Electronic currency system, remittance apparatus, remittance method, and program

Abstract

Provided is an electronic currency system comprising: a remittance apparatus, which is the remittance source of electronic currency to which additional information is added each time remittance is made; and a receiving apparatus, which is the remittance destination of the electronic currency. The remittance apparatus comprises a verification key reception unit configured to receive a group verification key of a group to which the receiving apparatus belongs, a signature unit configured to use a member signature key of the remittance apparatus to generate a group signature for the group verification key and a hash value of the additional information that is most recently added to the electronic currency, and a currency transmission unit configured to transmit to the receiving apparatus the electronic currency to which the group verification key, the hash value, and the group signature have been added as the additional information. This makes it possible to appropriately ensure the anonymity of a user of electronic currency while maintaining the traceability.

Description

Electronic Currency System, Remittance Device, Remittance Method, and Program

[0001] The present invention relates to an electronic currency system, a remittance device, a remittance method, and a program.

[0002] Studies on CBDC (Central Bank Digital Currency) are underway in various countries around the world. The Bank of Japan states that digital currency (electronic currency) needs to have the following characteristics.

[0003] (1) Universal access (2) Security (3) Resilience (4) Instant settlement (5) Interoperability. To satisfy resilience and instant settlement, it is necessary to circulate currency through settlement between users (in a form that does not involve a central server / offline settlement). Furthermore, since currency has the property of being exchanged between users multiple times (transferability), authentication of transaction transactions and traceability of fraud are essential from the perspective of security.

[0004] In the case of offline electronic currency, it is difficult to detect forgery. Therefore, a method of linking signatures for fraud detection and performing batch verification at the time of deposit is known (for example, Non-Patent Document 1, Non-Patent Document 2).

[0005] Okuda, et al., "Consideration of Double-Use Detection and Formal Verification of Privacy in Token-Type Electronic Cash Method", Research Report Computer Security (CSEC), 2023-CSEC-100, 66, pp.1-8, 2023 / 2 / 27 Okuda, et al., "Initial Consideration of Formal Verification Method for Token-Type Electronic Cash Method", Research Report Electronic Intellectual Property and Social Infrastructure (EIP), 2022-EIP-98, 24, pp.1-8, 2022 / 12 / 15

[0006] In the prior art, every time an electronic currency is transferred, the public key of the recipient user is added to the electronic currency. Here, since the public key is a fixed value authenticated by the issuer of the electronic currency such as a central bank, it corresponds one-to-one with the user. Therefore, for each electronic currency, there is a possibility of specifying the circulation route of the electronic currency in terms of the user (a possibility that the anonymity of the user is not ensured), which is not desirable from the perspective of protecting the user's privacy. On the other hand, when illegal use of an electronic currency occurs, it is necessary to be able to track the user who has made the illegal use.

[0007] The present invention has been made in view of the above points, and an object thereof is to appropriately ensure anonymity while maintaining the traceability of users of electronic currency.

[0008] Therefore, in order to solve the above problems, in an electronic currency system including a remittance device which is the sender of an electronic currency to which additional information is added every time a remittance is made, and a receiving device which is the recipient of the electronic currency, the remittance device is configured to receive a group verification key of a group to which the receiving device belongs, a signature unit configured to generate a group signature for a hash value of the additional information last added to the electronic currency and the group verification key by a member signature key of the remittance device, and a currency transmission unit configured to transmit the electronic currency to which the group verification key, the hash value, and the group signature are added as the additional information to the receiving device.

[0009] It is possible to appropriately ensure anonymity while maintaining the traceability of users of electronic currency.

[0010] It is a diagram showing a configuration example of an electronic currency system in an embodiment of the present invention. It is a diagram for explaining a configuration example of a currency in a basic protocol. It is a diagram for explaining a configuration example of a currency in this embodiment. It is a diagram showing a hardware configuration example of a user device 10 in an embodiment of the present invention. It is a diagram showing a functional configuration example of a user device 10 in an embodiment of the present invention. It is a sequence diagram for explaining an example of a processing procedure executed when a currency is remitted.

