Electronic currency system, information processing device, method, and program

Abstract

An electronic currency system according to an aspect of the present disclosure includes: an information processing device that verifies electronic currency; and one or more user devices that use the electronic currency. The user device includes: an additional information generation unit that, upon receiving electronic currency information representing the electronic currency and a signature for the electronic currency information, generates additional information for the electronic currency information; a signature generation unit that generates a new signature on the basis of the additional information, the signature, and a private key of the user device; and a remittance unit that transmits, to a remittance destination, new electronic currency information in which the additional information is added to the electronic currency information, and the new signature. The information processing device includes a verification unit that, upon receiving the electronic currency information representing the electronic currency and the signature for the electronic currency information, verifies the signature on the basis of the electronic currency information and the signature.

Description

Electronic currency system, information processing device, method, and program

[0001] The present disclosure relates to an electronic currency system, an information processing device, a method, and a program.

[0002] Central bank digital currencies (CBDCs) are being considered around the world, and the Bank of Japan has stated that digital currencies must meet the following five characteristics: (1) universal access, (2) security, (3) resilience, (4) instantaneous settlement, and (5) interoperability. To meet the requirements of resilience and instantaneous settlement, the currency must be circulated through user-to-user settlement (offline settlement without a central server). Furthermore, because currency is subject to repeated transactions between users (transferability), transaction authentication and fraud traceability are essential from a security perspective.

[0003] Since it is difficult to detect tampering with offline digital currency, a method is known in which signatures are chained together to detect fraud and verified all at once at the time of deposit (Non-Patent Documents 1 and 2).

[0004] Okuda, et al., "Initial Study on Formal Verification Methods for Token-Based Electronic Cash Systems," Research Report, Electronic Intellectual Property and Infrastructure (EIP), 2022-EIP-98, 24, pp.1-8, 2022 / 12 / 15; Okuda, et al., "Considerations on Formal Verification of Double-Spending Detection and Privacy for Token-Based Electronic Cash Systems," Research Report, Computer Security (CSEC), 2023-CSEC-100, 66, pp.1-8, 2023 / 2 / 27

[0005] However, in the conventional technology, each signature needs to be verified, which poses a problem that the verification process takes time.

[0006] The present disclosure has been made in consideration of the above points, and aims to efficiently perform signature verification for detecting fraud in electronic currency.

[0007] An electronic currency system according to one aspect of the present disclosure is an electronic currency system that includes an information processing device that verifies electronic currency and one or more user devices that use the electronic currency, wherein the user device has an additional information generation unit that generates additional information for the electronic currency information when it receives electronic currency information representing the electronic currency and a signature for the electronic currency information, a signature generation unit that generates a new signature based on the additional information, the signature, and its own private key, and a remittance unit that transmits the new electronic currency information with the additional information added to the electronic currency information and the new signature to a remittance destination, and the information processing device has a verification unit that verifies the signature based on the electronic currency information and the signature when it receives electronic currency information representing the electronic currency and a signature for the electronic currency information.

[0008] Signature verification for detecting fraud in electronic currency can be performed efficiently.

[0009] FIG. 1 is a diagram showing an example of validity verification of electronic currency in the prior art. FIG. 2 is a diagram showing an example of validity verification of electronic currency in the proposed method. FIG. 3 is a diagram showing an example of the overall configuration of an electronic currency system according to the present embodiment. FIG. 4 is a diagram showing an example of the hardware configuration of a currency issuance and withdrawal device according to the present embodiment. FIG. 5 is a diagram showing an example of the hardware configuration of a user device according to the present embodiment. FIG. 6 is a diagram showing an example of the functional configuration of a user device according to the present embodiment. FIG. 7 is a flowchart showing an example of key generation processing of a currency issuance and withdrawal device according to the present embodiment. FIG. 8 is a flowchart showing an example of key generation processing of a user device according to the present embodiment. FIG. 9 is a sequence diagram showing an example of currency issuance processing according to the present embodiment. FIG. 10 is a sequence diagram showing an example of currency circulation processing according to the present embodiment. FIG. 11 is a sequence diagram showing an example of currency withdrawal processing according to the present embodiment.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Verifying the Validity of Electronic Currency in Prior Art> Hereinafter, electronic currency will also be referred to simply as "currency." In addition, hereinafter, it is assumed that a central bank issues currency, and that the central bank is the zeroth holder of the currency (hereinafter referred to as "holder 0"). Furthermore, the i-th (i≧1) user of the currency (e.g., a commercial bank, a store, a company, an ordinary consumer, etc.) will be referred to as "user i," and user i will also be the i-th holder of the currency (hereinafter also referred to as "holder i").

