payment unless he / she knows the amount of money received by the receiver in advance. However, even if the payer is unaware, if the paid electronic cash is automatically distributed among multiple recipients, it is possible to operate the business with no extra trouble and high flexibility It becomes.
[0008]
Accordingly, an object of the present invention is to provide an electronic cash system that can pay electronic cash to a plurality of recipients in one payment operation.
[0009]
A second object of the present invention is to provide an electronic cash system in which paid electronic cash is automatically distributed to a plurality of recipients without paying particular attention.
[0010]
[Means for Solving the Problems]
In the electronic cash method of the present invention, a plurality of receiving machines each assigned a plurality of receiving amounts, and communicating with one paying machine, from this paying machine, a payment amount equal to the total amount of the plurality of receiving amounts and Payment to receive the electronic cash for the payment amount, and then create and send a challenge to the payment machine indicating the right to receive the payment amount, and then receive an electronic signature for the challenge from the payment machine A machine interface. Means for each receiving machine to check that it can take its amount from the payment received by the payment machine interface, and if so, to create a challenge element indicating the legitimate receiving authority of its amount; Means for verifying the electronic signature received by the payment machine interface and, if the electronic signature is valid, receiving electronic cash corresponding to the amount received from the electronic cash received by the payment machine interface. The payment machine interface also collects the challenge elements created by the plurality of receiving machines and creates the challenge from the challenge elements.
[0011]
According to this electronic cash method, a plurality of receiving machines check whether the numerical relationship between the payment amount sent from the payment machine and their own received amount is correct, and if they are correct, each receiving machine, Create a challenge element indicating the right to receive the right of each received amount. Then, the payment machine interface collects the challenge elements created by all the receiving machines, creates one challenge for the payer based on them, and sends the challenge to the payment machine. Therefore, the payment machine completes the payment only by executing one payment protocol using the total amount of the plurality of received amounts as the payment amount. In addition, since the payer does not need to know the amount of each individual recipient, the recipients can distribute the payment according to their own convenience without regard to the payer.
[0012]
In a preferred embodiment, when creating a challenge for a payer, a challenge having a fixed data length is created by performing a compression-type encryption process such as a hash function on challenge elements from all receiving machines. Thus, the challenge signed by the payment machine has a fixed data length regardless of the number of recipients. Therefore, the processing of the payment machine may be the same as the conventional one-on-one payment.
[0013]
In a preferred embodiment, one representative machine of the plurality of receiving machines has a payment machine interface. Then, starting from the representative machine, a plurality of receiving machines are connected and connected in a daisy chain. The payment amount and the electronic cash from the paying machine are sequentially relayed by each machine from the representative machine to the last receiving machine, and the challenge elements created by each receiving machine are sequentially relayed to the representative machine. In the course of this relay, each receiving machine receives the remaining amount obtained by subtracting the received amount of the other receiving machine from the payment amount, or the total amount of the received amount of the other receiving machine from the adjacent receiving machine. From this balance or the total amount, each receiving machine can determine whether or not it can take its received amount from the paid amount. Therefore, it is confirmed that the numerical relationship between the payment amount and the reception amount is correct when the challenge elements of all the receiving machines are gathered in the representative machine. Moreover, the amount received by each receiving machine is not known to other receiving machines.
[0014]
The present invention can be typically implemented by a computer, and a computer program for that can be installed or loaded into the computer through various media such as a disk storage, a semiconductor memory, and a communication network.
[0015]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 2 shows an electronic cash payment protocol according to an embodiment of the present invention. The payment protocol shown in FIG. 2 is an example where there are two recipients.
[0016]
The payer has a payment machine 11 that can store electronic cash and perform the calculations required to execute the payment protocol. As the payment machine 11, for example, a device having tamper resistance such as an IC card is suitable, but of course, another type of computer may be used. Each recipient has a set (hereinafter, referred to as a "receipt machine") 13, 15 of a computer required for executing the payment protocol and a storage device capable of storing the received electronic cash. The payment machine 11 and at least one receiving machine 13 can communicate. The receiving machines 13, 15 can also communicate with each other.
[0017]
Here, it is assumed that the amount received by one recipient is x1, the amount received by the other recipient is x2, and the amount paid by the payer is x (= x1 + x2). However, the payer knows the payment amount x, but does not know the reception amounts x1 and x2 of the individual receivers.
[0018]
After the payer agrees with the payment amount x, the payment machine 11 determines, as shown in step S11, the electronic cash C corresponding to the payment amount x yen among the stored electronic cash and the electronic cash C The license L indicating that the user is a proper user and the payment amount x are transmitted to the receiving machine 13 of the first recipient.