[0011] Embodiments of the present invention will be described below with reference to the drawings. Figure 1 is a diagram showing an example configuration of an electronic currency system in an embodiment of the present invention. In Figure 1, the electronic currency system includes an issuing bank server 20, a certification authority server 30, and a plurality of user devices 10. Each user device 10 is connected to the issuing bank server 20 and the certification authority server 30 via a network such as the Internet (whether wired or wireless). Note that only some of the user devices 10 may be able to communicate with the issuing bank server 20.

[0012] The issuing bank server 20 is one or more computers managed by an issuing bank that issues electronic currency (hereinafter simply referred to as "currency"). The issuing bank server 20 issues currency and accepts the redemption of currency.

[0013] The certification authority server 30 is one or more computers that authenticate the private key (hereinafter referred to as the "signing key") used by the user terminal that is the source of the currency transfer to generate the electronic signature attached to the currency, and issue a public key certificate to the user device 10 that includes a public certificate (hereinafter referred to as the "verification key") which is paired with the signing key and used to verify the electronic signature generated by the signing key. The certification authority server 30 may be operated by a commercial bank.

[0014] User device 10 is a computer used by the currency user. For example, a server computer, PC, tablet terminal, or smartphone may be used as user device 10.

[0015] A user of a currency is any person or organization that sends or receives currency in its circulation. Examples of users include financial institutions other than the issuing bank (e.g., commercial banks), businesses, stores, and general consumers.

[0016] Each user device 10 can act as either a sender or a recipient depending on the transaction using currency. A sender is the party that sends the currency, and a recipient is the party that receives the currency.

[0017] Remittances include, for example, withdrawals from financial institutions other than the issuing bank (e.g., commercial banks), deposits into financial institutions, and payments in commercial transactions.

[0018] For example, in the case of a withdrawal from a financial institution, the user device 10 managed by the financial institution is the remitter, and the user device 10 used by the person who receives the withdrawn currency is the payee. In the case of a deposit to a financial institution, the user device 10 used by the person who deposits currency during the financial period is the remitter, and the user device 10 managed by the financial institution is the payee. In the case of a payment, the user device 10 used by the person who makes the payment (the purchaser of goods or services) is the remitter, and the user device 10 used by the person who receives the payment (the seller of goods or services) is the payee. Thus, the remitter and the payee are in a relative relationship. That is, the user device 10 used by the user of the electronic currency system can be the remitter in one transaction and the payee in another transaction.

[0019] In this embodiment, the basic protocol regarding the circulation of currency (hereinafter referred to as the "basic protocol") conforms to the "4. Verification Target Protocol" of Non-Patent Document 1 and Non-Patent Document 2. The issuing bank server 20 and each user store a pair of their respective verification keys and signature keys in advance.

[0020] An outline of the basic protocol assumed in this embodiment will be described.

[0021] Currency is issued by the issuing bank server 20. The issuance of currency is to newly generate a token (data) as currency. In this embodiment, the currency at the time of issuance (immediately after issuance) is denoted as T ０ In the basic protocol, T ０ has the following structure:

[0022] T ０ := (id, v, vk ｉ , σ ０ ) That is, T ０ includes id, v, vk ｉ , and σ ０ . Id is the currency ID. The currency ID is a unique value for each currency. V is the denomination of the currency. The denomination of the currency may be the minimum unit (for example, 1 yen), or may be different for each currency. Vk ｉThis is the verification key of user i, the issuer of the currency. The issuer of the currency is, for example, a financial institution. σ ０ is (id, v, vk ｉ This is an electronic signature (hereinafter simply referred to as "signature") applied to the hash value of ) using the signing key of the issuing bank server 20.

