WO2026074632A1 - Electronic currency system, remittance apparatus, remittance method, and program - Google Patents

Abstract

Provided is an electronic currency system comprising: a remittance apparatus, which is the remittance source of electronic currency to which additional information is added each time remittance is made; and a receiving apparatus, which is the remittance destination of the electronic currency. The remittance apparatus comprises a verification key reception unit configured to receive a group verification key of a group to which the receiving apparatus belongs, a signature unit configured to use a member signature key of the remittance apparatus to generate a group signature for the group verification key and a hash value of the additional information that is most recently added to the electronic currency, and a currency transmission unit configured to transmit to the receiving apparatus the electronic currency to which the group verification key, the hash value, and the group signature have been added as the additional information. This makes it possible to appropriately ensure the anonymity of a user of electronic currency while maintaining the traceability.

Description

Electronic currency systems, remittance devices, remittance methods and programs

This invention relates to an electronic currency system, a money transfer device, a money transfer method, and a program.

The development of CBDCs (Central Bank Digital Currencies) is progressing in countries around the world, and the Bank of Japan states that digital currencies (electronic currencies) must possess the following characteristics.

(1) Universal access (2) Security (3) Resilience (4) Instant settlement (5) Interoperability Of these, in order to satisfy resilience and instant settlement, it is necessary to circulate the currency through settlements between users (without the mediation of a central server/offline settlement). Furthermore, because the currency has the characteristic of being exchanged between users many times (transferability), authentication of transaction and traceability of fraud are essential from a security standpoint.

Because tampering detection is difficult with offline electronic currencies, a method is known to chain signatures and perform a batch verification at the time of deposit for fraud detection (for example, Non-Patent Document 1, Non-Patent Document 2).

Okuda, et al., "A Study on Formal Verification Regarding Double-Use Detection and Privacy in Token-Based Electronic Cash Systems," Research Report Computer Security (CSEC), 2023-CSEC-100, 66, pp.1-8, 2023/2/27 Okuda, et al., "Initial Study on Formal Verification Methods for Token-Based Electronic Cash Systems," Research Report on Electronic Intellectual Property and Social Infrastructure (EIP), 2022-EIP-98, 24, pp.1-8, 2022/12/15

In conventional technology, each time electronic currency is sent, the recipient user's public key is attached to that electronic currency. Here, since the public key is a fixed value authenticated by the electronic currency issuer, such as a central bank, it corresponds one-to-one with each user. Therefore, for each electronic currency, there is a possibility that the circulation route of that electronic currency can be identified on a per-user basis (potentially compromising user anonymity), which is undesirable from the perspective of protecting user privacy. On the other hand, in the event of fraudulent use of electronic currency, it is necessary to be able to track down the user who committed the fraud.

This invention has been made in view of the above points, and aims to enable appropriate anonymity while maintaining the traceability of users of electronic currency.

Therefore, to solve the above problem, in an electronic currency system including a remittance device that is the source of electronic currency to which additional information is added each time a remittance is made, and a receiving device that is the destination of the electronic currency, the remittance device includes: a verification key receiving unit configured to receive the group verification key of the group to which the receiving device belongs; a signature unit configured to generate a hash value for the last added additional information to the electronic currency and a group signature for the group verification key using the member signature key of the remittance device; and a currency transmission unit configured to transmit the electronic currency to which the group verification key, the hash value, and the group signature are added as the additional information to the receiving device.

This makes it possible to maintain traceability of electronic currency users while appropriately ensuring anonymity.

This figure shows an example configuration of an electronic currency system according to an embodiment of the present invention. This is a diagram illustrating an example of currency structure in the basic protocol. This is a diagram illustrating an example of the currency configuration in this embodiment. This figure shows an example of the hardware configuration of the user device 10 in an embodiment of the present invention. This figure shows an example of the functional configuration of the user device 10 in an embodiment of the present invention. This is a sequence diagram illustrating an example of the processing steps performed when transferring currency.

The embodiments of the present invention will be described below with reference to the drawings. Figure 1 is a diagram showing an example configuration of an electronic currency system in an embodiment of the present invention. In Figure 1, the electronic currency system includes an issuing bank server 20, a certification authority server 30, and a plurality of user devices 10. Each user device 10 is connected to the issuing bank server 20 and the certification authority server 30 via a network such as the Internet (whether wired or wireless). Note that only some of the user devices 10 may be able to communicate with the issuing bank server 20.

The issuing bank server 20 is one or more computers managed by an issuing bank that issues electronic currency (hereinafter simply referred to as "currency"). The issuing bank server 20 issues currency and accepts currency redemption.