[0012] When a currency is issued, the central bank sends a message M ０ and generates a message M ０ and its signature σ ０ and is sent to user 1. Here, message M ０ The verification key vk of the user 1 who is the remittance destination is included in the １ etc. Note that the message M ０ is also called a "token".

[0013] When currency is circulated, a user i (i≧1) sends a message M ｉ and its signature σ ｉ and generate ((M ０ , σ ０ ), (M １ , σ １ ), ..., (M ｉ－１ , σ ｉ－１ )) to (M ｉ , σ ｉ ) and then transmits it to the next user i+1. ｉ The verification key vk of the next user i+1 to whom the remittance is to be made is ｉ＋１ , message M ｉ－１ and signature σ ｉ－１ The hash value H(M ｉ－１ , σ ｉ－１ ) and so on. As a result, the i+1th owner i+1 can ０ , σ ０ ), (M １ , σ １ ), ..., (M ｉ , σ ｉ)) format of electronic currency. ｉ H (M ｉ－１ , σ ｉ－１ ) is included, so each M ｉ It can be said that this represents transaction information up to now.

[0014] In addition, the verification key vk ｉ (i≧0) is (M ｉ , σ ｉ ) and is public information.

[0015] In this case, if holder n+1 is a central bank (i.e., for example, when the currency is withdrawn), the central bank verifies the validity of the currency. Verification of the validity of electronic currency in conventional technology, including the technology described in Non-Patent Document 2, will be described with reference to Figure 1. Figure 1 is a diagram showing an example of verification of the validity of electronic currency in conventional technology.

[0016] As shown in FIG. 1, in the prior art, ０ , σ ０ ), (M １ , σ １ ), ..., (M ｎ , σ ｎ Each (M ｉ , σ ｉ ) are the verification keys vk ｉ By verifying this, it is possible to check whether there are any fraudulent transactions (in other words, ｉ In addition, if duplicate currency is issued or transferred, it is possible to identify the fraudulent user who issued or transferred the duplicate currency.

[0017] On the other hand, in the prior art, each (M ｉ , σ ｉ ) are the verification keys vk ｉ That is, for example, (M ｉ , σ ｉ ) takes an average of T time to verify, then T×n time is required.

[0018] <Proposed Method> Below, we propose a method (hereinafter also referred to as the "proposed method") that can efficiently verify the legitimacy of currency.

[0019] The proposed method makes it possible to efficiently verify the legitimacy of currency by performing signature verification in one go using a signature method called HF-SAS (History-Free Sequential Aggregate Signature).

[0020] <HF-SAS> HF-SAS is composed of a key generation algorithm KeyGen, a signature generation algorithm AggSign, and a signature verification algorithm AggVerify. For details of HF-SAS, see, for example, Reference 1.

[0021] KeyGen (1 λ ) → (vk, sk): The key generation algorithm KeyGen uses security parameters 1 λ It takes as input a key pair of a verification key vk and a secret key sk and outputs it.

[0022] AggSign(sk ｉ , M ｉ , Σ ｉ－１ ) →Σ ｉ : The signature generation algorithm AggSign uses the private key sk of the holder i ｉ and message M ｉ and the signature of holder i-1 Σ ｉ－１ and the signature Σ ｉ where Σ ｉ is Σ －１ , Σ ０ , ..., Σ ｉ－１ It is also called an aggregate signature. －１ is Σ －１ =φ.

[0023] AggVerify(L ｎ , Σ ｎ ) → 0 / 1: The signature verification algorithm AggVerify is ｎ = {vk ｉ , M ｉ} ｉ＝０，・・・，ｎ and signature Σ ｎIt receives the inputs and outputs 0 indicating successful verification or 1 indicating unsuccessful verification.

