Patent Publication Number: US-2002010858-A1

Title: Method and apparatus for registration of information with plural institutions and recording medium with registration program stored thereon

Description:
BACKGROUND OF THE INVENTION  
       [0001] The present invention relates to a method and apparatus for registering a plurality of pieces of electronic information with a plurality of institutions, for example, in an electronic cash system through utilization of a telecommunication system. Further, the invention pertains to a recording medium with a registration program stored thereon.  
       [0002] For example, in an electronic cash system, a user registers his generated information I A  with a bank, then has the bank to sign the information I A  and issue the signed information as a license, and uses it to get another institution to issue electronic cash. In such an instance, the user needs to register different pieces of information I A  and I B  with the bank and the electronic cash issuing institution, respectively, in such a way that either of them will have no knowledge of the information registered with the other.  
       [0003] To register two such different pieces of information I A  and I B , for example, with two institutions A and B without any risk of revealing to either of them what is registered with the other, it is necessary that the institution A prepare a pair of public and secret keys PK A  and SK A , that the institution B similarly prepare a pair of public and secret keys PK B  and SK B , and that the user enciphers the different pieces of information I A  and I B  through utilization of the public keys PK A  and PK B , respectively, and registers the enciphered pieces of information with the institutions A and B separately of each other. This inevitably gives rise to the problem of a heavy load of processing on the user side.  
       SUMMARY OF THE INVENTION  
       [0004] It is therefore an object of the present invention to provide a method and apparatus which permit registration of different pieces of user information with a plurality of institutions simply by presenting required information to each of them without providing any chance for either institution to get the information registered with the other institution.  
       [0005] Another object of the present invention is to provide a recording medium having stored thereon a programs for such registration of information.  
       [0006] The principles of the registration method according to the present invention are that the user generates the pieces of information I A  and I B  for registration with the institutions A and B, respectively, then enciphers the information I B  with a cipher key EK to obtain information EK(I B ), and sends these pieces of information I A  and EK(I B ) to the institution A. The institution A registers the information I A  as user information and sends the information EK(I B ) to the institution B. The institution B deciphers the information EK(I B ) with a cipher key EK and registers the resulting information I B .  
       [0007] The registration method according to the present invention comprises the steps as follows:  
       [0008] When a user U registers the different pieces of information I A  and I B  with an institution A apparatus and an institution B apparatus through a user apparatus:  
       [0009] the user unit generates key information K to be shared with the institution B, and enciphers the pieces of information I B  and K to be registered with the institution B apparatus through the use of a public key (PK B ) of the institution B, thereby generating information PK B (I B , K);  
       [0010] the user apparatus sends the pieces of information PK B (I B , K) and I A  to the institution A apparatus;  
       [0011] the institution A apparatus registers the user information I A  contained in its received information and sends the remaining information PK B (I B , K) to the institution B apparatus; and  
       [0012] the institution B apparatus deciphers the information PK B (I B , K) with its own secret key SK B  to derive I B  and K, and registers I B .  
       [0013] In this instance, when the institution B apparatus does not send its signature to the user apparatus to inform it of the registration of the user information, the key information K need not be generated.  
       [0014] Instead of generating the information PK B (I B , K), the user apparatus may generate information K(I B ) by enciphering I B with K and information PK B (K) by enciphering K with PK B  and send these pieces of information to the institution A apparatus. The institution A apparatus sends PK B (K) and K(I B ) to the institution B apparatus. The institution B apparatus deciphers the enciphered information PK B (K) with its secret key SK B  to obtain the key information K and uses it to decipher the enciphered information K(I B ) to obtain the user information I B .  
       [0015] Further, the institution A apparatus uses its secret key SK A  to add a signature of the institution A to information that is sent to the institution B apparatus to indicate thereto the registration of the user information with the institution A. The institution B apparatus verifies the validity of the signature contained in the information received from the institution A apparatus through the use of its public key PK A ; the institution B apparatus proceeds to decipherment only when the signature is found valid.  