[0019]
The first receiving machine 13 prepares two random numbers R11 and R21 as shown in step S12, and applies a one-way function, for example, a hash function, to the first random number R11 and the received amount x1. To create a challenge element F11 related to the received amount x1, the user number IdU1 of the first receiver, the identification number Gb1 assigned to the transaction by the receiver, and the second random number R21. Similarly, a hash function is performed to create a challenge element F21 related to the user number IdU1. Thereafter, as shown in step S13, the first receiving machine 13 sends the two challenge elements F11 and F21 created by itself together with the electronic cash C, license L and payment amount x received from the paying machine 11, and The received amount x1 and the random number R11 from which the challenge element F11 related to the received amount x1 is created are transmitted to the next (last) receiving machine 15.
[0020]
The last receiving machine 15 prepares two random numbers R12 and R22 as shown in step S14, and firstly, receives the received amount x1 and the random number R11 received from the first receiving machine 13 and the received amount x1. From the challenge element F11, it is confirmed that the received amount x1 is correct. Next, the last receiving machine 15 obtains the remaining amount by subtracting the received amount x1 of the first receiver confirmed to be correct from the paid amount x, and the remaining amount (= x−x1) becomes the received amount x2. Check whether they are equal, and if they are correct, use one of the two random numbers R12 and R22 prepared in advance and the own received amount x2 to similarly challenge the own received amount x2 using the hash function. An element F12 is created, and the user number IdU2 of the last recipient, the identification number Gb2 assigned to the transaction by the recipient, and the other random number R22 are similarly used, using a hash function, A challenge element F22 relating to the user number IdU2 is created. Further, the receiving machine 15 generates a time stamp Ts and a random number Rs for signature. Thereafter, as shown in step S15, the last receiving machine 15 receives the time stamp Ts, the random number Rs for signature, the challenge elements F12 and F22 created by itself, and the challenge element F12 related to the received amount x2. The received receipt amount x2 and the random number R21, which are the creation source, are sent to the first receiving machine 13.
[0021]
The first receiving machine 13 checks whether the numerical relationship between the payment amount x, its own received amount x1, and the received amount x2 received from the last receiving machine 15 is correct, as shown in step S16, and corrects it. For example, a hash function is applied to the challenge elements F11 and F21 created by the user and the challenge elements F12 and F22 received from the last receiving machine 13 to create one challenge F for the payer. Thereafter, the first receiving machine 13 sends the created challenge F, the time stamp Ts received from the last receiving machine 15, the famous random number Rs, and the payment amount x to the paying machine 13.
[0022]
As shown in step S18, the payment machine 13 checks whether the payment amount x received from the receiving machine 13 is correct. If the payment amount x is correct, the payment machine 13 transmits its own private key to the received data Ts, Rs, F, x as a whole. The electronic signature S is used to generate the electronic signature S, and the electronic signature S is sent to the first receiving machine 13 as shown in step S19. The first receiving machine 13 also sends the electronic signature 3 to the last receiving machine 15 as shown in step S21.
[0023]
Then, as shown in step S20, the first receiving machine 13 verifies the electronic signature S received from the payment machine 11 using the public key included in the license L of the payer that has already been received. That is, using the payer's public key, the data from which the digital signature S was created is restored from the received electronic signature S, and the restored data is converted into true original data Ts, Rs, F, x Check if matches. As a result, if the electronic signature S is valid, the receiving machine 13 stores the electronic cash for the received amount x1 in the storage device together with the license L of the payer, the challenge F, and the challenge elements F11, F21, F12, and F22. To be stored.
[0024]
Similarly, the last receiving machine 15 calculates the challenge F from the received or created challenge elements F11, F21, F12, and F22 as shown in step S22, and then licenses the electronic signature S from the payer to the license L. Is verified using the payer's public key included in the payer, and as a result, if the electronic signature S is valid, the electronic cash for the received amount x2 is transferred to the payer's license L, challenge F, and challenge It is stored in the storage device together with the elements F11, F21, F12, and F22.
[0025]
By performing the payment in the above procedure, the payer can make payments to a plurality of recipients simply by performing a single payment protocol without being aware of whether the recipients are plural or singular. The burden of labor and communication costs is reduced. Recipients can distribute the received money according to their business circumstances without any extra trouble for the payer. For example, a store operator of an electronic mall can automatically pay a part of the sales proceeds as a tenant fee to the owner of the electronic mall. The challenge F signed by the payer is obtained by processing the challenge elements created by a plurality of recipients to a predetermined data length by performing a compression-type encryption process such as a hash function. Also, the payer can sign with the same operation.