[0024] <Verifying the validity of electronic currency in the proposed method> In the proposed method, when currency is circulated, a user i (i≧1) sends a message M ｉ And message M ｉ and signature Σ ｉ－１ Signature for Σ ｉ and (M ０ , M １ , ..., M ｉ－１ ) to the message M ｉ and signature Σ ｉ Then, the message M is sent to the next user i+1. ｉ The verification key vk of the next user i+1 is ｉ＋１ , message M ｉ－１ The hash value H(M ｉ－１ ) and so on. As a result, the i+1th owner i+1 can ０ , M １ , ..., M ｉ , Σ ｉ ) form of electronic currency. ｉ H (M ｉ－１ ) is included, so each M ｉ It can be said that this represents transaction information up to now.

[0025] In this case, if the holder n+1 is a central bank (i.e., for example, when the currency is withdrawn), the central bank verifies the validity of the currency. Verification of the validity of electronic currency in the proposed method will be explained with reference to Figure 2. Figure 2 is a diagram showing an example of verification of the validity of electronic currency in the proposed method.

[0026] As shown in Figure 2, in the proposed method, (M ０ , M １ , ..., M ｎ , Σ ｎ ) contained in the aggregate signature Σ ｎ By verifying the ｉIt is also possible to check whether the currency has been tampered with or not. In addition, if currency is issued or transferred in duplicate, it is also possible to identify the fraudulent user who issued or transferred the currency in duplicate.

[0027] In this way, in the proposed method, the aggregate signature Σ ｎ By verifying the above, signature verification can be performed in one go, which makes it possible to significantly reduce the verification time and realizes efficient signature verification.

[0028] The following describes an electronic currency system 1 that can verify the validity of electronic currency using the above-mentioned proposed method.

[0029] <Overall Configuration Example> An overall configuration example of the electronic currency system 1 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the overall configuration of the electronic currency system 1 according to this embodiment.

[0030] 3, the electronic currency system 1 according to this embodiment includes a currency issuance and withdrawal device 10 and a plurality of user devices 20. Here, the currency issuance and withdrawal device 10 and each user device 20 are communicatively connected via a communication network 30 including, for example, the Internet. However, for example, only some of the plurality of user devices 20 may be communicatively connected to the currency issuance and withdrawal device 10.

[0031] The currency issuing and withdrawing device 10 is a computer (information processing device) or computer system (information processing system) managed by a bank that issues and withdraws currency. In the following description, currency is issued and withdrawn by a central bank, but currency may be issued and withdrawn by a bank other than a central bank. Banks that issue and withdraw currency are called "issuing banks" or the like.

[0032] The user device 20 is a computer (information processing device) or computer system (information processing system) used or managed by a user (i.e., a person who conducts transactions using currency). Transactions using currency involve the sending and receiving of currency, and a user who sends currency is also called a "sender" or "remitter," and a user who receives currency is also called a "receiver" or "recipient." Examples of users include financial institutions such as commercial banks, stores, companies, and general consumers. Examples of transactions using currency include lending or withdrawing currency from an issuing bank to a financial institution such as a commercial bank, depositing currency from a financial institution such as a commercial bank to an issuing bank, withdrawing currency from a financial institution other than the issuing bank (e.g., a commercial bank), depositing currency to a financial institution other than the issuing bank (e.g., a commercial bank), and commercial transactions using currency.

[0033] Hereinafter, the user device 20 used or managed by user i (owner i) will be referred to as "user device 20 ｉ " will also be expressed as ".

[0034] 3 is an example, and the overall configuration of the electronic currency system 1 is not limited to this. For example, in addition to the currency issuing / returning device 10 and the user device 20, various other devices and equipment may be included.

[0035] <Hardware Configuration Example> <Currency Issuance and Refund Device 10> An example of the hardware configuration of the currency issuance and refund device 10 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the hardware configuration of the currency issuance and refund device 10 according to this embodiment.

[0036] 4, the currency issuance and withdrawal device 10 according to this embodiment includes an input device 11, a display device 12, an external I / F 13, a communication I / F 14, a RAM (Random Access Memory) 15, a ROM (Read Only Memory) 16, an auxiliary storage device 17, and a processor 18. Each of these pieces of hardware is communicatively connected via a bus 19.

