# Mobile, Divisible, and Safe E-Cash System

Authors: Ting Huang
Journal: Mathematical Problems in Engineering
 (2021)

---

## Abstract

Mobile, divisible, and safe e-cash system adapts on mobile terminals for e-payment which can circulate in multiple banks. The usage of the divisible e-cash does not need pass bank, which the bank has not the bottleneck of e-business. The author’s thesis discusses on the withdrawal protocol, payment protocol, transferable protocol, deposit protocol, and update of e-cash, based on elliptic curve cryptography (ECC).The system is simple, efficient, secure, and fit for the mobile e-payment terminals in which storage, power, operand capacity, and network bandwidth supply are extraordinarily restricted. The system can protect from double spending, non-frameability, eavesdropping, tampering, and “perfect crime” effectively too. It can save from mis-identity attacks, two-layer anonymity attacks, and linking attacks.


---

## Body

## 1. Introduction

With the development of science and technology and the progress of society, e-cash began to enter people’s lives and gradually changed people’s consumption concept and mode. Compared with the traditional paper money, e-cash has the advantages of fast transmission, wide coverage, and convenient use, which has replaced the paper money with an irreversible trend. But the e-cash systems use online payment nowadays. The usage of every e-cash system must pass the bank [1]; thus, the bank has turned into the bottleneck of the payment. The e-cash [2] only circulates in a single bank, which cannot meet the needs of reality. The e-cash system [3] based on RSA encryption algorithm problem which needs exponentiation compute. The e-cash [4] cannot be circulated in user’s e-business. This paper researches on mobile, divisible, and safe e-cash system. The e-cash in this study is divisible, and the usage of the divisible e-cash system need not pass bank, which the bank has not the bottleneck of e-business. Meanwhile, the system can protect from double spending. ECC in this paper needs no exponentiation operation compared to RSA. The research effectively improves the efficiency and security of mobile e-cash system, which provides the theoretical basis and technical support for an electronic transaction system nowadays. In the system, the consumer can recover the lost money even if the phone has crashed and all the files are removed accidentally or the e-cash wallet has been lost. The e-cash in this study can circulate in all the banks, which can meet the needs of reality. The e-cash in this study can circulate in user’s e-business, which circulates any time offline between the users before getting saved in the bank. In comparison with the protocol in [5], the proposed protocol can protect from eavesdropping, tampering, and “perfect crime” effectively too. The e-cash in this study and its signatures cannot be forgery. It can save from mis-identity attacks, two-layer anonymity attacks, and linking attacks. The system is simple, efficient, secure, and fit for the mobile e-payment terminals in which storage, power, operand capacity, and network bandwidth supply are extraordinarily restricted. The e-cash in the system has a usage period. When the usage period ends, the bank will delete the e-cash. Thus, the storage space of the bank is saved.


## 2. Design of Protocol

### 2.1. Withdrawal Protocol

(1)
The user withdraws I yuan from thebankm. He takes a∈RZn and then computes δ=Ha+SKU. Next, he enters δ in the database, encrypts IDnU, δ, and ,I by the symmetric key, and sends them to the bankm.(2)
The bankm produces the e-cash: αI=HISKBm1+δSKBm2‖SKBm‖t1‖b and computes βI=HcGx‖αI‖t1‖I, γI=c+βISKBm, and b,c∈RZn.The bankm enters αI,b,δ,t1, in the database, encrypts IDnU, I, αI, βI, γI, and t1 and sends to the user.(3)
The user decrypts IDnU, I,αI, βI, γI, andt1 and saves them to the database.


### 2.2. Payment Protocol

The user pays the e-cash to the merchant0 by the credit center. First αi=Hb1‖t2‖SKU‖αI‖j‖i, βi=Hc1Gxαit2ji, γi=c1+βiSKU, b1,c1∈Zn, d,e1,e2∈Zn, d≠0, ε=Hαi, ε1=dIDnU−εe1, ε2=d−εe2, αi, βi, γi, i,j, t2, ε, ε1,ε2 are sent to the credit center. The e-cash cannot be used the next time. Then the credit center checks βi=?HγiG−βiPKU‖αi‖t2‖j‖i and saves i, αi, βi, γi, ε, ε1,ε2. It gets φ=Hi‖SKCPKMx and sends φ, NAU, and Timestamp to the merchant0. The merchant0 checks φ=?Hi‖PKCSKMx and then sends the goods to the user. The user receives the goods, gets f=HSKUPKCx, deletesαi, βi, γi, i, and sends f, merchant’s address, NAU, and timestamp to the credit center. The credit center checks f=?HSKCPKMx, comupters φ′=Hi‖SKCPKMx‖αi, and sends i, αi, NAU, f, ε, ε1, ε2, and timestamp to the merchant0. The merchant0 tests φ′=?HiSKMPKCxαi and saves αi, i, ε, ε1, ε2.The protocol that the merchant0 pays the e-cash to the merchanti (i  = 1, 2, …, n) or factory is the same as the payments that the user pays to merchant.


