Source: https://patents.justia.com/patent/6003765
Timestamp: 2019-10-16 01:52:07
Document Index: 657681119

Matched Legal Cases: ['art 306', 'art 307', 'art 305', 'art 404', 'art 403', 'art 302', 'art 114', 'art 114', 'art 114', 'art 115', 'art 114', 'art 114', 'art 107', 'art 103', 'art 114', 'art 113', 'art 114', 'art 107', 'art 306', 'art 307', 'art 305', 'art 404', 'art 403', 'art 40', 'art 302', 'art 114', 'art 114', 'art 114', 'art 103', 'art 114', 'art 114', 'art 107']

US Patent for Electronic cash implementing method with a surveillance institution, and user apparatus and surveillance institution apparatus for implementing the same Patent (Patent # 6,003,765 issued December 21, 1999) - Justia Patents Search
Justia Patents Banking SystemsUS Patent for Electronic cash implementing method with a surveillance institution, and user apparatus and surveillance institution apparatus for implementing the same Patent (Patent # 6,003,765)
May 13, 1997 - Nippon Telegraph and Telephone Corporation
A method for implementing an electronic cash system with a surveillance institution, in which a user sends a request for the issuance of electronic cash of a face value X to a bank together with user information U and a user signature verification key N.sub.U, and the bank stores a pair of data X and N.sub.U in the user database in correspondence with the user information U and sends the pair of data to the surveillance institution, while at the same time the bank generates and sends a signature S.sub.B (X,N.sub.U) for the data (X,N.sub.U) to the user. The surveillance institution registers the data (X,N.sub.U) in a surveillance database in correspondence with the total amount of payments Y. The user sends to a shop the amount of payment y, the face value X, the signature verification key N.sub.U and the signature S.sub.B (X,N.sub.U), along with a signature S.sub.U (e,y) for challenge information e received from the shop. The shop verifies the signatures S.sub.B (X,N.sub.U) and S.sub.U (e,y) and, if they are valid, receives a payment with the electronic cash.
Next, a description will be given, with reference to FIG. 3, of how the user 300 pays the amount of money y (y.ltoreq.x) to a shop 400 with the electronic cash C of the face value X and the balance x and containing the pair of the signature verification key N.sub.U of the user 300 and the signature S.sub.B (X,N.sub.U) issued from the bank 200.
Step 3: The user 300 verifies the validity of the inquiry information e=f(TIME,W) by a one-way function calculating part 306 and a comparison part 307. If it is valid, the user 300 calculates by a signature generating part 305 a user's signature S.sub.U (e,y) for the information e sent thereto and the payment y (y.ltoreq.x) and sends the information y and S.sub.U (e,y) to the shop 400.
Step 4: The shop 400 verifies the validity of the user signature S.sub.U (e,y) and the payment y by the signature verification part 404 using the inquiry information e and the signature verification key N.sub.U and verifies y.ltoreq.x by a comparison part 403. If either of them is valid, the shop 400 approves the payment of the amount y of money concerned with electronic cash and sends the decision result OK to the user 300, and if at least one of them is invalid, the shop 400 sends the decision result NG declining the payment with electronic cash. Further, the shop 400 holds the communication data H={x,X,N.sub.U,S.sub.B (X,N.sub.U),TIME,W,e,y,S.sub.U (e,y)} between it and the user 300 in a shop data storage 40D for the subsequent settlement of accounts.
Step 5: When receiving the decision result OK from the shop 400, the user 300 updates, by a subtract part 302, the balance x in the memory 30M with x.rarw.x-y.
The sum total Y of payments recorded corresponding to the management data (X,N.sub.U) is updated with Y+y.fwdarw.Y and a check is made again to see if the updated value Y is smaller than the face value X. Further, the control part 114 records the communication data H in a history database 108. It is preferable that the amount of data stored in the history database 108 be reduced by setting a term to each piece of history data H therein and eliminating therefrom the data when the term expires.
When the information (X,N.sub.U) has not been registered in the surveillance database 101, the surveillance institution 100 decides that the user 300 has overspent the electronic cash, and it performs processing for specifying the overspender. If Y+y>X, the control part 114 deletes the pair of data X and N.sub.U and the corresponding total sum Y from the surveillance database 101. Also in this case, the control part 114 decides that the user has overspent the electronic cash, and it carries out the overspender specifying processing.