[0037] The input device 11 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 12 is, for example, a display, a display panel, etc. Note that the currency issuance and withdrawal device 10 does not necessarily have to have at least one of the input device 11 and the display device 12, for example.

[0038] The external I / F 13 is an interface with an external device such as a recording medium 13 a. Examples of the recording medium 13 a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0039] The communication I / F 14 is an interface for connecting to the communication network 30. The RAM 15 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 16 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 17 is a non-volatile storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 18 is a variety of arithmetic devices such as a CPU (Central Processing Unit).

[0040] 4 is an example, and the hardware configuration of the currency issuing and withdrawing device 10 is not limited to this. For example, the currency issuing and withdrawing device 10 may have multiple auxiliary storage devices 17 or multiple processors 18, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0041] <User Device 20> An example of the hardware configuration of the user device 20 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the hardware configuration of the user device 20 according to this embodiment.

[0042] 5, the user device 20 according to this embodiment includes an input device 21, a display device 22, an external I / F 23, a communication I / F 24, a RAM 25, a ROM 26, an auxiliary storage device 27, and a processor 28. Each of these pieces of hardware is connected to each other via a bus 29 so as to be able to communicate with each other.

[0043] The input device 21 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 22 is, for example, a display, a display panel, etc. Note that the user device 20 may not have at least one of the input device 21 and the display device 22, for example.

[0044] The external I / F 23 is an interface with an external device such as a recording medium 23a, etc. Examples of the recording medium 23a include a CD, a DVD, an SD memory card, and a USB memory card.

[0045] The communication I / F 24 is an interface for connecting to the communication network 30. The RAM 25 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 26 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 27 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 28 is, for example, a CPU or other type of computing device.

[0046] 5 is an example, and the hardware configuration of the user device 20 is not limited to this. For example, the user device 20 may have multiple auxiliary storage devices 27 or multiple processors 28, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0047] <Functional Configuration Example> <Currency Issuance and Refund Device 10> An example of the functional configuration of the currency issuance and refund device 10 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the currency issuance and refund device 10 according to this embodiment.

[0048] As shown in FIG. 6 , the currency issuance / refund device 10 according to this embodiment includes a key generation unit 101, a currency issuance unit 102, a signature generation unit 103, a remittance unit 104, a remittance request unit 105, a currency storage unit 106, and a verification unit 107. Each of these units is implemented, for example, by a processor 18 or the like executing one or more programs installed in the currency issuance / refund device 10. The currency issuance / refund device 10 according to this embodiment also includes a key storage unit 108 and a refund currency storage unit 109. Each of these storage units is implemented, for example, by a storage area of ​​the auxiliary storage device 17 or the like. However, at least one of the key storage unit 108 and the refund currency storage unit 109 may be implemented by a storage area of ​​a storage device (e.g., a storage device provided in a database server) communicatively connected to the currency issuance / refund device 10.

[0049] The key generation unit 101 generates a key pair (vk) of the verification key and the private key of the holder 0 by the key generation algorithm KeyGen. ０ , sk ０ ) to generate the

[0050] When issuing currency, the currency issuing unit 102 issues the currency to the user device 20 of the holder 1. １ In response to a remittance request from ０ where message M ０ The verification key vk of the holder 1 to be the remittance destination is included in the １ etc. are included.

[0051] The signature generation unit 103 generates an aggregate signature Σ using the signature generation algorithm AggSign. ０ Generate.

[0052] The remittance unit 104 is a user device 20 that is the holder 1. １ For (M ０ , Σ ０ ) in the remittance response.

[0053] When the currency is to be withdrawn, the remittance request unit 105 requests the user device 20 of the holder n to ｎ The remittance request includes the verification key vk ０ Includes:

[0054] The currency storage unit 106 stores (M ０ , M １ , ..., M ｎ , Σ ｎ ) is sent to the user device 20 of the holder n. ｎ When received from (M ０ , M １ , ..., M ｎ , Σ ｎ ) is stored in the refund currency storage unit 109.

[0055] The verification unit 107 verifies the signature stored in the refund currency storage unit 109 (M ０ , M １ , ..., M ｎ , Σ ｎ ) contained in the aggregate signature Σ ｎ Verify.