       [0016] The confirmation of registration may be issued to the user apparatus by mail or telephone, for instance. In the case of sending such a notice of registration, especially, the signature of the institution B to the user apparatus:  
       [0017] the institution B apparatus generates registration confirming information SK B (I B ) by attaching a digital signature to the user information I B  through the use of the secret key SK B , then generates information K(SK B (I B )) by enciphering the registration confirming information with the user secret key K, and sends the enciphered information to the institution A apparatus;  
       [0018] the institution A apparatus generates information SK A (I A ) indicative of the registration of the user information I A  by attaching thereto a digital signature through the use of the secret key SK A , and sends the user apparatus the information SK A (I A ) and the enciphered information K(SK B (I B )) received from the institution B apparatus; and  
       [0019] the user apparatus obtains the registration confirming information SK B (I B ) by deciphering the information K(SK B (I B )) with the secret key K, then detects the signature SK A (I A ) of the institution A corresponding to the user information I A  and the signature SK B (I B ) of the institution B corresponding to the user information I B , then verifies the validity of the signature SK A (I A ) by the public key PK A  of the institution A and the user information I A  and the validity of the signature SK B (I B ) by the public key PK B  and the user information I B , and if they are both found valid, recognizes that the user information has been duly registered with either institution.  
       [0020] As described above, the present invention enables the user to register different information with a different institution simply by presenting thereto the required information without incurring the possibility of the information being revealed to other institutions. 
     
    
    
     BRIEF DESCRIPTION OF THE INVENTION  
     [0021]FIG. 1 is a block diagram for explaining the principles of the method for registering information with a plurality of institutions according to the present invention;  
     [0022]FIG. 2 is a block diagram illustrating the functional configurations of a user apparatus, an institution A apparatus and an institution B apparatus according to an embodiment of the present invention;  
     [0023]FIG. 3 is a flowchart showing the procedure involved in the system configuration of FIG. 2;  
     [0024]FIG. 4 is a block diagram illustrating a modified form of the FIG. 2 embodiment;  
     [0025]FIG. 5 is a flowchart showing the procedure involved in the system configuration of FIG. 4;  
     [0026]FIG. 6 is a flowchart depicting a modification of the procedure in FIG. 3;  
     [0027]FIG. 7 is a flowchart depicting a modification of the procedure in FIG. 5;  
     [0028]FIG. 8 is a block diagram illustrating the configuration of an electronic cash system embodying the information registering method according to the present invention;  
     [0029]FIG. 9 is a block diagram depicting the configurations of a user apparatus, a bank apparatus and a cash issuer apparatus for user registration processing in the electronic cash system shown in FIG. 8;  
     [0030]FIG. 10 is a block diagram depicting the configurations of the user apparatus, the bank apparatus and the cash issuer apparatus for electronic cash issuance processing in the electronic cash system shown in FIG. 8;  
     [0031]FIG. 11 is a block diagram depicting the configurations of the user apparatus and a shop apparatus for electronic cash payment processing in the electronic cash system shown in FIG. 8; and  
     [0032]FIG. 12 is a block diagram depicting the configurations of the bank apparatus and the cash issuer apparatus for settlement processing in the electronic cash system. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
     [0033] A description will be given, with reference to FIG. 1, of the principles of the method for registering user information with a plurality of institutions according to the present invention.  
     [0034] An institution A apparatus  100 , an institution B apparatus  200  and a user apparatus  300  are interconnected, for example, via communication lines, but they may be connected using a smart card or the like on which information can be recorded.  
     [0035] The system configuration of the present invention is based on the premise that at least institution B apparatus  100  prepares a pair of secret and public keys SK B  and PK B  and provides the public key PK B  to the user apparatus  300 . A user U uses an information generating part  33  of the user apparatus  300  to generate information I A  for registration with the institution A apparatus  100  and information I B  for registration with the institution B apparatus  200 . Further, the user U uses an encipher key EK to encipher the information I B  in an enciphering part  32  to obtain information EK(I B ). The user U sends the information I A  and the enciphered information EK(I B ) to the institution A apparatus  100 , which registers the information I A  in a memory  11  in correspondence to the user U and then sends the enciphered information EK(I B ) to the institution B apparatus  200 . The institution B apparatus  200  deciphers the received enciphered information PK B (I B ) with a decipher key DK in a deciphering part  23  to obtain the information I B , and registers it in a memory  21  in correspondence to the user U.  