The Certificate Authority Server 30 is one or more computers that authenticate the private key (hereinafter referred to as the "signing key") used by the user terminal that is the source of the currency transfer to generate the electronic signature attached to the currency, and issues a public key certificate (hereinafter referred to as the "verification key") which is paired with the signing key and used to verify the electronic signature generated by the signing key. The Certificate Authority Server 30 may be operated by a commercial bank.

User device 10 is a computer used by the currency user. For example, a server computer, PC, tablet terminal, or smartphone may be used as user device 10.

A user of a currency is any individual or organization that sends or receives currency in its circulation. Examples of users include financial institutions other than the issuing bank (e.g., commercial banks), businesses, shops, and general consumers.

Each user device 10 acts as either the sender or recipient of a currency transaction, depending on the context. The sender is the party sending the currency, and the recipient is the party receiving the currency.

Remittances include, for example, withdrawals from financial institutions other than the issuing bank (e.g., commercial banks), deposits into financial institutions, and payments in commercial transactions.

For example, in the case of a withdrawal from a financial institution, the user device 10 managed by the financial institution is the sender, and the user device 10 used by the recipient of the withdrawn currency is the recipient. In the case of a deposit to a financial institution, the user device 10 used by the person depositing the currency with the financial institution is the sender, and the user device 10 managed by the financial institution is the recipient. In the case of a payment, the user device 10 used by the payer (purchaser of goods or services) is the sender, and the user device 10 used by the recipient (seller of goods or services) is the recipient. Thus, the sender and recipient are in a relative relationship. That is, the user device 10 used by a user of the electronic currency system can be the sender in one transaction and the recipient in another.

In this embodiment, the basic protocol for currency circulation (hereinafter referred to as the "basic protocol") conforms to "4. Protocol to be verified" in Non-Patent Documents 1 and 2. The issuing bank server 20 and each user have their respective verification key and signing key pairs stored in advance.

The basic protocol assumed in this embodiment will now be described.

The currency is issued by the issuing bank server 20. The issuance of currency means the creation of new tokens (data) as currency. In this embodiment, the currency at the time of issuance (immediately after issuance) is denoted as _T0 . In the basic protocol, _T0 has the following structure.

T ₀ :=(id, v, vk _i , σ ₀ )
In other words, _T0 includes id, v, vk _i , and _σ0 . id is the currency ID. The currency ID is a unique value for each currency. v is the face value of the currency. The face value of the currency may be the smallest unit (e.g., 1 yen) or may differ for each currency. vk _i is the verification key of user i, the recipient of the currency. The recipient of the currency is, for example, a financial institution. _σ0 is an electronic signature (hereinafter simply referred to as "signature") using the signing key of the issuing bank server 20 on the hash value of (id, v, vk _i ).

The issued currency is sent from the user device 10 acting as the sender to the user device 10 acting as the recipient, depending on the transaction. In the basic protocol, when a certain currency is sent from user i's user device 10 (hereinafter referred to as "user device 10i") to user i+1's user device 10 (hereinafter referred to as "user device 10i+1"), a message _Mi containing (vk _i+1 , H) and information containing σ _i (hereinafter referred to as "additional information t _i ") are added (recorded) to the currency by the sender user device 10i.

Here, vk _i+1 is the verification key of the user device 10i+1, which is the recipient of the remittance. H is the hash value of the additional information t _i-1 that was last added to the currency. However, for currency immediately after issuance, H is the hash value of T _0. σ _i is the signature of Mi _i by the signing key of the sending user i.

If we denote the additional information from the first transfer immediately after issuance as _t1 , and the additional information from the nth transfer as _tn , then the currency that has been transferred n times since issuance (i.e., the currency held by the (n+1)th user) will have the following structure.

{T ₀ , t ₁ ,..., t _n-1 , t _n }
Figure 2 shows the currency in this state.

In this way, additional information is added to the currency each time a transfer is made. Below, the currency _T0 in the state after n transfers (n≧0) have been made (i.e., with n pieces of additional information added) will simply be denoted as _Tn .

On the other hand, in this embodiment, in order to protect the privacy of each user, group signature, a known technology, is used as the signature method for each user device 10. Group signature is a signature method that allows only the affiliation with a certain group to be confirmed from the signature made by a user belonging to that group, making it impossible to identify who made the signature. In order to use group signature, in this embodiment, the following (1) to (3) are performed in advance according to known technology.

(1) The certification authority server 30 first generates a group (with no members), and generates a verification key for the group (hereinafter referred to as "group verification key vk _G ") and a signing key for the group (hereinafter referred to as "group signing key sk _G ").

(2) The user device 10 of a user using the currency requests the certification authority server 30 to add it as a group member.

