Electronic currency system, remittance device, remittance method, and program

Abstract

In this electronic currency system including a remittance device which is a remittance source of electronic currency and a deposit device which is a remittance destination of the electronic currency, the remittance device comprises: a message reception unit configured to receive a message including a random number generated for each remittance from the deposit device; an addition unit configured to add additional information including the random numbers and an electronic signature for the random numbers using the secret key of the remittance device to the electronic currency; and a currency transmission unit configured to transmit the electronic currency having the additional information added thereto to the attachment device. As a result, it is possible to identify the timing of unauthorized used of the electronic currency.

Description

Electronic currency system, remittance device, remittance method and program

[0001] The present invention relates to an electronic currency system, a remittance device, a remittance method, and a program.

[0002] Consideration of CBDC (Central Bank Digital Currency) is underway in various countries around the world, and the Bank of Japan has stated that digital currency must have the following characteristics:

[0003] (1) Universal access (2) Security (3) Robustness (4) Instantaneous settlement (5) Interoperability To meet the requirements of robustness and instantaneous settlement, the currency must be circulated through user-to-user settlement (offline settlement without the mediation of a central server). Furthermore, because currency has the property of being traded between users multiple times (transferability), authentication of transaction and traceability of fraud are essential from a security perspective.

[0004] Since it is difficult to detect tampering with offline digital currencies, a known method is to chain signatures to detect fraud and verify them all at once when making a deposit.

[0005] Okuda, et al., "Initial Study on Formal Verification Methods for Token-Based Electronic Cash Systems," Research Report, Electronic Intellectual Property and Infrastructure (EIP), 2022-EIP-98, 24, pp.1-8, 2022 / 12 / 15; Okuda, et al., "Considerations on Formal Verification of Double-Spending Detection and Privacy for Token-Based Electronic Cash Systems," Research Report, Computer Security (CSEC), 2023-CSEC-100, 66, pp.1-8, 2023 / 2 / 27

[0006] However, conventional technology has the problem that it is difficult to identify the timing of fraud (double spending) when the same currency is duplicated and sent to the same user. In particular, when multiple users collude, the more users who collude, the more difficult it becomes.

[0007] The present invention has been made in view of the above points, and has as its object to make it possible to identify the timing at which electronic currency has been used fraudulently.

[0008] In order to solve the above problem, in an electronic currency system including a remittance device which is the source of remittance of electronic currency and a remittance receiving device which is the destination of remittance of the electronic currency, the remittance device has a message receiving unit configured to receive a message including a random number generated for each remittance from the remittance receiving device, an addition unit configured to add additional information to the electronic currency including the random number and an electronic signature for the random number using the private key of the remittance device, and a currency sending unit configured to send the electronic currency with the additional information added to the remittance receiving device.

[0009] It is possible to identify when electronic currency has been misused.

[0010] Fig. 1 is a diagram showing an example of the configuration of an electronic currency system in an embodiment of the present invention. Fig. 2 is a diagram showing an example of the hardware configuration of a user device 10 in an embodiment of the present invention. Fig. 3 is a diagram showing an example of the functional configuration of an electronic currency system in an embodiment of the present invention. Fig. 4 is a sequence diagram for explaining an example of the processing procedure executed when remitting currency. Fig. 5 is a diagram showing an example of the state of currency that has been double-used. Fig. 6 is a flowchart for explaining an example of the processing procedure executed by the issuing bank server 20 when withdrawing.

[0011] An embodiment of the present invention will now be described with reference to the accompanying drawings. FIG. 1 is a diagram showing an example of the configuration of an electronic currency system according to an embodiment of the present invention. In FIG. 1, the electronic currency system includes an issuing bank server 20 and multiple user devices 10. The issuing bank server 20 and each user device 10 are connected via a network such as the Internet (whether wired or wireless). Note that only some of the user devices 10 may be able to communicate with the issuing bank server 20.

[0012] The issuing bank server 20 is one or more computers managed by an issuing bank that issues electronic currency (hereinafter simply referred to as "currency"). The issuing bank server 20 issues currency and accepts currency withdrawals.

[0013] The user device 10 is a computer used by a user of the currency. For example, a server computer, a PC, a tablet terminal, a smartphone, or the like may be used as the user device 10.

[0014] A currency user is any person (individual or organization) who sends or receives currency during the currency circulation process. Examples of users include financial institutions other than the issuing bank (e.g., commercial banks), companies, stores, and general consumers.