     [0036] In the system of FIG. 1 there are two ways of conducting encipherment of the information I B  by the enciphering part  32  of the user apparatus  300  and decipherment of the enciphered information EK(I B ) by the deciphering part  23  of the institution B apparatus  200  as seen from the embodiments described later on. First, the user apparatus  300  enciphers the information I B  by using, as the encipher key EK, the public key PK B  of the institution B apparatus  200  to obtain information PK B (I B ), and sends it to the institution A apparatus  100  together with the information I A , and the institution B apparatus  200  deciphers the enciphered information PK B (I B ) by using the secret key SK B  as the decipher key DK to obtain the information I B . Second, the user apparatus  300  generates information K(I B ) by using its generated common key K as the encipher key EK and enciphers the common key K with the public key PK B  of the institution B apparatus  200  into PK B (I B ), and sends these pieces of information PK B (I B ) and K(I B ) to the institution A apparatus  100  together with the information I A , and the institution B apparatus  200  deciphers the enciphered information PK B (I B ) with the secret key SK B  to obtain the common key and deciphers the information K(I B ) with the key K to obtain the information I B . Accordingly, the institution A cannot get acquainted with the information I B  registered with the institution B in correspondence to the user U nor can the institution B get acquainted with the information I A  registered with the institution A in correspondence to the user U.  
     [0037] Embodiment 1  
     [0038]FIG. 2 illustrates in block form an example of the system configuration for implementing the registration of user information with a plurality of institutions according to the present invention. FIG. 3 depicts procedures for registering the user information with the institutions A and B in the system configuration of FIG. 2.  
     [0039] This embodiment is based on the premise that the institution A apparatus  100  prepares the secret key SK A  and the public key PK A  for a public key cryptosystem and a digital signature system (see, for example, Ikeno and Koyama, “Modern Cryptology,” Institute of Electronics, Information and Communication Engineers of Japan) and provides the public key PK A  to the user apparatus  300 , and that the institution B apparatus  200  similarly prepares the secret key SK B  and the public key PK B  and provides the latter to the user apparatus  300 .  
     [0040] Step S 1 : The user U uses an information generating part  330  of the user apparatus  300  to generate the information I A  for registration with the institution A apparatus  100  and the information I B  for registration with the institution B apparatus  200 . Further, the user U uses a common key generating part  340  to generate the common key K and an enciphering part  320  to encipher the information I A  and the common key K with the public key PK B  to generate information PK B (I B , K), and sends the pieces of information I A  and PK B (I B , K) to the institution A apparatus  100 .  
     [0041] Step S 2 : The institution A apparatus  100  uses a registration part  120  to store the information I A  and PK B (I B , K) in the memory  110 .  
     [0042] Step S 3 : Further, the institution A apparatus  100  uses a signature generating part  130  to attach a signature SK A (PK B (I B , K)) to the enciphered information PK B (I B , K) through the use of the secret key SK A , and sends the information SK A (PK B (I B , K)) and PK B (I B , K) to the institution B apparatus  200 .  
     [0043] Step S 4 : The institution B apparatus  200  uses a signature verification part  220  to decipher the signature SK A (PK B (I B , K)) of the institution A with the public key PK A , and makes a check to see if the resulting information PK B (I B , K)) matches the information PK B (I B , K) received from the institution A. If they do not match each other, the received information will be abandoned.  
     [0044] When they match each other, the received information PK B (I B , K) is deciphered using the secret key SK B  in a deciphering part  230  to extract the information I B  and the common key K.  
     [0045] Step S 5 : The institution N stores the thus obtained information I B  and K in a memory  210  through a registration part  240 .  
     [0046] Step S 6 : Further, the institution B generates a signature SK B (I B ) for the information I B  by a signature generating part  250  through the use of the secret key SK B , then enciphers the signature SK B (I B ) with the common key K by a ciphering part  260  to generate information K(SK B (I B )), then generates signature information SK B (K(SK B (I B ))) of the institution B for the enciphered information (SK B (I B )) by the signature generating part  250 , and sends the enciphered information K(SK B (I B )) and the signature information SK B (K(SK B (I B ))) to the institution A apparatus  100 .  
     [0047] Step S 7 : The institution A apparatus  100  uses a signature verification part  140  to verify the validity of the signature SK B (K(SK B (I B ))) of the institution B with the public key PK B . If the signature SK B (K(SK B (I B ))) is found invalid, the received information will be abandoned or destroyed.  
     [0048] When the signature SK B (K(SK B (I B ))) is found valid, the institution A generates signature information SK A (I A ) of the institution A for the user information I A  registered therewith, by a signature information generating part  150  through the use of a key K A , and sends the signature information SK A (I A ) and the information K(SK B (I B )) to the user apparatus  300 .  