Thereafter, when the communication history data H={x, X,N.sub.U,S.sub.B (X,N.sub.U),TIME,W,e,y,S.sub.U (e,y)} for the procedure of payment with the electronic cash C={x,X,N.sub.U,S.sub.B (X,N.sub.U)} is received from the shop 400 in the receiving part 115, the control part 114 retrieves the surveillance database 101 to see if the data (X,N.sub.U) in the received data has already been registered, and if not, the control part 114 decides that the payment with the electronic cash is improper and reports the data (X,N.sub.U) to the bank which issued the electronic cash. If the data (X,N.sub.U) has already been registered, the total amount of money used Y in the surveillance database 101, corresponding to the data (X,N.sub.U), and the amount of payment y in the data H are added together in the adding part 107. The result of this addition is compared in the comparison part 103 with the face value X in the data H. If the result of this comparison is Y+y>X, the control part 114 decides that the payment with the electronic cash is improper and erases the data (X,N.sub.U) and the corresponding face value X from the surveillance database 101 and, at the same time, sends the data (X,N.sub.U) via a transmitting part 113 to the bank that issued the electronic cash. If Y+y<X, the control part 114 decides that the use of the electronic cash is proper, then records the data H in the history database 108, and updates the corresponding total amount of money used Y in the surveillance database 108 with the result of addition in the adding part 107. When Y+y=X, it means that all the face value X of the electronic cash is spent, and consequently, the management data (X,N.sub.U) and the corresponding amount of money Y are erased from the surveillance database 101.
In the embodiment described above with reference to FIGS. 2, 3 and 4, since the user presents his signature verification key N.sub.U to the bank when requesting it to issue electronic cash, the bank knows the correspondence between the user information U and the data (X,N.sub.U). On the other hand, the shop, when paid with electronic cash, receives the data (X,N.sub.U) from the user. Then, in the event that the bank conspires with the shop, the former can get the information U of the user who spent the electronic cash at the latter. Thus, the embodiment described above with respect to FIGS. 2, 3 and 4 does not ensure sufficient user privacy. Turning now to FIGS. 7, 8 and 9, an embodiment improved in this respect will be described below.
Turning next to FIG. 8, a description will be given of the case where the user 300 pays the amount of money y (y.ltoreq.x) to the shop 400, using a pair of user signature verification key N.sub.U and bank signature S.sub.B (N.sub.U,R) as the electronic cash C of the face value X and the balance x (initial value x=X). It should be noted that in the blind signature scheme, it is possible to produce a unique pair of keys SK.sub.B and PK.sub.B in correspondence with each of a desired number of face values X. This means that the keys SK.sub.B and PK.sub.B to be used in the blind signature represent a face value X and, therefore, the signature S.sub.B (N.sub.U,R) contains information on both the signature key N.sub.U and the face value X.
Step 3: The user 300 uses the one-way function calculating part 306 and the comparison part 307 to verify the validity of the challenge information e=f(TIME,W). If the information is valid, the user 300 uses the signature generating part 305 to calculate the challenge information e sent thereto and the user signature S.sub.U (e,y) for the amount of payment y (y.ltoreq.x) and sends the amount of payment y and the user signature S.sub.U (e,y) to the shop 400.
Step 4: The shop 400 uses the signature verification part 404 to verify the validity of the user signature S.sub.U (e,y) and the amount of payment y through utilization of the challenge information e and the signature verification key N.sub.U and verifies y.ltoreq.x by the comparison part 403. If either of them is valid, the shop 400 approves the payment of the amount of money y with electronic cash and sends the decision result OK to the user 300. Further, the shop 400 holds the communication data H={x,X,N.sub.U,R,S.sub.B (N.sub.U,R),TIME,W,e, y,S.sub.U (e,y)} between it and the user 300 in a shop data storage part 40D for the subsequent settlement of accounts. If at least one of them is invalid, the shop 400 sends the decision result NG declining the payment with electronic cash.
Step 5: When receiving the decision result OK from the shop 400, the user 300 updates, by the subtract part 302, the balance x in the memory 30M with x.rarw.x-y.
The sum total payments Y recorded corresponding to the management data (X,N.sub.U,R) is updated with Y+y.fwdarw.Y and a check is made again to see if the updated value Y is smaller than the face value X. Further, the control part 114 records the communication data H in the history database 108.