[0026]
3 and 4 show a payment protocol according to another embodiment of the present invention by connecting the two figures. FIG. 3 illustrates a case where there are n recipients (n is an arbitrary integer of 2 or more). Here, the received amount of the i-th (i = 1, 2,..., N−1, n) receiver is assumed to be xi, and the payment amount is assumed to be x (= x1 + x2 +... + Xn−1 + xn).
[0027]
When the receiving machine 21 of the first receiver receives the license L, the electronic cash C for the payment amount x, and the payment amount from the payer (not shown) as shown in step S31, as shown in step S32, It checks whether the received payment amount x exceeds its own reception amount x1, and if it exceeds, subtracts its own reception amount x1 from the payment amount x, and calculates the remaining amount and x-x1 from the random number R11 prepared in advance. Then, a challenge element Call11 relating to the balance xx1 is created using a hash function, and a challenge element Call21 relating to the user number IdU1 is similarly created from the user's own user number IdU1 and a random number R21 prepared in advance. Thereafter, as shown in step S33, the first receiving machine 21 transmits the challenge Chall11, Chall21 created by itself, the remaining amount x-x1, and the random number R11 together with the data L, C, x from the payer, as shown in step S33. Send to receiving machine 23.
[0028]
As shown in step 34, the second receiving machine 23 determines from the remaining amount x-x1 received from the first receiving machine 21, the random number R11, and the challenge element Chall11 for the remaining amount that the received remaining amount x-x1 is correct. After confirming, it is checked whether the remaining amount x-x1 exceeds the received amount x2, and if it is exceeded, the received amount x2 is subtracted from the remaining amount x-x1 and the remaining amount x-x1-x2 is determined in advance. A challenge element Chall12 for the remaining amount x-x1-x2 is created from the prepared random number R12, and a challenge element Chall22 for the user number IdU2 is similarly created from the own user number IdU2 and the previously prepared random number R22. (S34). Then, as shown in step S35, the second receiving machine 23 receives the data L, C, x from the payer, the challenge elements Chll11 and Challenge21 from the first receiving machine 23, and the challenge Challenge12 created by itself. , Chall22, the balance x-x1-x2, and the random number R12 are sent to the third receiving machine 23 (not shown).
[0029]
In this way, each of the second to (n-1) th receiving machines (generally, the i-th receiving machine) receives the remaining amount x-x1 -...- xi-1 received from the immediately preceding receiving machine. After confirming that the remaining amount x-x1 -...- xi-1 is correct from the random number R1i-1 and the challenge Challenge1i-1 for the remaining amount, the remaining amount x-x1 -...- xi-1 is the amount received by the user. It checks whether it exceeds xi, and if it does, subtracts the received amount xi from the remaining amount x-x1 -...- xi-1. Then, from the balance x-x1-x2 -...- xi-1-xi obtained as a result of the subtraction and the random number R1i prepared in advance, the challenge element Chall1i relating to the balance x-x1-x2 -...- xi-1-xi is obtained. Create Further, a challenge element Call2i relating to the user number IdUi is created from the user number IdUi and a random number R2i prepared in advance. Then, the data L, C, x from the payer, the challenge elements Chll11, Chall21,..., Chall1i-1, Chall2i-1 from all the previous receiving machines, the challenges Chall1i, Chall2i created by the user, and the remaining amount .. -xi and the random number R2i are sent to the next receiving machine.
[0030]
The last n-th receiving machine 27, as shown in step S39, the balance x-x1 -...- xn-1, the random number R1n-1, and the challenge Challenge1n-1 for the balance received from the previous receiving machine 25. From the above, after confirming that the balance x-x1 -...- xn-1 is correct, it is checked whether the balance x-x1 -...- xn-1 matches the received amount xn, and the balance is checked. If so, a challenge element Chall12 relating to the received amount xn is created from the received amount xn and a random number R1n prepared in advance. Further, a challenge element Call2n relating to the user number IdUn is created from the user number IdUn and the random number R2n prepared in advance. Further, a time stamp Ts and a random number Rs for signature are generated. Further, as preparation for the subsequent signature check, a hash function is created from challenge elements Call11, Challenge21,..., Challenge1n-1, Challenge2n-1 from all the previous receiving machines, and challenges Challenge1n, Challenge2n created by the user. Used to calculate the challenge Challenge for the payer. Then, as shown in step S40, the time stamp Ts, the signature random number Rs, the challenge elements Chall1n and Chall2n created by the user, the own received amount xn and the random number R1n are compared with the (n−1) -th previous one. Send to the receiving machine 25.