### 2.3. Transferable Protocol

The e-cash can circulate in the user’s e-business. First, the user1 computes ε=Hαi, ε1=dIDnU1−εe1, ε2=d−εe2, d, e1,e2∈Zn, d≠0, b1,c1∈Zn, αi=Hb1‖t3‖SKU1‖αI‖j‖i, βi=Hc1Gx‖αi‖t3‖j‖i,γi=c1+βiSKU1, and sends αi, βi, γi, i,j, t3, ε, ε1, and timestamp the e-cash cannot use again. Then the user 2 tests βi=?HγiG−βiPKU1‖αi‖t3‖j‖i and saves αi, βi, γi, i,j, t3, ε, ε1, ε2.


### 2.4. Deposit Protocol

When the person saves the e-cash to the bank, the bank must verify the correctness of the e-cash. The distributed bank must check whether the used e-cash is less than or equal to the distributed e-cash. If the used e-cash is more than the distributed e-cash, the bank can trace the person’s identification. When the person saves the e-cash to the bankn, the e-cash will save in the bankn; when the person saves the e-cash to the bankm (not the distributed bankn), the bankm will send the e-cash to the bankn. After the e-cash in the bankn is dealt well, the person finishes the deposit. The central bank that has the highest grade among banks can test the trading process of the bank to check the business errors and punishment them. Thus, the e-cash can circulate in all the banks, which can meet the needs of reality.


### 2.5. Update of the E-Cash

When the usage period of the e-cash is over, the person tells the bank and fetches the new e-cash.


## 2.1. Withdrawal Protocol

(1)
The user withdraws I yuan from thebankm. He takes a∈RZn and then computes δ=Ha+SKU. Next, he enters δ in the database, encrypts IDnU, δ, and ,I by the symmetric key, and sends them to the bankm.(2)
The bankm produces the e-cash: αI=HISKBm1+δSKBm2‖SKBm‖t1‖b and computes βI=HcGx‖αI‖t1‖I, γI=c+βISKBm, and b,c∈RZn.The bankm enters αI,b,δ,t1, in the database, encrypts IDnU, I, αI, βI, γI, and t1 and sends to the user.(3)
The user decrypts IDnU, I,αI, βI, γI, andt1 and saves them to the database.


## 2.2. Payment Protocol

The user pays the e-cash to the merchant0 by the credit center. First αi=Hb1‖t2‖SKU‖αI‖j‖i, βi=Hc1Gxαit2ji, γi=c1+βiSKU, b1,c1∈Zn, d,e1,e2∈Zn, d≠0, ε=Hαi, ε1=dIDnU−εe1, ε2=d−εe2, αi, βi, γi, i,j, t2, ε, ε1,ε2 are sent to the credit center. The e-cash cannot be used the next time. Then the credit center checks βi=?HγiG−βiPKU‖αi‖t2‖j‖i and saves i, αi, βi, γi, ε, ε1,ε2. It gets φ=Hi‖SKCPKMx and sends φ, NAU, and Timestamp to the merchant0. The merchant0 checks φ=?Hi‖PKCSKMx and then sends the goods to the user. The user receives the goods, gets f=HSKUPKCx, deletesαi, βi, γi, i, and sends f, merchant’s address, NAU, and timestamp to the credit center. The credit center checks f=?HSKCPKMx, comupters φ′=Hi‖SKCPKMx‖αi, and sends i, αi, NAU, f, ε, ε1, ε2, and timestamp to the merchant0. The merchant0 tests φ′=?HiSKMPKCxαi and saves αi, i, ε, ε1, ε2.The protocol that the merchant0 pays the e-cash to the merchanti (i  = 1, 2, …, n) or factory is the same as the payments that the user pays to merchant.


## 2.3. Transferable Protocol

The e-cash can circulate in the user’s e-business. First, the user1 computes ε=Hαi, ε1=dIDnU1−εe1, ε2=d−εe2, d, e1,e2∈Zn, d≠0, b1,c1∈Zn, αi=Hb1‖t3‖SKU1‖αI‖j‖i, βi=Hc1Gx‖αi‖t3‖j‖i,γi=c1+βiSKU1, and sends αi, βi, γi, i,j, t3, ε, ε1, and timestamp the e-cash cannot use again. Then the user 2 tests βi=?HγiG−βiPKU1‖αi‖t3‖j‖i and saves αi, βi, γi, i,j, t3, ε, ε1, ε2.