[0015] Each user device 10 acts as a remitter or a remittance destination depending on the situation of the transaction using the currency. The remitter is the party that sends the currency, and the remittance destination is the party that receives the currency.

[0016] Remittances include, for example, withdrawals from financial institutions other than the issuing bank (for example, commercial banks), deposits to financial institutions, and payments in commercial transactions.

[0017] For example, in the case of a withdrawal from a financial institution, the user device 10 managed by the financial institution is the sender, and the user device 10 used by the person receiving the withdrawn currency is the recipient. In the case of a deposit at a financial institution, the user device 10 used by the person depositing currency at the financial institution is the sender, and the user device 10 managed by the financial institution is the recipient. In the case of a payment, the user device 10 used by the person making the payment (the purchaser of a product or service) is the sender, and the user device 10 used by the person receiving the payment (the seller of a product or service) is the recipient. In this way, the sender and the recipient have a relative relationship. In other words, a user device 10 used by a user of an electronic currency system can be the sender in one transaction and the recipient in another transaction.

[0018] In this embodiment, the basic protocol for currency circulation (hereinafter referred to as the "basic protocol") conforms to "4. Protocol to be verified" in Non-Patent Document 1 and Non-Patent Document 2. A pair of public and private keys is issued to the issuing bank server 20 and each user in advance, and the issuing bank server 20 and each user device 10 store the pair of public and private keys.

[0019] An outline of the basic protocol that is a prerequisite for this embodiment will be described.

[0020] Currency is issued by the issuing bank server 20. Issuing currency means newly generating a token (data) as currency. In this embodiment, currency at the time of issuance (immediately after issuance) is called T ０ In the basic protocol, T ０ has the following structure:

[0021] T ０ :=(id, v, y, pkU, S ０ ) In other words, T ０ , d, v, y, pkU ｉ , and S ０ id is the currency ID. The currency ID is a unique value for each currency. v is the face value of the currency. The face value of the currency may be the smallest unit (for example, 1 yen) or may be different for each currency. y is the year of issue of the currency. pkU ｉ is the public key of the user to whom the currency is issued. The currency is issued to, for example, a financial institution. S ０ is (id, v, y, pkU ｉ ) using the private key of the issuing bank server 20 (hereinafter simply referred to as "signature").

[0022] The issued currency is transferred from the user device 10 as the remitter to the user device 10 as the recipient in accordance with the transaction. In the basic protocol, when a certain currency is transferred from the user device 10 of user i (hereinafter referred to as "user device 10i") to the user device 10 of user i+1 (hereinafter referred to as "user device 10i+1"), (pkU ｉ＋１ , S ｉ ) (hereinafter referred to as "additional information") is added (recorded) to the currency by the remitter's user device 10i.

[0023] Here, pkU ｉ＋１ is the public key of the user device 10i+1, which is the remittance destination. ｉ , pkU ｉ＋１ is a signature of the sender user i using the private key of the hash value of

[0024] Additional information from the first remittance immediately after issuance １ The n-th additional information is t ｎ Then, a currency that has been transferred n times since its issuance has the following structure:

[0025] {T ０ , t １ , ..., t ｎ－１ , t ｎ In this way, additional information is added to the currency every time a remittance is made. In the following, we will refer to the currency T after n (n≧0) remittances have been made (i.e., n pieces of additional information have been added). ０ Simply change it to T ｎ It is written as follows.

[0026] 2 is a diagram showing an example of the hardware configuration of a user device 10 according to an embodiment of the present invention. The user device 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, all of which are interconnected via a bus B.

[0027] A program that realizes processing on the user device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101, but may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc.

[0028] When an instruction to start a program is received, the memory device 103 reads the program from the auxiliary storage device 102 and stores it. The processor 104 is a CPU or a GPU (Graphics Processing Unit), or a CPU and a GPU, and executes functions related to the user device 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0029] The issuing bank server 20 may also have the same hardware configuration as that shown in FIG.

[0030] FIG. 3 is a diagram showing an example of the functional configuration of an electronic currency system according to an embodiment of the present invention.

[0031] 3, the issuing bank server 20 has a currency issuing unit 21 and an identification unit 22. Each of these units is realized by one or more programs installed in the issuing bank server 20, which are executed by the processor of the issuing bank server 20. The issuing bank server 20 also uses an issued currency storage unit 23 and a withdrawn currency storage unit 24. Each of these storage units can be realized, for example, by using an auxiliary storage device of the issuing bank server 20, or a storage device connectable to the issuing bank server 20 via a network.