[0056] The key storage unit 108 stores the key pair (vk ０ , sk ０ ) is memorized.

[0057] The refunded currency storage unit 109 stores the (M ０ , M １ , ..., M ｎ , Σ ｎ ) is memorized.

[0058] <User Device 20> An example of the functional configuration of the user device 20 according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of the functional configuration of the user device 20 according to this embodiment.

[0059] As shown in FIG. 7 , the user device 20 according to this embodiment includes a key generation unit 201, a remittance request unit 202, a currency storage unit 203, an additional information generation unit 204, a signature generation unit 205, and a remittance unit 206. Each of these units is implemented, for example, by a processor 28 or the like executing one or more programs installed in the user device 20. The user device 20 according to this embodiment also includes a key storage unit 207 and a currency storage unit 208. Each of these storage units is implemented, for example, by a storage area of ​​the auxiliary storage device 27 or the like. However, at least one of the key storage unit 207 and the currency storage unit 208 may be implemented by a storage area of ​​a storage device (e.g., a storage device provided in a database server) communicatively connected to the user device 20.

[0060] The key generation unit 201 generates a key pair (vk) of a verification key and a private key of the holder i who uses or manages the user device 20 using a key generation algorithm KeyGen. ｉ , sk ｉ ) to generate the

[0061] The remittance request unit 202 is connected to the currency issuing and withdrawing device 10 of holder 0 and the user device 20 of holder i-1. ｉ－１ The remittance request includes the verification key vk ｉ Includes:

[0062] The currency storage unit 203 stores (M ０ , M １ , ..., M ｉ－１ , Σ ｉ－１ ) is transmitted to the currency issuing / receiving device 10 or the user device 20. ｉ－１ When received from (M ０ , M １ , ..., M ｉ－１ , Σ ｉ－１ ) is stored in the currency storage unit 208.

[0063] The additional information generating unit 204 generates the additional information for the currency issuing and withdrawing device 10 and the user device 20 that are holder i+1. ｉ＋１ In response to a remittance request from ｉ Here, the message M ｉ The verification key vk of the next owner i+1 is ｉ＋１, message M ｉ－１ The hash value H(M ｉ－１ ) etc.

[0064] The signature generation unit 205 generates an aggregate signature Σ using the signature generation algorithm AggSign. ｉ Generate.

[0065] The remittance unit 206 is a device for issuing and withdrawing currency 10 and a user device 20 that are holders i+1. ｉ＋１ In contrast, (M ０ , M １ , ..., M ｉ , Σ ｉ ) in the remittance response.

[0066] The key storage unit 207 stores the key pair (vk ｉ , sk ｉ ) is memorized.

[0067] The currency storage unit 208 stores the currency (M ０ , M １ , ..., M ｉ－１ , Σ ｉ－１ ) is memorized.

[0068] <Example of processing executed by electronic currency system 1> <Key generation processing of currency issuance and withdrawal device 10> The key generation processing of the currency issuance and withdrawal device 10 according to this embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the key generation processing of the currency issuance and withdrawal device 10 according to this embodiment.

[0069] The key generation unit 101 of the currency issuing and withdrawing device 10 generates KeyGen(1 λ ) → (vk ０ , sk ０ ) to generate a key pair (vk ０ , sk ０ ) is generated (step S101).

[0070] The key generation unit 101 of the currency issuing and withdrawing device 10 generates the key pair (vk ０ , sk ０ ) is stored in the key storage unit 108 (step S102).

[0071] <Key Generation Process of User Device 20> The key generation process of the user device 20 according to this embodiment will be described with reference to Fig. 9. Fig. 9 is a flowchart showing an example of the key generation process of the user device 20 according to this embodiment. In the following, ｉ The key generation process executed by will now be described.

[0072] User device 20 ｉ The key generation unit 201 of λ ) → (vk ｉ , sk ｉ ) to generate a key pair (vk ｉ , sk ｉ ) is generated (step S201).

[0073] User device 20 ｉ The key generation unit 201 of the ｉ , sk ｉ ) is stored in the key storage unit 207 (step S202).

[0074] <<Currency Issuance Processing>> The currency issuance processing according to this embodiment will be described with reference to Fig. 10. Fig. 10 is a sequence diagram showing an example of the currency issuance processing according to this embodiment.