     [0049] Step S 8 : The user apparatus  300  uses the common key K to decipher the enciphered information K(SK B (I B )) by a deciphering part  350  to thereby extract the signature SK B (I B ) of the institution B. The user apparatus  300  verifies the signatures SK A (I A ) and SK B (I B ) of the institutions A and B through the use of a pair of the public key PK A  of the institution A and the user information I A  and a pair of the public key PK B  of the institution B and the user information I B , respectively. When either one of the signatures SK A (I A ) and SK B (I B ) is found invalid, the user apparatus  300  destroys both of them, and when the both signatures are found valid, the user apparatus stores them in a memory  310 .  
     [0050] In the embodiment of FIG. 2, the purpose of attaching the signature of the institution A to the information PK B (I B , K) to be sent to the institution B through the use of the secret key SK A  is to enable the institution B to make sure that its received information SK A (PK B (I B , K)) has been sent via a normal route, i.e. from the institution A. The institution B verifies the validity of the signed information PK B (I B , K) from the institution A by the use of the public key PK A , thereby making sure that the information PK B (I B , K) has been duly received from the institution A. If such a verification is unnecessary, however, the institution A may send to the institution B only the received information PK B (I B , K) intact with no signature attached thereto. Similarly, when there is no need for the institution A to make sure that its received information K(SK B (I B )) has been received from the institution B, the institution B needs only to send to the institution A the information K(SK B (I B , K)) without attaching thereto its signature. The institution A sends the received information K(SK B (I B , K)) intact to the user U.  
     [0051] The embodiment of FIG. 2 described above may be modified as depicted in FIG. 4. A modified registration procedure is shown in FIG. 5 in correspondence to FIG. 3. In FIG. 4 the parts corresponding to those in FIG. 2 are identified by the same reference numerals. Instead of generating the enciphered information PK B (I B , K), the user apparatus  300  generates, in step S 1 , information K(I B ) by enciphering the information I B  with the key information K in an enciphering part  321  and information PK B (K) by enciphering the key information K with the public key PK B  in an enciphering part  322 , and sends these pieces of information K(I B ) and PK B (K) to the institution A apparatus  100 .  
     [0052] The institution A apparatus  100  stores, in step S 2 , the user information I A  in the memory  110  and stores therein the information K(I B ) in place of the information PK B (I B , K), and in step S 3  attaches its signature to the information K(I B ) with the secret key SK A  in the signing part  130 , thereafter sending the signature SK A (K(I B )) and the pieces of information PK B (K) and K(I B ) to the institution B apparatus  200 .  
     [0053] The institution B apparatus  200  verifies, in step S 4 , the signature SK A (K(I B )) with the key PK A  in the verification part  220 . If the signature is found valid, the institution B apparatus  200  deciphers the information PK B (K) with the secret key SK A  in a deciphering part  231  to obtain the key information K, and uses the key information K to decipher the information K(I B ) in a deciphering part  232  to obtain the information I B . In step S 5  the user information I B  and the key information K thus deciphered are stored in the memory  210 .  
     [0054] In FIG. 4 there is omitted the procedure for sending the signatures SK A (I A ) and SK B (I B ) to the user U for indicating thereto the registration of the user information because the procedure is identical with that described above with reference to FIGS. 2 and 3.  
     [0055] In the embodiments of FIGS. 2 and 4 the institution A apparatus  100  has been described to send the enciphered information signed with the secret key SK A , as information indicative of registration of the information I A , to the institution B apparatus  200 . If, however, the information I A  and the information I B  are merely registered with the institution A apparatus  100  and the institution B apparatus  200 , respectively, without any possibility of the information registered with either of the institution apparatuses being revealed to the other, the signature by the secret key SK A  need not be sent to the institution B apparatus  200 . That is, the signing in the signing part  130  in step S 3  can be omitted; in the case of FIG. 3, only the information PK B (I B ,K) may sent to the institution B as depicted in FIG. 6, and in the case of FIG. 5, the information K(I B ) and PK B (K) may be sent to the institution B as depicted in FIG. 7. Accordingly, in the cases of FIGS. 6 and 7, the institution B does not verify the signature of the institution A in step S 4 , but instead it only obtains the information I B  and the key K by decipherment using the secret key SK B .  