[0032] The currency issuing unit 21 executes the currency issuing process and records the issued currency in the issued currency storage unit 23. In this embodiment, the currency at the time of issuance is T ０ has the following structure:

[0033] T ０ :=(id, v, y, pkU ｉ , r ｉ , S ０ In this embodiment, T in the basic protocol ０ For ｉ is added. ｉ With the addition of ０ is (id, v, pkU ｉ , r ｉ ) is a signature using the private key of the issuing bank server 20. ｉ is a random number generated by the public key of currency issuer i when the currency is issued and transmitted to issuing bank server 20.

[0034] The identification unit 22 receives the currency to be refunded and checks whether the currency has been fraudulently used (double-spend). For currency in which fraudulent use is detected, the identification unit 22 identifies the timing of the fraudulent use. For currency in which fraudulent use is not detected, the identification unit 22 records the currency in the refund currency storage unit 24.

[0035] The user device 10 has a message receiving unit 111, an adding unit 112, and a currency sending unit 113 as functional units of the remitter, and a random number generating unit 121, a message sending unit 122, a currency receiving unit 123, and a verification unit 124 as functional units of the destination (receiving side). Each of these units is realized by the processor 104 executing one or more programs installed in the user device 10. The user device 10 also uses a currency storage unit 131. The currency storage unit 131 can be realized using, for example, the auxiliary storage device 102.

[0036] The details of each functional unit will be described later.

[0037] As with the basic protocol, additional information is added to the issued currency each time it is remitted. However, in this embodiment, the configuration of the additional information differs from that of the basic protocol. Specifically, when a currency is remitted from user i to user i+1, (pkU ｉ＋１ , r ｉ＋１ , S ｉ ) including additional information t ｎ＋１ is added to the currency by the user device 10i of the user i. That is, in this embodiment, the additional information t ｎ＋１ And then ｉ＋１ It differs from the basic protocol in that it includes ｉ＋１ is a random number generated by the user device 10i+1 of the remittance recipient user i+1 in association with the remittance.

[0038] Such a random number is added to the currency in order to identify the timing of the double spending of the currency (or the person who performed the double spending). However, since it is basically assumed that the issuing bank server 20, which is the issuer of the currency, is trusted, ０ is a random number r ｉ It should be noted that the double use of a currency refers to the creation of a copy of the currency and the same currency being used by the same person more than once.

[0039] The following describes the processing procedures executed in the electronic currency system. Fig. 4 is a sequence diagram for explaining an example of the processing procedures executed when transferring currency. In Fig. 4, T ｉ－１ An example in which the i-th remittance is made for T ｉ－１ is the currency that user i holds after receiving a remittance from user i-1.

[0040] In step S101, the currency sending unit 113 of the user device 10i receives the T ｉ－１ T with the history of additional information removed from ０ and additional information t ｉ－１ and user i's public key pkU ｉ and transmits a remittance request including the above to the user device 10i+1.

[0041] When the currency receiving unit 123 of the user device 10i+1 receives the remittance request, the verification unit 124 ０ The signature S contained in ０ Ya, t ｉ－１ The signature S contained in ｉ－１ is verified (S102).

[0042] When each signature is verified to be correct, the random number generator 121 of the user device 10i+1 generates a random number r ｉ＋１ (S103) A random number r ｉ＋１ is generated using a random number generator that can generate collision-resistant random numbers.

[0043] Next, the message sending unit 122 of the user device 10i+1 calculates a random number r ｉ＋１ and the public key pkU of the user device 10i+1 ｉ＋１ A message including the following is sent to the user device 10i (S104).

[0044] When the message receiving unit 111 of the user device 10i receives the message, the adding unit 112 of the user device 10i adds the private key skU of the user device 10i to the hash value of the message. ｉ A signature S generated using ｉ By adding the additional information t ｉ(S105). Therefore, the additional information t ｉ is (pkU ｉ＋１ , r ｉ＋１ , S ｉ ) is included.

[0045] Next, the adding unit 112 selects the T currency to be remitted from among the currencies stored in the currency storage unit 131 of the user device 10i. ｉ－１ Additional information ｉ By adding T ｉ is generated (S106).

[0046] Next, the currency sending unit 113 of the user device 10i sends the T ｉ is transmitted to the user device 10i+1 (S107).