[0075] User device 20 １ The remittance request unit 202 of １ The remittance request including the above is sent to the currency issuing and withdrawing device 10 (step S301).

[0076] The currency issuing unit 102 of the currency issuing and refunding device 10 receives the verification key vk １ When a remittance request containing ０ (Step S302). ０ The currency ID, currency denomination, and other currency information, a verification key vk １ etc. are included.

[0077] The signature generation unit 103 of the currency issuing and withdrawing device 10 generates AggSign(sk ０ , M ０ , Σ －１ ) →Σ０ By using the aggregate signature Σ ０ (Step S303). －１ =φ.

[0078] The remittance unit 104 of the currency issuing and withdrawing device 10 ０ , Σ ０ ) is transmitted to the user device 20 １ (step S304).

[0079] User device 20 １ The currency storage unit 203 of (M ０ , Σ ０ ), the remittance response containing ０ , Σ ０ ) is stored in the currency storage unit 208 (step S305).

[0080] <Currency Circulation Processing> The currency circulation processing according to this embodiment will be described with reference to FIG. 11. FIG. 11 is a sequence diagram showing an example of the currency circulation processing according to this embodiment. Note that the user device 20 ｉ The currency storage unit 208 of ０ , M １ , ..., M ｉ－１ , Σ ｉ－１ ) is stored.

[0081] User device 20 ｉ＋１ The remittance request unit 202 of ｉ＋１ The remittance request including the ｉ (step S401).

[0082] User device 20 ｉ The additional information generating unit 204 generates the verification key vk ｉ＋１ When a remittance request including the message M ｉ (Step S402). ｉ The verification key vk ｉ＋１ , message M ｉ－１ The hash value H(M ｉ－１ ) etc.

[0083] User device 20 ｉThe signature generation unit 205 of ｉ , M ｉ , Σ ｉ－１ ) →Σ ｉ By using the aggregate signature Σ ｉ is generated (step S403).

[0084] User device 20 ｉ The remittance unit 206 of (M ０ , M １ , ..., M ｉ , Σ ｉ ) is transmitted to the user device 20 ｉ＋１ (step S404).

[0085] User device 20 ｉ＋１ The currency storage unit 203 of (M ０ , M １ , ..., M ｉ , Σ ｉ ), the remittance response containing ０ , M １ , ..., M ｉ , Σ ｉ ) is stored in the currency storage unit 208 (step S405).

[0086] <Currency Refund Process> The currency refund process according to this embodiment will be described with reference to FIG. 12. FIG. 12 is a sequence diagram showing an example of the currency refund process according to this embodiment. Note that the user device 20 ｎ The currency storage unit 208 of ０ , M １ , ..., M ｎ－１ , Σ ｎ－１ ) is stored.

[0087] The remittance request unit 105 of the currency issuing and withdrawing device 10 uses its own verification key vk ０ The remittance request including the ｎ (step S501).

[0088] User device 20 ｎ The additional information generating unit 204 generates the verification key vk ０ When a remittance request including the message M ｎ is generated (step S502).

[0089] User device 20 ｎ The signature generation unit 205 of ｎ , M ｎ , Σ ｎ－１ ) →Σ ｎ By using the aggregate signature Σ ｉ is generated (step S503).

[0090] User device 20 ｎ The remittance unit 206 of (M ０ , M １ , ..., M ｎ , Σ ｎ ) is sent to the currency issuing and withdrawing device 10 (step S504).

[0091] The currency storage unit 106 of the currency issuing and withdrawing device 10 stores (M ０ , M １ , ..., M ｎ , Σ ｎ ) is sent to the user device 20 of the holder n. ｎ When received from (M ０ , M １ , ..., M ｎ , Σ ｎ ) is stored in the refund currency storage unit 109 (step S505).

[0092] The verification unit 107 of the currency issuing and withdrawing device 10 executes AggVerify(L ｎ , Σ ｎ ) by (M ０ , M １ , ..., M ｎ , Σ ｎ ) contained in the aggregate signature Σ ｎ is verified (step S506). ｎ = {vk ｉ , M ｉ} ｉ＝０，・・・，ｎ Furthermore, if 0 is output as the verification result of the signature verification algorithm AggVerify, it means that the verification is successful, and if 1 is output, it means that the verification is unsuccessful.