## 2.4. Deposit Protocol

When the person saves the e-cash to the bank, the bank must verify the correctness of the e-cash. The distributed bank must check whether the used e-cash is less than or equal to the distributed e-cash. If the used e-cash is more than the distributed e-cash, the bank can trace the person’s identification. When the person saves the e-cash to the bankn, the e-cash will save in the bankn; when the person saves the e-cash to the bankm (not the distributed bankn), the bankm will send the e-cash to the bankn. After the e-cash in the bankn is dealt well, the person finishes the deposit. The central bank that has the highest grade among banks can test the trading process of the bank to check the business errors and punishment them. Thus, the e-cash can circulate in all the banks, which can meet the needs of reality.


## 2.5. Update of the E-Cash

When the usage period of the e-cash is over, the person tells the bank and fetches the new e-cash.


## 3. Discussion of Safety and Efficiency

αi, βi, and γi are the right signatures of the e-cash i. Because γiG−βiPKU=c+βiSKUG−βiPKU=cG, βi=?HγiG−βiPKU‖αi‖t2‖j‖i is verified. The e-cash and its signatures cannot be forged.The e-cash and its signatures contain SK. Any attacker must gain SK so as to forge the e-cash and its signatures, which must solve ECDLP. ECDLP cannot be solved, so that the e-cash and its signatures cannot be forged. It can save from mis-identity attacks, two-layer anonymity attacks, and linking attacks. Therefore, the e-cash is safe and divisible.When the user pays the e-cash with valuei for the first time, the user sends αi=Hb1‖t2‖SKU‖αI‖i‖ii<I. The e-cash with value I-i can use next. When he pays the e-cash with value k for the second time, the user sends αi=Hb1‖t2‖SKU‖αI‖j‖kj=i+k. Similarly, the e-cash can be used repeatedly until j=I. Thus, the usage of the divisible e-cash need not pass bank, which the bank has not the bottleneck of e-business.


### 3.1. Non-Frameability

ε1=dIDnU−εe1, so the user’s identification is sent with the e-cash. Thus, illegal users cannot frame other users, due to the security against mis-identity attacks, two-layer anonymity attacks, and linking attacks.When a person uses the e-cash normally, his identity cannot be gained. However, the bank will trace the identity of the user when his e-cash is used repeatedly.If the person spends the e-cash repeatedly, the bank will find when his e-cash was deposited. Because b is not the same as different e-cash,ε=Hαi and αI=HISKBm1+δSKBm2‖SKBm‖t1‖b are different when the user’s demand is the same. When the person uses the same e-cash repeatedly, the bank will fetch the other (ε′, ε1′ , ε2′).d≠0, ε1′=dIDnU−ε′e1, and ε2′=d−ε′e2 .Thus, IDnU =  ε′ε1−εε1′/ε′ε2−εε2′ (mod n) =  ε′dIDnU−εdIDnU/ε′d−εd. The bank will check the user’s identity IDnU. Thus, the system can prevent from double spending. So the system is safe, and the bank must be reliable and safe.The anonymity and untraceability of signatures facilitate criminals to kidnap, launder, and extort money. So it is necessary to design a fair and controllable e-cash system. If he extorts money from the victim, the criminal can only ask the victim to transfer the money. After the victim transfers the e-cash, the criminal obtains the e-cash (I, αI, ε, ε1,ε2) and releases the victim. Then the victim can report to the bank that the e-cash (I, αI , ε , ε1 , ε2) is obtained by extorting means. When the criminal is spending the e-cash, the merchant can call the police and arrest the criminal. After the case is solved, the bank will return the recovered e-cash to the victim. The system can protect from non-frameability, eavesdropping, tampering, and “perfect crime” effectively. So the system is secure.The time of protocol realization and storage capacity in mobile, divisible, and safe e-cash systems are key to efficiency. 160b of ECC of the paper has the same function with 1024b of RSA [6]. The e-cash system [3] is based on RSA. ECC in the paper needs no exponentiation operation compared to RSA. The calculation of ECC is very little compared to RSA. Therefore the efficiency of the system runs faster. The e-cash of spending process [3] is S¯′,T¯′,R¯′,K^,S^,S^0,S1^,S2^,C∼,T∼,b,t,B1,D1,D2, π2 , the storage space of the e-cash is 1024∗10+128+1024∗5=15488 bit. While the e-cash of spending process in the paper is i, αi, βi, and γi, the storage space of the e-cash is 32 + 128 + 128 + 192 = 480 bit(The actual cost in the experimental system), which decreases 96.9% of the storage space and the network bandwidth. Therefore, the system is simple, efficient, and fit for the mobile e-payment terminals in which storage, power, operand capacity, and network bandwidth supply are extraordinarily restricted.The e-cash in the system has a usage period. When the usage period ends, the bank will delete the e-cash. Thus, the storage space is saved.The e-cash in the system can circulate in multiple banks, which does not confine to the bank that distributes the e-cash.The e-cash [1] is inseparable. When the user withdraws the money from the bank, he can only use the money at one time. The merchant has to deposit it in the bank to verify the authenticity. Therefore, the bank has become a bottleneck. The e-cash can be divided. After the user withdraws the money from the bank, he can spend several times without frequently looking for the bank to withdraw money. The merchant does not have to deposit every money that they receive into the bank for verification. When the merchant needs to deposit money, the bank will verify the authenticity of the cash and find out the illegal e-cash.The e-cash [4] cannot work between the users. However, the e-cash in the system can circulate any time offline between the users before getting saved in the bank.