[0023] The issued currency is sent from user device 10 as the sender to user device 10 as the recipient, depending on the transaction. In the basic protocol, when a certain currency is sent from user device 10 of user i (hereinafter referred to as "user device 10i") to user device 10 of user i+1 (hereinafter referred to as "user device 10i+1"), (vk ｉ＋１ Message M containing ,H) ｉ And, σ ｉ Information including (hereinafter referred to as "additional information t") ｉ The following is added (recorded) to the currency by the user device 10i of the remitter.

[0024] Here, vk ｉ＋１ H is the verification key of the user device 10i+1, which is the recipient of the remittance. H is the additional information t that was last attached to the currency. ｉ－１ This is the hash value of [the currency]. However, H for a currency immediately after its issuance is T ０ This is the hash value for σ. ｉ M ｉ This is a signature from user i, the sender, using their signature key.

[0025] Additional information from the first remittance immediately after issuance １ Let the nth additional information be t ｎ Therefore, the currency that has been sent n times since its issuance (i.e., the currency held by the (n+1)th user) has the following structure.

[0026] {T ０ ,t １ ,・・・・, t ｎ－１ ,t ｎ Figure 2 shows the currency in this state.

[0027] In this way, additional information is added to the currency each time a transfer is made. Below, we will look at the currency T after n transfers (n≧0) have been made (i.e., with n pieces of additional information added). ０ Simply T ｎ This is how it is written.

[0028] On the other hand, in this embodiment, in order to protect the privacy of each user, group signature, which is a known technology, is used as the signature method by each user device 10. Group signature is a signature method that allows only the affiliation with a certain group to be confirmed from the signature made by a user belonging to that group, and makes it impossible to identify who made the signature. In order to use group signature, in this embodiment, the following (1) to (3) are performed in advance in accordance with the known technology.

[0029] (1) The certification authority server 30 generates a group in advance (with no members) and sets the verification key for that group (hereinafter referred to as "group verification key vk"). Ｇ ) and the signing key of the group (hereinafter referred to as "group signing key sk") Ｇ It generates (which means "...").

[0030] (2) The user device 10 of a user using the currency requests the certification authority server 30 to add it to the group.

[0031] (3) The certification authority server 30 adds the user to the group and authenticates the member signing key, which is a private key that the user can use to sign documents.

[0032] Furthermore, the method for issuing the pair of a public key and a member signing key that is paired with the member signing key (hereinafter referred to as the "member key") may be either of the methods described in references [1] and [2] below.

[0033] In the method described in reference [1], the certification authority server 30 generates the member key and assigns it to the authenticated user. In the method described in reference [2], the user device 10 generates the member key during the authentication process with the certification authority server 30.

[0034] For each of the above user devices 10i, when (2) and (3) above are executed, the user device 10i will have the member signing key uskｉ and group verification key vk Ｇ This will result in the group verification key vk being remembered. Ｇ Since this is a public key that anyone can obtain, the user device 10 can also obtain it in advance.

[0035] Currency T immediately after issuance by the issuing bank server 20 ０ It has the following structure.

[0036] T ０ :=(id, v, vk Ｇ , σ ０ ) In other words, the verification key vk of the issuing user i in the basic protocol. ｉ The group verification key vk belongs to the group to which the issuing user i belongs. Ｇ It will be replaced by...

[0037] When a certain currency is transferred from user device 10i to user device 10i+1, (vk Ｇ Message M containing ,H) ｉ And, σ ｉ Additional information including t ｉ This is added (recorded) to the currency by the user device 10i of the remitter.

[0038] Here, vk Ｇ H is the group verification key of the user device 10i+1, which is the recipient of the remittance. H is the additional information t that was last attached to the currency. ｉ－１ This is the hash value of [the currency]. However, H for a currency immediately after its issuance is T ０ This is the hash value for σ. ｉ M ｉ The member signing key usk of the sender user i. ｉ This is a group signature generated using [a specific method / tool].