     [0056] Moreover, the pieces of user information I A  and I B  need only to be registered with the institution A apparatus  100  and the institution B apparatus B  200 , respectively, and notice of registration may be served to the user U, for example, by mail or telephone, not electronically. In such an instance and when the user apparatus  200  does not require the signatures SK A (I A ) and SK B (I B ) of the institution A apparatus  100  and the institution B apparatus  200  that are attached to the information I A  and the information I B , respectively, the signature verification parts  140  and  360 , the signing parts  150  and  250 , the enciphering part  260  and the deciphering part  350  in FIG. 2 and the associated processing can be omitted, and in the FIG. 2 embodiment the key information can be dispensed with. For example, in an electronic cash system the institution A apparatus  100  is a bank and the institution B apparatus  200  an electronic cash issuing institution; except in the case where the institution A apparatus  100  calls for information containing I B  so as to deal with an abuse of electronic cash, there is no need for registering the pieces of information PK B (I B , K) and K(I B ) with the institution A apparatus  100  in the examples of FIGS. 2 and 4.  
     [0057] The institution A apparatus  100 , the institution B apparatus  200  and the user apparatus  300  have the functional configurations shown in FIGS. 2 and 3; their processing is computerized and a recording medium is used which has the program therefor recorded thereon.  
     [0058] Embodiment 2  
     [0059] Next, the present invention will be described as being applied to a hierarchical electronic cash system and an apparatus therefor.  
     [0060]FIG. 8 illustrates an example of the system configuration to which this embodiment is applied. An apparatus of an electronic cash issuing institution (hereinafter referred to as an issuer I)  200 , apparatuses of a plurality of institutions that manage user information (account information) and effect settlement of electronic cash with shops (hereinafter referred to simply as banks)  100 , an apparatus of a person who has electronic cash issued (hereinafter referred to simply as a user)  300 , and an apparatus of an institution that receives electronic cash from the user (hereinafter referred to simply as a shop)  400  are interconnected via communication lines or the like. These apparatuses may also be connected using a smart card.  
     [0061] The bank  100  makes public in advance a public key PS B  for digital signature that is set by a signature verification function V B  and the function V B , and pregenerates a secret key SS B  that is set by a function S B . The issuer  200  makes public beforehand a public encipher key PE I  that is set by a function E, and a public key PS I  for digital signature that is set by a function V I , and pregenerates a secret cipher key SE I  that is set by a function D I  and a secret signature key SS I  that is set by a function S I . To make the cipher key PE I  public is based on the premise of making public the cipher function E I  that uses the public cipher key PE I . Likewise, to make the key PS I  for digital signature public is based on the premise of making public the signature verification function V I =V PSI  that uses the public key PS I .  
     [0062] In this embodiment, when the user  300  requests the bank  100  to do a procedure for the issue of electronic cash of a face value X, the bank  100  withdraws the amount of money X from the account of the user  300  and sends the user&#39;s request to the issuer  200  after attaching a digital signature to the request to certify its validity. The issuer  200  verifies the validity of the request and issues electronic cash of the face value X to the user  300 .  
     [0063] In this instance, the user  300  generates, as electronic cash issuance request information, information that contains a signature verification key N U  necessary for the verification of a signature of the user in the procedure for his payment of electronic cash to a shop. And the user  300  follows the procedure in Embodiment 1 to register his real name with the bank  100  in correspondence to his account and the signature verification key N U  with the electronic cash issuing institution  200 .  
     [0064] (A) User Registration Procedure  
     [0065] Step  1 : A description will be given first, with reference to FIG. 9 depicting functional blocks of the user  300 , the bank  100  and the issuer  200 , of a procedure for the user  300  to register his information with the bank  100  and the issuer  200 . The user  300  uses a digital signature key generating part  330  to generate a signature generating key SS U , that is, a signature generating function S U  and a signature verification key N U . Further, the user  300  generates a cipher key K, using a cipher key generating part  340  for a common cipher key (see, for example, Ikeno and Koyama, “Modern Cryptology,” Institute of Electronics, Information and Communication Engineers of Japan). The signature generating key SS U , the signature verification key N U , and the cipher key K thus generated are held in a memory  30 M (FIG. 10). Next, the user  300  calculates E I (K, N U ) by means of an encipherment part  320  for calculating the cipher function E I , and sends the calculated information to the bank  100  together with the user&#39;s name U.  
     [0066] Step S 2 : The bank  100  first makes sure that the user&#39;s name U corresponds to an authorized user having an account, and then records the user&#39;s name U and the information E I (K, N U ) in a pair in a user data base  110 .  