## 3.1. Non-Frameability

ε1=dIDnU−εe1, so the user’s identification is sent with the e-cash. Thus, illegal users cannot frame other users, due to the security against mis-identity attacks, two-layer anonymity attacks, and linking attacks.When a person uses the e-cash normally, his identity cannot be gained. However, the bank will trace the identity of the user when his e-cash is used repeatedly.If the person spends the e-cash repeatedly, the bank will find when his e-cash was deposited. Because b is not the same as different e-cash,ε=Hαi and αI=HISKBm1+δSKBm2‖SKBm‖t1‖b are different when the user’s demand is the same. When the person uses the same e-cash repeatedly, the bank will fetch the other (ε′, ε1′ , ε2′).d≠0, ε1′=dIDnU−ε′e1, and ε2′=d−ε′e2 .Thus, IDnU =  ε′ε1−εε1′/ε′ε2−εε2′ (mod n) =  ε′dIDnU−εdIDnU/ε′d−εd. The bank will check the user’s identity IDnU. Thus, the system can prevent from double spending. So the system is safe, and the bank must be reliable and safe.The anonymity and untraceability of signatures facilitate criminals to kidnap, launder, and extort money. So it is necessary to design a fair and controllable e-cash system. If he extorts money from the victim, the criminal can only ask the victim to transfer the money. After the victim transfers the e-cash, the criminal obtains the e-cash (I, αI, ε, ε1,ε2) and releases the victim. Then the victim can report to the bank that the e-cash (I, αI , ε , ε1 , ε2) is obtained by extorting means. When the criminal is spending the e-cash, the merchant can call the police and arrest the criminal. After the case is solved, the bank will return the recovered e-cash to the victim. The system can protect from non-frameability, eavesdropping, tampering, and “perfect crime” effectively. So the system is secure.The time of protocol realization and storage capacity in mobile, divisible, and safe e-cash systems are key to efficiency. 160b of ECC of the paper has the same function with 1024b of RSA [6]. The e-cash system [3] is based on RSA. ECC in the paper needs no exponentiation operation compared to RSA. The calculation of ECC is very little compared to RSA. Therefore the efficiency of the system runs faster. The e-cash of spending process [3] is S¯′,T¯′,R¯′,K^,S^,S^0,S1^,S2^,C∼,T∼,b,t,B1,D1,D2, π2 , the storage space of the e-cash is 1024∗10+128+1024∗5=15488 bit. While the e-cash of spending process in the paper is i, αi, βi, and γi, the storage space of the e-cash is 32 + 128 + 128 + 192 = 480 bit(The actual cost in the experimental system), which decreases 96.9% of the storage space and the network bandwidth. Therefore, the system is simple, efficient, and fit for the mobile e-payment terminals in which storage, power, operand capacity, and network bandwidth supply are extraordinarily restricted.The e-cash in the system has a usage period. When the usage period ends, the bank will delete the e-cash. Thus, the storage space is saved.The e-cash in the system can circulate in multiple banks, which does not confine to the bank that distributes the e-cash.The e-cash [1] is inseparable. When the user withdraws the money from the bank, he can only use the money at one time. The merchant has to deposit it in the bank to verify the authenticity. Therefore, the bank has become a bottleneck. The e-cash can be divided. After the user withdraws the money from the bank, he can spend several times without frequently looking for the bank to withdraw money. The merchant does not have to deposit every money that they receive into the bank for verification. When the merchant needs to deposit money, the bank will verify the authenticity of the cash and find out the illegal e-cash.The e-cash [4] cannot work between the users. However, the e-cash in the system can circulate any time offline between the users before getting saved in the bank.


## 4. Conclusions

The mobile, divisible, and safe e-cash system adapts on mobile terminals for e-payment which can circulate in multiple banks. The usage of the divisible e-cash needs not pass bank, which the bank has not the bottleneck of e-business. Experimental tests have been made, which prove that the system is simple, efficient, security, and fit for the mobile e-payment terminals in which storage, power, operand capacity, and network bandwidth supply are extraordinarily restricted.



---

*Source: 5537965-2021-04-19.xml*