[0039] Additional information from the first remittance immediately after issuance １ Let the nth additional information be t ｎ Therefore, a currency that has been sent n times after issuance (i.e., the currency held by the (n+1)th user) will have the following structure, similar to the basic protocol.

[0040] {T ０ ,t １,・・・・, t ｎ－１ ,t ｎ Figure 3 shows the currency in this state. Comparing Figure 3 with Figure 2, in Figure 3, each message M has the group verification key vk of the group to which the recipient user belongs. Ｇ This includes each additional information t ｉ This differs from Figure 2 in that the signatures included are group signatures.

[0041] Figure 4 shows an example of the hardware configuration of a user device 10 in an embodiment of the present invention. The user device 10 in Figure 4 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, etc., which are all interconnected by bus B.

[0042] The program that enables processing on the user device 10 is provided on a recording medium 101 such as a CD-ROM. When the recording medium 101 containing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101; it may also be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files and data.

[0043] The memory device 103 reads and stores a program from the auxiliary storage device 102 when a program startup command is received. The processor 104 is either a CPU or a GPU (Graphics Processing Unit), or both a CPU and a GPU, and executes functions related to the user device 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0044] The issuing bank server 20 and the certification authority server 30 may also have the same hardware configuration as shown in Figure 4.

[0045] Figure 5 shows an example of the functional configuration of the user device 10 in an embodiment of the present invention. In Figure 5, the user device 10 has a verification key receiving unit 111, a signature unit 112, and a currency transmission unit 113 as the sending function unit (receiving device), and a verification key transmission unit 121, a currency receiving unit 122, and a verification unit 123 as the receiving function unit (receiving device). Each of these units is realized by processing that one or more programs installed in the user device 10 cause the processor 104 to execute. The user device 10 also utilizes a currency storage unit 131. The currency storage unit 131 can be realized using, for example, an auxiliary storage device 102. Details of each function unit will be described later.

[0046] The following describes the processing procedures performed in the electronic currency system. Figure 6 is a sequence diagram illustrating an example of the processing procedures performed when transferring currency. In Figure 6, T is transferred from user device 10n to user device 10n+1. ｎ－１ Let's explain an example where the nth transfer of funds is performed. ｎ－１ This is the currency that user n has received from user n-1 and that user n possesses.

[0047] In step S101, the verification key transmission unit 121 of the user device 10n+1 transmits the group verification key vk stored in the user device 10n+1. Ｇ This is sent to the user device 10n.

[0048] The verification key receiving unit 111 of the user device 10n receives the group verification key vk Ｇ Upon receiving the T, the signature unit 112 of the user device 10n selects the currency to be sent from among the currencies stored in the currency storage unit 131 of the user device 10n. ｎ－１ The last additional information t ｎ－１ Calculate the hash value H and the group verification key vk Ｇ and message M including hash value H ｎ Member signing key usk ｎ Using group signing σ ｎ This is generated (S102).

[0049] Next, the currency transmission unit 113 sends the group verification key vk Ｇhash value H and group signature σ ｎ Additional information including t ｎ to T ｎ－１ By adding to T ｎ Generate (S103).

[0050] Next, the currency transmission unit 113 of the user device 10n, ｎ This is sent to user device 10n+1 (S104). ｎ The details are as shown in Figure 3.

[0051] The currency receiving unit 122 of the user device 10n+1 is T ｎ Upon receiving T ｎ The validity of is verified (S105). For example, the verification unit 123 is T ｎ Additional information t ｎ The signature σ included ｎ The group verification key vk of user device 10n Ｇ Verification is performed using the following. Note that if the group to which user device 10n+1 belongs and the group to which user device 10n belongs are the same, then the respective group verification keys vk Ｇ They are the same. Signature σ ｎ If this is correct, the verification unit 123 will perform T ｎ This is recorded in the currency storage unit 131 of the user device 10n+1.