[0093] Note that step S506 can be executed at any timing after step S505 has been executed.

[0094] <Summary> As described above, the electronic currency system 1 according to this embodiment uses HF-SAS as a method for the holder of electronic currency to generate a signature. This allows the currency issuing and withdrawing device 10 to verify the legitimacy of the electronic currency (each M ｉ When verifying the signature (e.g., whether the signature has been tampered with), only the aggregate signature needs to be verified, which significantly reduces the time required for the verification process and improves the efficiency of signature verification.

[0095] Note that the HF-SAS may be an HF-SAS based on quantum-resistant cryptography. By using an HF-SAS based on quantum-resistant cryptography, it becomes possible to generate aggregate signatures that are resistant to attacks using quantum computers.

[0096] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0097] [References] Reference 1: Alessio Meneghetti and Edoardo Signorini: History-Free Sequential Aggregate Signatures from Generic Trapdoor Functions. IACR Cryptol. ePrint Arch. 2023: 784 (2023)

[0098] 1 Electronic currency system 10 Currency issuance and withdrawal device 11 Input device 12 Display device 13 External I / F 13a Recording medium 14 Communication I / F 15 RAM 16 ROM 17 Auxiliary storage device 18 Processor 19 Bus 20 User device 21 Input device 22 Display device 23 External I / F 23a Recording medium 24 Communication I / F 25 RAM 26 ROM 27 Auxiliary storage device 28 Processor 29 Bus 30 Communication network 101 Key generation unit 102 Currency issuance unit 103 Signature generation unit 104 Remittance unit 105 Remittance request unit 106 Currency storage unit 107 Verification unit 108 Key storage unit 109 Remitted currency storage unit 201 Key generation unit 202 Remittance request unit 203 Currency storage unit 204 Additional information generation unit 205 Signature generation unit 206 Remittance unit 207 Key storage unit 208 Currency storage unit

Claims

1. An electronic currency system including an information processing device that verifies electronic currency and one or more user devices that use the electronic currency, wherein the user devices have: an additional information generation unit that, upon receiving electronic currency information representing the electronic currency and a signature for the electronic currency information, generates additional information for the electronic currency information; a signature generation unit that generates a new signature based on the additional information, the signature, and its own private key; and a remittance unit that transmits the new electronic currency information with the additional information added to the electronic currency information and the new signature to a remittance destination, and the information processing device has: a verification unit that, upon receiving electronic currency information representing the electronic currency and a signature for the electronic currency information, verifies the signature based on the electronic currency information and the signature.

2. The electronic currency system of claim 1, wherein the signature generation unit generates a new signature by aggregating the signatures using HF-SAS (History-Free Sequential Aggregate Signature).

3. The electronic currency system of claim 2, wherein the electronic currency information includes a message containing currency information of the electronic currency and a verification key for the next remittance destination, and a message representing additional information containing the verification key for the next remittance destination, and the verification unit verifies the signature using HF-SAS based on the message and verification key contained in the electronic currency information and the signature.

4. An information processing device for verifying electronic currency, comprising: a verification unit that, upon receiving electronic currency information representing the electronic currency and an aggregate signature generated for the electronic currency information using an HF-SAS signature generation algorithm, verifies the aggregate signature using the HF-SAS signature verification algorithm based on the electronic currency information and the aggregate signature.

5. A method used in an electronic currency system including an information processing device that verifies electronic currency and one or more user devices that use the electronic currency, wherein the user device, upon receiving electronic currency information representing the electronic currency and a signature for the electronic currency information, executes an additional information generation procedure that generates additional information for the electronic currency information, a signature generation procedure that generates a new signature based on the additional information, the signature, and its own private key, and a remittance procedure that sends the new electronic currency information with the additional information added to the electronic currency information and the new signature to a remittance destination; and the information processing device, upon receiving electronic currency information representing the electronic currency and a signature for the electronic currency information, executes a verification unit that verifies the signature based on the electronic currency information and the signature.

6. A program that causes a computer to function as an information processing device or user device included in the electronic currency system described in any one of claims 1 to 3.

Images