# Offline Payment of Central Bank Digital Currency Based on a Trusted Platform Module
## 3 Methodology  
### Core Features of Proposed Model  
To implement a secure CBDC payment system in a completely offline environment, several widely utilized technologies are employed. Firstly, a TPM is used as a security device, along with its counter, which serves as a fundamental aspect of this study. By leveraging the TPM counter, it becomes possible to determine whether a payment has been executed, even in a fully offline environment. For efficiency and convenience, a token-based approach is adopted, specifically utilizing JSON Web Tokens (JWTs), which are inherently verifiable. Furthermore, the generation of a valid payment token must be performed by the counterparty to mitigate the risk of fraud by the device owner. The digital signature provided by the TPM is utilized for payment verification and to ensure non-repudiation. The following outlines the core features of the proposed model. 1. Applying the TPM and its counter: The TPM was developed by the Trusted Computing Group (TCG) [23]. The TPM fundamentally consists of hardware-based cryptographic chips and a standardized framework for managing these chips through embedded software, which enhances compatibility among various cryptographic components. The TPM specification was formalized as ISO/IEC 11889 in 2015. Specifically, the TPM functions as a system-independent security chip designed to be impervious to external access. Utilizing this characteristic, the TPM generates and securely stores cryptographic keys and executes cryptographic operations internally to ensure robust security. In the TPM 2.0 specification, the rights of the user and the platform owner are restricted, preventing users from modifying the TPM's functionalities [24]. The TPM is widely utilized across various devices, including smartphones and notebook PCs. The main functions of a TPM encompass boot security, authentication, data protection, device protection, and the prevention of unauthorized access [25; 26; 27]. Moreover, TPM 2.0 introduces a versatile monotonic counter stored in non-volatile memory, characterized by a non-decreasing value that is resistant to tampering due to its internal location within the TPM. This monotonic counter is particularly advantageous, as it can be employed in conjunction with specific messages to ascertain whether a message has been reused. A study conducted by Sarmenta et al. demonstrated the feasibility of implementing a secure payment method utilizing the TPM's monotonic counter within an untrusted platform [28]. In the present study, the monotonic counter within an offline platform is employed to detect instances of double spending, and detailed payment processes will be presented in the subsequent section. 2. Applying the ID (identification) certificate: Each offline CBDC wallet is equipped with a public key pair within the TPM for transaction purposes and is secured by an ID certificate issued by the CBDC institution or a Certificate Authority. Subscribers are required to verify their identity upon receipt of the ID certificate, which contains an identifier for the subscriber's offline CBDC wallet rather than their actual name. This identifier must not be linked to any personal information of the subscriber and is utilized for administrative purposes by the CBDC institution. The certificate is included and transmitted with the transaction. To enhance efficiency, particularly in terms of ID certificate validation and verification, it is essential that all such certificates share the same domain or root. 3. Applying the JSON Web Token (JWT) for offline CBDC format: JWT is a standard established by the Internet Engineering Task Force (IETF), RFC 7519. It is widely employed in web applications for the secure transmission of information, particularly in the areas of authentication and authorization. A JWT consists of three components, which are separated by dots: Header.Payload.Signature.