[0031]
As shown in step S41, the (n-1) th receiving machine 25 sets the total amount xn + xn-1 of the received amount xn received from the last receiving machine 27 and its own received amount xn-1 as the immediately preceding received value. It is checked whether it is equal to the balance x-x1 -...- xn-2 already received from the machine, and if it is correct, as shown in step S42, the time stamp Ts received from the last receiving machine 27, the famous random number Rs, and the challenge It transmits the elements Chall1n and Chall2n, the challenge elements Chall1n-1 and Chall2n-1 created by the user, the sum xn + xn-1 of the received amount, and the random numbers R1n and R1n-1 to the immediately preceding receiving machine. Further, as preparation for the later signature check, a challenge Challenge for the payer is calculated from all challenge components Chll11, Challenge21,..., Challenge1n, Challenge2n that have already been received or created by the user.
[0032]
In this way, each of the (n-1) th to the second receiving machines (generally, the i-th receiving machine) receives the total amount xn + xn-1 +... + Xi + 1 received from the succeeding receiving machine. Check whether the total amount xn + xn-1 + ... + xi + 1 + xi with the received amount xi is equal to the balance x-x1 -...- xi-1 already received from the previous receiving machine. The time stamp Ts received from the receiving machine, the well-known random number Rs, the challenge elements Chall1n, Chall2n,. , R1n, R1n-1,..., Ri to the previous receiving machine. Further, as preparation for the later signature check, a challenge Challenge for the payer is calculated from all challenge elements Chll11, Challenge21,..., Challenge1n, Challenge2n already received or created by the user.
[0033]
As shown in step S46, the first receiving machine 21 calculates the total amount xn + xn-1 +... + X2 + x1 of the total amount xn + xn-1 +... + X2 received from the second receiving machine 23 and its own received amount x1. It is checked whether it is equal to the payment amount x. If it is correct, a challenge Chall for the payer is calculated from all the challenge elements Chll11, Chall21,..., Chall1n, Chall2n already received or created by the user. Then, as shown in step S47, the time stamp Ts received from the second receiving machine 23, the famous random number Rs, the payment amount x, and the challenge created by the user are transmitted to the payment machine.
[0034]
Although not shown, the payment machine checks whether the payment amount x received from the receiving machine 21 is correct, as in the embodiment of FIG. 2, and if it is correct, an electronic signature for the received data Ts, Rs, x, and Chall. And sends this electronic signature to the first receiving machine 21. This electronic signature is sent to all receiving machines from the first receiving machine 21 to the last receiving machine 27. Each receiving machine (generally, the i-th receiving machine) verifies the received electronic signature as in the embodiment of FIG. 2, and if the electronic signature is valid, the electronic cash corresponding to the received amount xi. Are stored in the storage device together with the payer's license L, the challenge Challenge, and the challenge elements Challenge11, Challenge21, Challenge12, Challenge22,..., Challenge1n, Challenge2n.
[0035]
According to this embodiment, not only the same advantages as in the embodiment of FIG. 2 but also the advantage that the amount received by each recipient is not known to other recipients can be obtained. That is, each receiving machine receives not the received amount of the preceding machine but the remaining amount from the payment amount from the preceding receiving machine, and the receiving machine of the subsequent stage receives not the received amount of the subsequent machine but the received amount of the subsequent machine. Since you receive the sum of the received amount, you cannot know the received amount of the other receiving machine.
[0036]
The embodiments of the present invention have been described above. However, the above embodiments are merely examples for describing the present invention, and are not intended to limit the present invention only to the above embodiments. Therefore, the present invention can be implemented in various modes other than the above-described embodiment. For example, in the above embodiments, individual machines, such as payment machines and receiving machines, were described as separate computer hardware, but this need not be the case and separate processes running on the same computer hardware. It can also be implemented as For example, the receiving machine of the first recipient and the receiving machine of the second recipient are actually two receiving processes that are being executed in multiplex on one computer.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a conventional electronic cash payment protocol.
FIG. 2 is a block diagram showing an electronic cash payment protocol according to an embodiment of the present invention.