[0052] Note that the certification authority server 30 may generate only one group. In this case, all users will belong to the same group, and the group verification key vk stored in all user devices 10 will be used. Ｇ These will be the same. Alternatively, the authentication server may generate multiple groups. For example, each user may belong to a different group depending on the commercial bank they use, or the groups may be distinguished by the economic zone of points awarded for the purchase of goods or services.

[0053] As described above, according to this embodiment, the additional information sequentially attached to the currency includes a group verification key and a group signature, but does not include user-specific verification keys and user-specific signing keys. Here, group signatures have the characteristics of anonymity and traceability. Anonymity means that if a message and its signature are given, the signer cannot be identified without the group signing key. Traceability means that if a valid signature exists, the issuer of the signature can be traced using the group signing key. In this embodiment, since only the certification authority server 30 holds the group signing key, transaction information using the currency is kept secret from each user, and the certification authority server 30 can track the user if there is any fraud in the transaction.

[0054] As described above, this embodiment makes it possible to appropriately ensure anonymity while maintaining the traceability of users of electronic currency.

[0055] [References] [1] Boyen, Xavier, and Brent Waters, "Compact group signatures without random oracles," Annual international conference on the theory and applications of cryptographic techniques. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006. [2] Clarisse, Re'mi and Olivier Sanders, "Group signature without random oracles from randomizable signatures," Provable and Practical Security: 14th International Conference, ProvSec 2020, Singapore, November 29-December 1, 2020, Proceedings 14. Springer International Publishing, 2020. Although embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention as described in the claims.

[0056] 10 User device 20 Issuing bank server 30 Certification authority server 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 Processor 105 Interface device 111 Verification key receiving unit 112 Signature unit 113 Currency transmission unit 121 Verification key transmission unit 122 Currency receiving unit 123 Verification unit 131 Currency storage unit B Bus

Claims

1. An electronic currency system comprising a remittance device which is the source of an electronic currency to which additional information is added each time a remittance is made, and a receiving device which is the destination of the electronic currency, wherein the remittance device comprises: a verification key receiving unit configured to receive a group verification key of the group to which the receiving device belongs; a signature unit configured to generate a hash value for the last added additional information to the electronic currency and a group signature for the group verification key using the member signature key of the remittance device; and a currency transmission unit configured to transmit the electronic currency to which the group verification key, the hash value, and the group signature are added as the additional information to the receiving device.

2. The electronic currency system according to claim 1, characterized in that the receiving device has a verification unit configured to verify the group signature attached to the electronic currency received from the remittance device using the group verification key of the group to which the remittance device belongs.

3. A remittance device that is the source of an electronic currency to which additional information is added each time a remittance is made, comprising: a verification key receiving unit configured to receive a group verification key of the group to which the receiving device, which is the destination of the electronic currency, belongs; a signature unit configured to generate a hash value for the additional information last added to the electronic currency and a group signature for the group verification key using the member signature key of the remittance device; and a currency transmission unit configured to transmit the electronic currency to which the group verification key, the hash value, and the group signature are added as the additional information to the receiving device.

4. A transmission method characterized by executing: a verification key receiving procedure configured to receive a group verification key of the group to which the receiving device, which is the recipient of the electronic currency, belongs; a signature procedure which generates a hash value for the last added information to the electronic currency and a group signature for the group verification key using the member signature key of the remittance device; and a currency transmission procedure which transmits the electronic currency to the receiving device, to which the group verification key, hash value, and group signature have been added as the additional information.

5. A program for executing the following steps: a verification key receiving procedure configured to receive a group verification key from a group to which a receiving device, the recipient of the electronic currency, belongs; a signature procedure for generating a hash value for the last added information to the electronic currency and a group signature for the group verification key using the member signature key of the remittance device; and a currency transmission procedure for transmitting the electronic currency, to which the group verification key, hash value, and group signature have been added as the additional information, to the receiving device.

Images