(3) The certification authority server 30 adds the user to the group and authenticates the member signing key, which is the private key that the user can use to sign documents.

Furthermore, the method for issuing the pair of a member signing key and its corresponding public key (hereinafter referred to as the "member key") may be either of the methods described in references [1] and [2] below.

In the method described in reference [1], the certification authority server 30 generates the member key and assigns it to the authenticated user. In the method described in reference [2], the user device 10 generates the member key during the authentication process with the certification authority server 30.

For each of the user devices 10i described above, when (2) and (3) are executed, the user device 10i will have stored the member signing key usk _i and the group verification key vk _G. Note that the group verification key vk _G is a public key that anyone can obtain, so the user device 10 can also obtain it in advance.

The currency _T0 immediately after issuance by the issuing bank server 20 has the following structure.

T ₀ :=(id, v, vk _G , σ ₀ )
In other words, the verification key vk _i of the recipient user i in the basic protocol is replaced by the group verification key vk _G of the group to which the recipient user i belongs.

When a certain currency is sent from user device 10i to user device 10i+1, a message _Mi containing (vk _G , H) and additional information t _i containing σ _i are added (recorded) to the currency by the sending user device 10i.

Here, vk _G is the group verification key of the user device 10i+1, which is the recipient of the remittance. H is the hash value of the additional information t _i-1 that was last attached to the currency. However, for currency immediately after issuance, H is the hash value of T _0. σ _i is the group signature for Mi _i , generated using the member signing key usk _i of the sending user i.

If we denote the additional information from the first transfer immediately after issuance as _t1 , and the additional information from the nth transfer as _tn , then the currency that has been transferred n times since issuance (i.e., the currency held by the (n+1)th user) will have the following structure, similar to the basic protocol.

{T ₀ , t ₁ ,..., t _n-1 , t _n }
Figure 3 shows the currency in this state. Comparing Figure 3 with Figure 2, Figure 3 differs from Figure 2 in that each message M includes the group verification key vk _G of the group to which the recipient user belongs, and the signature included in each additional information t _i is a group signature.

Figure 4 shows an example of the hardware configuration of the user device 10 in an embodiment of the present invention. The user device 10 in Figure 4 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, all of which are interconnected via bus B.

The program that enables processing on the user device 10 is provided on a recording medium 101 such as a CD-ROM. When the recording medium 101 containing the program is inserted into the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, program installation does not necessarily have to be performed from the recording medium 101; it may also be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program, as well as necessary files and data.

The memory device 103 reads and stores the program from the auxiliary storage device 102 when a program startup command is received. The processor 104 is either a CPU or a GPU (Graphics Processing Unit), or both, and executes functions related to the user device 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

Furthermore, the issuing bank server 20 and the certification authority server 30 may also have the same hardware configuration as shown in Figure 4.

Figure 5 shows an example of the functional configuration of the user device 10 in an embodiment of the present invention. In Figure 5, the user device 10 has a verification key receiving unit 111, a signature unit 112, and a currency transmission unit 113 as the sender's functional unit (sending device), and a verification key transmission unit 121, a currency receiving unit 122, and a verification unit 123 as the recipient's functional unit (receiving device). Each of these units is realized by processing performed by one or more programs installed in the user device 10, which are executed by the processor 104. The user device 10 also utilizes a currency storage unit 131. The currency storage unit 131 can be realized using, for example, an auxiliary storage device 102. Details of each functional unit will be described later.

The following describes the processing procedures performed in the electronic currency system. Figure 6 is a sequence diagram illustrating an example of the processing procedures performed when transferring currency. Figure 6 describes an example in which the nth transfer of T _n-1 is performed from user device 10n to user device 10n+1. _{T n-1} is the currency that user n has received from user n-1 and holds.

In step S101, the verification key transmission unit 121 of user device 10n+1 transmits the group verification key vk _G stored in user device 10n+1 to user device 10n.

When the verification key receiving unit 111 of the user device 10n receives the group verification key vk _G , the signing unit 112 of the user device 10n calculates the hash value H of the last added information t _n-1 attached to the T _n-1 to be sent from the currency stored in the currency storage unit 131 of the user device 10n, and generates a group signature σ _n using the member signing key usk _n for the message M _n containing the group verification key vk _G and the hash value H (S102).

Next, the currency transmission unit 113 generates _Tn by adding additional information _tn , which includes the group verification key vk _G , hash value H, and group signature _σn , to Tn _-1 (S103).

Next, the currency transmission unit 113 of the user device 10n transmits _Tn to the user device 10n+1 (S104). The contents of _Tn are as shown in Figure 3.