FIG. 3 is a block diagram showing an electronic cash payment protocol according to the second embodiment of the present invention by connecting to FIG. 4;
FIG. 4 is an exemplary block diagram showing an electronic cash payment protocol according to the second embodiment by connecting to FIG. 3;
[Explanation of symbols]
11,21 Payment machine 3,23-27 Receiving machine

Claims (2)

A payment machine that pays the payment amount by electronic cash,
An electronic cash system having a first and a second receiving machine communicable with a payment machine and further communicable with each other;
The first receiving machine comprises:
A storage device for storing electronic cash of the amount received,
In communication with the payment machine, equal payments to the sum of receipts of the first and second receiving machine from the payment machine, an electronic cash this payment amount, receives the license, the first receipts of the first receipt machine from the previously prepared random number and receipts of receipt of the machine to create a challenge by using a hash function, the random number, the payment amount, the electronic cash, the license with both the second To the receiving machine, and checks whether the total amount of the received amount received from the second receiving machine and the received amount is equal to the paid amount, and if correct, the created challenge and the second receiving machine using a hash function from a challenge received created a challenge indicating legitimate receipt authority of the payments from, and transmitted to the payment machine together with the payment, a next legitimate of the payment Receiving a digital signature created with the private key of the payment machine from the payment machine for the entire challenge showing the territorial authority and the payment amount, and reconstructing the original data using the public key included in the license. The electronic signature is verified by restoring, and if the electronic signature is valid, the received amount is stored in the storage device from the electronic cash, and the electronic signature is transmitted to the second receiving machine. Computer with
The second receiving machine,
A storage device for storing electronic cash of a received amount of the second receiving machine;
Subtract the received amount of the first receiving machine from the paid amount received from the first receiving machine and check whether the received amount is equal to the received amount. If they are equal, hash the received amount and the random number prepared in advance. Creating a challenge using a function, transmitting the challenge together with the received amount and the random number to the first receiving machine, and properly receiving the payment amount from the challenge received from the first receiving machine and the created challenge. Creates a challenge indicating authority , verifies the electronic signature received from the first receiving machine by restoring the original data using the public key included in the license, and if the electronic signature is valid, A computer for storing the received amount of electronic cash from the electronic cash in the storage device . A payment machine that pays the payment amount by electronic cash,
An electronic cash system having n (n is an integer of 2 or more) receiving machines communicable with a payment machine and further communicable with each other;
The first receiving machine is
A storage device for storing electronic cash of the amount received,
Communicating with the payment machine, receiving from the payment machine a payment amount equal to the sum of the received amounts of the plurality of receiving machines, electronic cash and a license for the payment amount, and the payment amount is equal to its own received amount. Check if it is over, if it is over, subtract the received amount from the paid amount to find the remaining amount, create a challenge using a hash function from the remaining amount and a random number prepared in advance, and make the electronic cash and the license, Send the balance and the random number to a second receiving machine,
It checks whether the total amount of the received amount received from the second receiving machine and the total amount of the received amount is equal to the paid amount, and if it is correct, a hash function is created from the challenge created by itself and all the received challenges. Creating a challenge indicating the legitimate receipt authority of the payment amount and transmitting it to the payment machine together with the payment amount ,
Next , a challenge indicating the right to receive the payment amount and an electronic signature created with the payment machine's secret key for the payment amount are received from the payment machine,
The original data is restored and verified from the digital signature using the public key included in the license, and if the digital signature is valid, the electronic cash for the amount received is stored in the storage device. A computer for transmitting the electronic signature to the second receiving machine,
The i-th (i is an integer satisfying 2 ≦ i ≦ n−1) receiving machine is
A storage device for storing electronic cash of the amount received,
Check whether the balance received from the (i-1) th receiving machine exceeds the amount received by the user, and if so, subtract the amount received from the received balance, and calculate the balance between the balance and the random number prepared in advance. Create a challenge using a hash function from, and send to the (i + 1) th receiving machine together with the electronic cash and the license, the received challenge, the balance after the deduction and the random number,
Check whether the sum of the amount received from the (i + 1) th receiving machine and the amount received by the user is equal to the balance already received, and if correct, the challenge received from the (i + 1) th receiving machine and the challenge created by oneself. And the total amount to the (i-1) th receiving machine,
A challenge is created using a hash function from all the received challenges and the challenge created by the user, and the electronic signature received from the (i-1) th receiving machine is used by using a public key included in the license. The electronic signature is verified by restoring the original data, and if the electronic signature is valid, the electronic cash of the amount received is stored in the storage device from the electronic cash, and the electronic signature is stored in the i + 1st An electronic cash system , comprising: a computer that transmits the data to a receiving machine .

Images