When the data (X,N.sub.U,R) has not been registered in the surveillance database 101, the surveillance institution 100 decides that the user 300 has overspent the electronic cash, and it performs processing for specifying the overspender. If Y+y>X, the control part 114 deletes the management data (X,N.sub.U,R) and the corresponding data Y from the surveillance database 101. Also in this case, the control part 114 decides that the user has overspent the electronic cash, and it carries out the overspender specifying processing.
The result of this addition is compared in the comparison part 103 with the face value X in the data H. If the result of this comparison is Y+y>X, the control part 114 decides that the payment with the electronic cash is improper and erases the management data (X,N.sub.U,R) and the corresponding total amount of payments Y from the surveillance database 101 and, at the same time, sends the data (X,N.sub.U,R) to the bank that issued the electronic cash. If Y+y<X, the control part 114 decides that the use of the electronic cash is proper, then records the data H in the history database 108, and updates the corresponding total amount of payments Y in the surveillance database 101 with the result of addition in the adding part 107. When Y+y=X, it means that all the face value X of the electronic cash is spent, and consequently, the management data (X,N.sub.U,R) and the corresponding total amount of payments Y are erased from the surveillance database 101.
For example, according to the Chaum et al. scheme, when the probability of success in overspending in the payment with electronic cash is 1/2.sup.30, processing needs to be performed 30 times, so that if the output size of the one-way function is assumed to be 128 bits, an amount of communication of at least (3.times.128.times.30)=11520 bits is required.
step (2) wherein said bank withdraws said amount X from said bank account of said user, generates a signature S.sub.B of said bank for information n including information of a user signature verification key N.sub.U and information of said amount X, sends the signature S.sub.B to said user, records said information n as management data n in a user database in correspondence with said user information U, and sends said management data n to said surveillance institution;
step (4) wherein said user pays an amount of money y to said shop, using information including a balance x, said amount X, said signature verification key N.sub.U and said signature S.sub.B as electronic cash C of said face value X and said shop receives said electronic cash C after verifying its validity;
step (4b) wherein said user generates his signature S.sub.U (e,y) for said amount of payment y and said challenge information e sent to him and sends said amount of payment y and said signature S.sub.U (e,y) of said user to said shop; and
step (4c) wherein said shop verifies the validity of said signature S.sub.B of said bank, verifies the validity of said signature S.sub.U (e,y) of said user by said verification key N.sub.U, and verifies that said amount of payment y is smaller than said balance x of said electronic cash, and if the results of any of said verifications are valid, said shop approves of the payment of said amount y with said electronic cash.
10. An electronic cash implementing method for an electronic cash system which is composed of a surveillance institution which keeps the issuance of electronic cash under surveillance, a bank which issues electronic cash, a user who uses electronic cash, and a shop which receives a payment with electronic cash, and wherein said surveillance institution makes public an encipher function E.sub.T and said bank makes public a bank signature verification key PK.sub.B, said method comprising:
step (1) wherein said user sends user information U and an amount of money X corresponding to the face value of electronic cash to said bank and requests the bank to withdraw said amount of money X from a bank account of said user, while at the same time said user enciphers information n including signature verification key N.sub.U to produce enciphered information E.sub.T (n) and sends said enciphered information E.sub.T (n) to said bank;
step (2) wherein said bank withdraws said amount of money X from said bank account of said user and sends said amount of money X and said enciphered information E.sub.T (n) to said surveillance institution, while at the same time said bank records said enciphered information E.sub.T (n) as management data in a user database in correspondence with said user information U;
step (3) wherein said surveillance institution deciphers said enciphered information E.sub.T (n) to obtain said information n and registers at least one of said information n and said enciphered information E.sub.T (n) as management data in a surveillance database in correspondence with a total amount of payments Y;
step (4) wherein said user requests said bank to attach a blind signature to said information n to obtain a bank signature S.sub.B of said bank for said amount of money X;
step (5) wherein said user pays an amount of money y to said shop, using, as electronic cash C of said face value X, second information including said bank signature S.sub.B, a balance x, said face value X and said user signature verification key N.sub.U and said shop receives said electronic cash C after verifying its validity;
step (5b) wherein said user generates a user signature S.sub.U (e,y) for said amount of payment y and said challenge information e sent to him and sends said electronic cash C={x,X,N.sub.U,S.sub.B } and information {y,S.sub.U (e,y)} to said shop; and
step (5c) wherein said shop verifies the validity of said bank signature S.sub.B by said bank signature verification key PK.sub.B and the validity of said user signature S.sub.U (e,y) by said user signature verification key N.sub.U, and if both of said signatures are valid, said shop approves of the payment of said amount y with said electronic cash.