     [0067] Next, the bank  100  uses the signature function S B  in a signature generating part  130  to calculate its signature S B =S B (E I , K, N U )) for the information E I (K, N U ), and sends information {E I (K, N U ), S B } to the issuer  200 .  
     [0068] Step S 3 : The issuer  200  verifies the validity of the signature S B  sent from the bank  100 , using the signature verification function V B  in a signature verification part  220 . If the signature is found valid, the issuer  200  deciphers the information E I (K, N U ) with the secret cipher key SE I  in a decipherment part  230 , thereby obtaining the keys K and N U . Next, the issuer  200  a signature S I (N U ) for the key information N U  in a signature generating part  250 , and stores the pieces of information N U  and E I (K, N U ) in a pair in an inspection data base  210 . Further, the issuer  200  uses the key K as an encipher key in an encipherment part  260  to encipher the signature S I (N U ) into E K (S I (N U )), and sends it to the bank  100 .  
     [0069] Step S 4 : The bank  100  sends the information E K (S I (N U )) to the user  300 .  
     [0070] Step S 5 : The user  300  deciphers its received information E K (S I (N U )) with the key K in a decipherment part  350 , thereby extracting the signature S I (N U ) of the issuer  200 . Here, let L={N U , S I (N U )} represent a license of the user U.  
     [0071] This registration procedure corresponds to that in the FIG. 3 embodiment. That is, the signature verification key N U  of the user U corresponds to the information I B  in FIG. 3 and the user&#39;s real name U to the information I A . The bank  100  has knowledge of the correspondence between the enciphered information E I (K, N U ) and the user U but cannot decipher the information E I (K, N U ), and hence it will be unable to get acquainted with the keys K and N U  (that is, it will not be able to know the information I B ). On the other hand, the electronic cash issuing institution  200  knows that the bank  100  has the enciphered information E I (K, N U ) but cannot get acquainted with its correspondence to the user U, and hence it will not be able to know the user&#39;s real name, that is, the information I A .  
     [0072] (B) Electronic Cash Issuing Procedure  
     [0073] Next, a description will be given, with reference to FIG. 10, of the procedure for the user to have electronic cash issued.  
     [0074] Incidentally, the issuer  200  holds secretly the secret key SE I  corresponding to the public cipher key PE I  and the decipher function D I =D SEI  using the key SE I  in a memory  10 M (FIG. 10) in correspondence to the cipher function E I  using the public key PE I ; that is, the issuer  200  holds the key SE I  in secret. Further, the issuer  200  holds secretly the signature generating function S I =S SSI  using the secret key SS I  corresponding to the public cipher key PS I  in a memory  20 M (FIG. 10) in correspondence to the signature verification function V I  using the public key PS I ; that is, the issuer  200  holds the key SS I  in secret. Similarly, the bank  100  holds secretly the signature generating function S B =S SSB  using the secret key SS B  corresponding to the public key PS B  in the memory  10 M in correspondence to the signature verification function V B  using the public key PS B ; that is, the bank  100  holds the key SS B  in secret.  
     [0075] The user  300  goes through the following procedure to ask the bank  100  to withdraw the amount of money X from his account so as to request the issue of electronic cash of the face value X.  
     [0076] Step S 1 : The user  300  reads out from the memory  30 M the cipher key K, the signature generating key SS U , the signature generating function S I  and the signature verification key N U  pregenerated by the user  300 . Next, the user  300  generates, as a request for the issue of electronic cash, information E I (X, K, N U ) obtained by enciphering (X, K, N U ) with the public encipher function E I  and the encipher key PE I  in the encipherment part  320 , and sends the bank  100  a message for requesting it to withdraw the amount of money X from the account of the user U and the enciphered information E I (X, K, N U ). The cipher key K is one that the issuer  200  uses to encipher return information S I (X, N U ) addressed to the user  300  as described later on. Incidentally, it is desirable that this message be authenticated, for example, by the digital signature of the user U.  
     [0077] Step S 2 : The bank  100  checks the balance of the user U and reduces the balance by the amount of money X. Alternatively, the user&#39;s request for withdrawal may be recorded. The user&#39;s signature, if attached to his request, will be of particularly high probative value. The withdrawal from the user&#39;s account may be made at any time after checking the balance.  
     [0078] Next, the bank  100  calculates, in the signature generating part  130 , its signature S B =S B (X, E I ,(X, K, N U )) for the amount of money X and the information E I (X, K, N U ) received as the electronic cash issuance request from the user  300 , and sends information {S, E I (X, K, N U ), S B } to the issuer  200 .  