When the currency receiving unit 122 of user device 10n+1 receives _Tn , the verification unit 123 verifies the validity of _Tn (S105). For example, the verification unit 123 verifies the signature _σn contained in the additional information _tn of _Tn using the group verification key _vkG of user device 10n. Note that if the group to which user device 10n+1 belongs and the group to which user device 10n belongs are the same, then their respective group verification keys _vkG are the same. If the signature _σn is correct, the verification unit 123 records _Tn in the currency storage unit 131 of user device 10n+1.

Note that the certification authority server 30 may generate only one group. In this case, all users will belong to the same group, and the group verification key vk _G stored in all user devices 10 will be the same. Alternatively, the authentication server may generate multiple groups. For example, the group to which each user belongs may be distinguished according to the commercial bank used by the user, or the group may be distinguished according to the economic zone of points awarded for the purchase of goods or services.

As described above, according to this embodiment, the additional information sequentially attached to the currency includes a group verification key and a group signature, but does not include signatures made by individual user verification keys and individual user signing keys. Here, group signatures have the characteristics of anonymity and traceability. Anonymity means that, given a message and its signature, the signer cannot be identified without the group signing key. Traceability means that, if a valid signature exists, the issuer of the signature can be traced using the group signing key. In this embodiment, since only the certification authority server 30 holds the group signing key, transaction information using the currency is kept secret from each user, and the certification authority server 30 can track users if there is any fraud in the transaction.

Based on the above, this embodiment makes it possible to appropriately ensure anonymity while maintaining the traceability of electronic currency users.

[References]
[1] Boyen, Xavier, and Brent Waters, "Compact group signatures without random oracles", Annual international conference on the theory and applications of cryptographic techniques. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006
[2] Clarisse, Re'mi (with an acute accent over the 'e') and Olivier Sanders, "Group signature without random oracles from randomizable signatures," Provable and Practical Security: 14th International Conference, ProvSec 2020, Singapore, November 29-December 1, 2020, Proceedings 14. Springer International Publishing, 2020.
Although embodiments of the present invention have been described in detail above, the present invention is not limited to these specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention as described in the claims.

10 User device 20 Issuing bank server 30 Certification authority server 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 Processor 105 Interface device 111 Verification key receiving unit 112 Signature unit 113 Currency transmission unit 121 Verification key transmission unit 122 Currency receiving unit 123 Verification unit 131 Currency storage unit B Bus

Claims (5)

An electronic currency system including a remittance device which is the source of electronic currency to which additional information is added each time a remittance is made, and a receiving device which is the destination of the electronic currency,
The aforementioned money transfer device is
A verification key receiving unit configured to receive the group verification key of the group to which the aforementioned deposit device belongs,
A signature unit is configured to generate a group signature for the hash value of the last added information attached to the electronic currency and the group verification key using the member signature key of the remittance device,
A currency transmission unit configured to transmit the electronic currency to the deposit device, to which the group verification key, the hash value, and the group signature are added as additional information,
An electronic currency system characterized by having the following features. The aforementioned deposit device is
A verification unit is configured to verify the group signature attached to the electronic currency received from the remittance device using the group verification key of the group to which the remittance device belongs.
The electronic currency system according to claim 1, characterized by having the following features. A remittance device that is the source of electronic currency remittances to which additional information is added each time a remittance is made,
A verification key receiving unit is configured to receive the group verification key of the group to which the receiving device that is the recipient of the electronic currency belongs,
A signature unit is configured to generate a group signature for the hash value of the last added information attached to the electronic currency and the group verification key using the member signature key of the remittance device,
A currency transmission unit configured to transmit the electronic currency to the deposit device, to which the group verification key, the hash value, and the group signature are added as additional information,
A money transfer device characterized by having the following features. A remittance device that is the source of electronic currency to which additional information is added each time a transfer is made.
A verification key receiving procedure configured to receive the group verification key of the group to which the receiving device that is the recipient of the electronic currency belongs,
A signing procedure that generates a group signature for the hash value of the last added information attached to the electronic currency and the group verification key using the member signing key of the remittance device,
A currency transmission procedure for transmitting the electronic currency to the receiving device, to which the group verification key, the hash value, and the group signature are attached as additional information,
A transmission method characterized by performing the following. The remittance device, which is the source of the electronic currency to which additional information is added each time a transfer is made,
A verification key receiving procedure configured to receive the group verification key of the group to which the receiving device that is the recipient of the electronic currency belongs,
A signing procedure that generates a group signature for the hash value of the last added information attached to the electronic currency and the group verification key using the member signing key of the remittance device,
A currency transmission procedure for transmitting the electronic currency to the receiving device, to which the group verification key, the hash value, and the group signature are attached as additional information,
A program to execute.