step (7a) wherein said surveillance institution makes a check to see if said at least one of said information n and said enciphered information E.sub.T (n) obtainable from said communication data H has been registered as said management data in said surveillance database;
step (7b) wherein if said management data has been registered, said surveillance institution updates said total amount of payments Y corresponding to said at least one of said signature verification key information and said enciphered information E.sub.T (n) with Y+y;
step (7d) wherein if Y+y=X, said surveillance institution erases from said surveillance database said management data and said total amount of payments Y corresponding to said at least one of said information n and said enciphered information E.sub.T (n); and
step (7e) wherein when the result of any one of said checks is invalid, said surveillance institution decides that said user committed overspending, then erases from said surveillance database said management data corresponding to said at least one of said signature verification information and said enciphered information E.sub.T (n) and said corresponding total amount of payments Y, and sends said at least one of said information n and said enciphered information E.sub.T (n) to said bank to specify the name of an overspending user from said user database.
key generating means for generating a user signature key SK.sub.U;
memory means for storing electronic cash C containing a bank signature S.sub.B on information n, a balance x, an amount of money X and a signature verification key, N.sub.U, and said user signature key SK.sub.U, said information n including the amount of money X corresponding to a face value and said signature verification key N.sub.U;
signature generating means for attaching a signature to an amount of payment y and arbitrary challenge information e received from said shop by said user signature key SK.sub.U to generate a signature S.sub.U (e,y); and
a surveillance database wherein information n corresponding to each user possessing electronic cash issued thereto is registered as management data in correspondence with a total amount of payments Y, said information n including a user's signature verification key N.sub.U;
a history database for storing communication history data H which contains electronic cash C including a balance x, a face value amount of money X, a signature verification key N.sub.U and a bank signature S.sub.B on said information n, and an amount of payment y all received from said shop;
means for making a check to see if there has been registered in the surveillance database said management data n corresponding to said face value amount of money X and said signature verification key N.sub.U in said communication history data H and, if not, for deciding that the electronic cash paid to the shop is overspent electronic cash;
encipher means for enciphering information n including a signature verification key N.sub.U by a public encipher key PK.sub.T of said surveillance institution to generate enciphered information E.sub.T (n) and for sending said enciphered information E.sub.T (n) to said bank;
blind signature pre-processing means for pre-processing information n including said signature verification key N.sub.U to produce pre-processed signature verification key information F(n), said pre-processed signature verification key information F(n) being sent to said bank;
blind signature post-processing means for post-processing a blind signature Z(n) for said signature verification key information F(n) received from said bank to obtain a signature S.sub.B of said bank;
memory means for storing electronic cash C, said user signature key SK.sub.U and said public encipher key PK.sub.T of said surveillance institution, said electronic cash C containing a balance, on amount of money X, said signature verification key N.sub.U and said bank signature S.sub.B;
21. A surveillance institution apparatus for implementing an electronic cash system which is composed of a surveillance institution which keeps the issuance of electronic cash under surveillance, a bank which issues electronic cash, a user who uses electronic cash and a shop which receives a payment with electronic cash, and wherein said surveillance institution makes public an encipher function E.sub.T and said bank makes public a signature verification key PK.sub.B, said apparatus comprising:
a memory for storing a secret decipher key SK.sub.T for deciphering said public encipher function E.sub.T;
decipher means for deciphering, by using said secret decipher key SK.sub.T, enciphered information E.sub.T (n) for information n containing a signature verification key N.sub.U to obtain said information n as management data;
a history database for storing history data H which contains electronic cash C including a balance x, an amount of money X, a signature verification key N.sub.U and a bank signature S.sub.B on information n including said signature verification key N.sub.U, and an amount of payment y all received from said shop;
means for making a check to see if there has been registered in said surveillance database said management data n corresponding to said amount of money X and said signature verification key N.sub.U in said history data H and, if not, for deciding that the electronic cash paid to said shop is overspent electronic cash;
Patent number: 6003765
Inventor: Tatsuaki Okamoto (Yokosuka)
Application Number: 8/855,580
Current U.S. Class: Banking Systems (235/379); Inventory (235/385); Bill Preparation (705/34); 380/24; Particular Communication Feature (902/39)