     [0079] Step S 3 : The issuer  200  verifies the validity of the signature S B  received from the bank  100 , using the signature verification function V B  in the signature verification part  220 . If the signature is found valid, the issuer  200  deciphers the information E I (X, K, N U ) with the secret cipher key SE I  in the decipherment part  230 , obtaining the individual pieces of information X, K, and N U . Next, the issuer  200  makes a check in a comparison part  240  to determine if the amount X received from the bank  100  and the amount X deciphered as mentioned above. If the information X is found valid, the issuer  200  generates, in the signature generating part  250 , its signature S I (X, N U ) for information (X, N U ) containing the key N U  for verifying the signature of the user  300 .  
     [0080] Further, the issuer  200  records a set of pieces of information N U , E I (X, K, N U ) and K and information B of the bank  100  (its name or identification number) in the inspection data base  210  in correspondence to an initial value Y=0 of the total amount of money used Y.  
     [0081] Then, the issuer  200  enciphers its signature S I (X, N U ) into information E K (S I (X, N U )), using the cipher key K in the encipherment part  260 , and sends the enciphered information E K (S I (X, N U )) to the bank  100 .  
     [0082] Step S 4 : The bank  100  sends the user  300  the enciphered information E K (S I (X, N U )) received from the issuer  200 .  
     [0083] Step S 5 : The user  300  uses the key K in the decipherment part  350  to decipher the received information E K (S I (X, N U )), obtaining the signature S I (X, N U ) of the issuer  200 .  
     [0084] In this instance, letting the initial value of the balance x of electronic cash be represented by x=X, information C={x, X, N U , S I (N U ), S I (X, N U )} is stored as electronic cash of the amount X in the memory  30 M, together with the key information SSU. The electronic cash C will hereinafter be called electronic cash issued from the issuer  200 .  
     [0085] While in this embodiment the user  300  has been described to generate the signature verification key N U , it may also be generated by a different institution, for example, by the issuer  200 . In such an instance, the user  300  sends information E I (X, K) to the bank  100 . The bank  100  processes the information in the same manner as is the case with the information E I (X, K, N U ) and the issuer  200  also performs processing in the same manner as in the above, thereby verifying the validity of the signature attached to the information (X, E I (X, K)) and deciphers it to obtain X and K. After this, the issuer  200  generates the signature verification key N U  and processes X and N U  in the same manner as in the above, and sends E K (N U ) to the user  300  via the bank  100 .  
     [0086] (C) Payment of Electronic Cash  
     [0087] Next, A description will be given, with reference to FIG. 11, of the procedure for the user  300  to pay an amount of money y (where y≦x) to the shop  400  with the electronic cash C of the face value X and the balance x.  
     [0088] Step S 1 : The user  300  sends the shop  400  the electronic cash C={x, X, N U , S I (X, N U ), S I (N U )} read out of the memory  30 M.  
     [0089] Step S 2 : The shop  400  verifies the validity of the issuer&#39;s signatures S I (N U ) and S I (X, N U ) in a signature verification part  410  using the public key PS I  for verification of the signature of the issuer  200 . If they are found valid, the shop  400  generates random numbers R 1  and R 2  in a random generating part  450 , then generates in a randomizing part  460  a value G 1  obtained by randomizing information W corresponding to the shop  400  with the random number R 1  and a value G 2  obtained by randomizing a signature verification key N W  with the random number R 2 , and sends these values G 1  and G 2  to the user  300  along with a transaction identifier T S  generated in a transaction identifier generating part  430 . The transaction identifier T S  is, for example, information containing the date and time of transaction.  
     [0090] Step S 3 : The user  300  receives the transaction identifier T S  and the values G1 and G1 in a one-way function calculating part  380  to obtain a function e=f(T S , G 1 , G 2 ), then generates a user signature S U (e, y) for the function e and the amount of money y to be paid in a signature generating part  370 , and sends the user signature and the amount of money y to the shop  400 .  
     [0091] Step S 4 : As is the case with the user  300 , the shop  400  calculates the function e from the transaction identifier T S  and the values G 1  and G 2  in a one-way function calculating part  420 , then verifies the validity of the user signature S U (e, y) in a signature verification part  440  through the use of the signature verification key N U  received from the user  300 , and makes a check in a comparison part  470  to see if y≦x. If both of them are found valid, the shop  400  admits or acknowledges payment with the electronic cash in the amount y concerned, and stores all communication data H={x, X, N U , S I (N U ), S I (X, N U ), T S , G 1 , G 2 , R 1 , R 2 , y, S U (e, y)} in a memory  480 .  