[0047] The currency receiving unit 123 of the user device 10i+1 ｉ Upon receiving the T ｉ For example, the verification unit 124 verifies the validity of T ｉ Additional information ｉ The signature S contained in ｉ the public key pkU of the user device 10i ｉ The verification unit 124 also verifies the additional information t ｉ The random number included in ｉ＋１ The signature S is verified to be consistent with the ｉ is correct, and additional information t ｉ The random number included in ｉ＋１ If it matches, the verification unit 124 ｉ is recorded in the currency storage unit 131 of the user device 10i+1.

[0048] If multiple currencies need to be transferred in one transaction, the same random number r is used for each currency. ｉ＋１ may be added, or a different random number r ｉ＋１ A different random number r may be added to each currency. ｉ＋１ In this case, the adding unit 112 adds the random number r received for each currency to be remitted to the remittance unit 112. ｉ＋１(S104), and then add the additional information to the currency (S105).

[0049] Here, suppose that user i of user device 10i is T ｉ－１ and copy T ｉ－１ (i.e., a copy of T ｉ－１ In this case, the same currency T ０ Two Ts for ｉ This state is shown in Figure 5.

[0050] Figure 5 shows the state of currency that has been double-spent. Figure 5 shows a state in which currency with a currency ID of "1234" has been double-spent by user i. For example, the currency in the top row is the original, and the currency in the bottom row is a copy. Both currencies have already been transferred by user i, and are not in user i's possession.

[0051] Additional information attached to the two currencies ｉ is added by user i when remitting money. ｉ is the random number r as explained in FIG. ｉ＋１ In the example of FIG. 5, one of the additional information t ｉ Random number r ｉ＋１ The value of is rty, and the other additional information t ｉ Random number r ｉ＋１ The value of the random number r is vbn. ｉ＋１ is generated by the recipient for each remittance in a collision-resistant manner, so the possibility of them matching is extremely low. Therefore, the two values ​​are different. Note that in conventional technology, when two currencies with the same ID are remitted to the same user, it is difficult to identify the location of fraud simply by verifying the signature chain included in the currency information. In this embodiment, a collision-resistant random number is assigned when remittance is made, so that an identifier (a collision-resistant random number) is assigned to each transaction. Therefore, when two currencies with the same ID are remitted to the same user, it is possible to identify the location of fraud.

[0052] By utilizing such characteristics, the issuing bank server 20 detects the timing of double spending by, for example, executing the following processing procedure when withdrawing currency.

[0053] FIG. 6 is a flowchart illustrating an example of a processing procedure executed by the issuing bank server 20 at the time of refund.

[0054] In step S201, the identification unit 22 receives the currency to be withdrawn (hereinafter referred to as "currency X") from the user device 10 managed by, for example, a financial institution.

[0055] Next, the identification unit 22 determines whether the currency X is counterfeit (S202). Specifically, if the issued currency storage unit 23 does not store a currency with the same currency ID as the currency X (No in S202), the identification unit 22 determines that the currency X is counterfeit and ends the process in FIG. 6.

[0056] If a currency with the same currency ID as currency X is stored in the issued currency memory unit 23 (if currency X is not counterfeit currency) (Yes in S202), the identification unit 22 determines whether a currency with the same currency ID value as currency X is already stored in the refund currency memory unit 24 (S203).

[0057] If the corresponding currency is not stored (No in S203), the identifying unit 22 records the currency X in the refund currency storage unit 24 (S204).

[0058] If the relevant currency (hereinafter referred to as "currency Y") is stored (Yes in S203), the identification unit 22 identifies the timing when currency X was double-used based on a comparison between the history of random numbers attached to currency X and the history of random numbers attached to currency Y (S205).

[0059] For example, if the currency in the upper row in FIG. 5 is currency X and the currency in the lower row is already stored in the refund currency storage unit 24, the currency in the lower row that has the same currency ID as currency X is currency Y. In this case, when comparing the random number histories for currency X and currency Y, the additional information t ｉ The random numbers are different in the additional information t ｉ The random number branches after that.) Therefore, the specification unit 22 ｉ The timing when the additional information t is added can be identified as the timing of dual use. ｉ－１ The additional information tｉ The user's public key pkU ｉ If correspondence information between public keys and users is managed, the identification unit 22 can also identify the user who has engaged in dual use based on the correspondence information.

[0060] Furthermore, even if user i claims to have received something that was duplicated by a user before user i-1, it is clear that user i is fraudulent because both currency X and currency Y contain the same random number generated by user i-1 (this does not constitute evidence of duplicate use, but the fact that the algorithm was modified makes it at least fraudulent).