     [0092] (D) Settlement  
     [0093] A description will be given finally, with reference to FIG. 12, of a method for the settlement of accounts between the shop  400  and the bank  100 .  
     [0094] Step S 1 : The shop  400  sends the issuer  200  all the communication data H={x, X, N U , S I (N U ), S I ,(X, N U ), T S , G 1 , G 2 , R 1 , R 2 , y, S U (e, y)} between the user  300  and the shop  400 .  
     [0095] Step S 2 : A decision/control part  295  of the issuer apparatus  200  makes a check to see if the signature verification key N U  for the user  300  contained in the communication data H is stored in the inspection data base  210 . When (X, N U ) is not stored in the inspection data base  210 , the issuer  200  considers that the user  300  has made an invalid payment, and begins a malicious adversary specifying procedure. When (X, N U ) is stored, the issuer  200  calculates in an adding part  270  a total amount of money used, Y+y, corresponding to (X, N U ), then compares the total value Y+y with the face value X in a comparison part  290 , and performs the following processing based on the result of comparison.  
     [0096] (a) If the total value Y+y is smaller than the face value X, the shop  400  will request the bank  100  to pay the money y into its bank account. In this case, the bank that has the account of the shop  400  need not always be the bank  100  with which the user  300  has his account. The issuer  200  updates the total value Y in the inspection data base  210  with Y+y, and stores the communication data H in a history data base  280 .  
     [0097] (b) If Y+y=X, the shop  400  will request the bank  100  to pay the money y into its bank account. And since the electronic cash has been spent in full, the issuer  200  deletes the information (X, N U ) and the corresponding total amount Y from the inspection data base  210 .  
     [0098] (c) If Y+y&gt;X, the issuer  200  deletes the information (X, N U ) and the corresponding total amount Y from the inspection data base  210 ; in this case, too, the issuer  200  considers that an invalid payment by the user  300  has been made, and performs the malicious adversary specifying procedure.  
     [0099] Step S 3 : In the malicious adversary specifying procedure, the issuer  200  sends, prior to the deletion of the information (X, N U ), the bank  100  information as evidence of the malicious play (all communication data H concerning the invalid payment) read out of the history data base  280  and the pieces of information (K, N U ) and E I (K, N U ) read out of the inspection data base  210 . The bank  100  verifies the validity of the evidence of the malicious play (all the communication data H concerning the invalid payment) with the signature verification key N U  in the signature verification part  140 . If the evidence is valid, the bank  100  will specifies the malicious user U from the user data base  110 , using the enciphered information E I (K, N U ) as a key.  
     [0100] In Embodiment 2 described above, it is possible, in general, to convert a given function g to g(X, N U )=n or {g(X), g(N U )}=n and use the n as a value corresponding to (X, N U ). That is, the above-described embodiment employs an identity function as the function g. Further, the information E I (X, K, N U ) may be considered as a combination of the pieces of information E I (X, K) and E I (N U ).  
     [0101] Effect of the Invention  
     [0102] As described above, according to the present invention, when the user sends pieces of information PK B (I B ) and I A  or PK B (K), K(I B ) and I A  to the institution A apparatus (a bank, for instance) from the user apparatus, the user information I A  is registered with the institution A apparatus, then the information containing I B  is sent therefrom to the institution B apparatus without any risk of the user information I B  being revealed to the institution A apparatus and is registered with the institution B apparatus. Accordingly, the user needs not to perform processing for individual registration of user information with the institution A apparatus and the institution B apparatus; hence, the registration processing is simple.  
     [0103] Further, the institution A apparatus attaches its signature to the information received from the user apparatus and sends the signed information to the institution B apparatus. The institution B apparatus verifies the validity of the signature attached to the information received from the institution A apparatus. When the signature is found valid, it can be recognized that the institution A apparatus has already registered the information I A  received from the user apparatus.  
     [0104] With the present invention applied to the electronic cash issuing procedure, the user needs only to perform a single procedure through a bank to register his real name U with the bank without any risk of the name being revealed to the issuer and the user signature verification key NU with the issuer without any risk of the key being revealed to the bank.  
     [0105] It will be apparent that many modifications and variations may be effected without departing from the scope of the novel concepts of the present invention.