[0061] Furthermore, even if user i claims that users i+1 and later have double-used the currency and that he or she is not aware of the double-usage, the additional information t ｉ Since the random numbers in the two documents are different, we can see that user i sent two currencies separately. Note that it is difficult to rewrite user i's random numbers, assuming the security of the signature.

[0062] From the above, when the maximum value of the index for which the random numbers are the same for a currency that has been double-used is i-1, it can be seen that at least user i is a fraudulent user (even if there is fraudulent collusion).

[0063] Although the above describes an example in which the issuing bank server 20 compares the random number histories of multiple currencies having the same currency ID at the time of withdrawal, such comparison of random numbers may also be performed by each user device 10. For example, when a user device 10 of a financial institution makes a deposit, the processing procedure of Fig. 6 may be performed between the currency stored in the currency storage unit 131 of the user device 10 (currency deposited at the financial institution). Also, when a store or the like receives payment, the processing procedure of Fig. 6 may be performed between the currency stored in the currency storage unit 131 of the user device 10 (currency held by the store).

[0064] The random number may also be included in the nonce (number used once) in Non-Patent Document 2. In addition, when a transaction ID is included in the additional information for each transaction (remittance), the random number may be included as part or all of the transaction ID.

[0065] As described above, the present embodiment aims to make it possible to identify the timing of fraudulent use of electronic currency even when the same currency is duplicated and remitted to the same user.

[0066] In this embodiment, the user device 10i is an example of a remittance device, the user device 10i+1 is an example of a remittance device, and the issuing bank server 20 is an example of an information processing device.

[0067] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0068] 10 User device 20 Issuing bank server 21 Currency issuing unit 22 Identification unit 23 Issued currency storage unit 24 Withdrawn currency storage unit 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 Processor 105 Interface device 111 Message receiving unit 112 Addition unit 113 Currency sending unit 121 Random number generation unit 122 Message sending unit 123 Currency receiving unit 124 Verification unit 131 Currency storage unit B Bus

Claims

1. An electronic currency system including a remittance device that is the source of electronic currency remittance and a remittance receiving device that is the destination of said electronic currency remittance, wherein said remittance device has: a message receiving unit configured to receive a message including a random number generated for each remittance from said remittance receiving device; an adding unit configured to add additional information to said electronic currency including said random number and a digital signature for said random number using the private key of said remittance device; and a currency sending unit configured to send said electronic currency with said additional information added to said remittance receiving device.

2. The electronic currency system according to claim 1, wherein the random number is generated by the depositing device.

3. The electronic currency system according to claim 1, characterized in that the adding unit is configured to add additional information containing the same random number or different random numbers to each of the electronic currencies when multiple electronic currencies are transmitted.

4. An electronic currency system as claimed in any one of claims 1 to 3, comprising an information processing device for redeeming electronic currency, wherein the information processing device has an identification unit configured to, when a second electronic currency identical to the first electronic currency has already been redeemed in response to the redemption of a first electronic currency, identify the timing of double spending of the electronic currency based on a comparison of the random number contained in one or more pieces of additional information attached to the first electronic currency with the random number contained in one or more pieces of additional information attached to the second electronic currency.

5. A remittance device that is a sender of electronic currency, comprising: a message receiving unit configured to receive a message including a random number generated for each remittance from a receiving device that is a recipient of the electronic currency; an adding unit configured to add additional information to the electronic currency including the random number and a digital signature for the random number using the private key of the remittance device; and a currency sending unit configured to send the electronic currency with the additional information added to the receiving device.

6. A remittance method characterized by the following steps being carried out by a remittance device, which is the sender of electronic currency, to execute a message receiving procedure in which the remittance device receives a message including a random number generated for each remittance from a remittance receiving device, which is the destination of the electronic currency; an attachment procedure in which additional information including the random number and a digital signature for the random number using the private key of the remittance device is attached to the electronic currency; and a currency sending procedure in which the electronic currency with the attached additional information is sent to the remittance receiving device.

7. A program for causing a remittance device, which is the sender of electronic currency, to execute the following steps: a message receiving procedure for receiving a message including a random number generated for each remittance from a remittance device, which is the destination of the electronic currency; an attachment procedure for adding additional information to the electronic currency, including the random number and an electronic signature for the random number using the private key of the remittance device; and a currency sending procedure for sending the electronic currency with the additional information attached to the remittance device.

Images