JP2003317018A - Quantum cash method, apparatus therefor, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To have forgery impossibility based upon the principles of quantum mechanics, to keep anonymity, and to reduce the amount of secret information held at a bank. <P>SOLUTION: Random columns A=(a1,..., ak) are generated, relative bits ci are generated by EXORing the products of corresponding elements by A and the rows of an open matrix M of (m) rows × (n) columns, and a quantum bit column |ϕ> is generated by encoding aj with a base Z when b(v,j) (or b(v,k+i))=0 and aj with a base X when 1 by secret random columns B<SP>(v)</SP>=(b(v,1),..., b(v,k), b(v,k+1),..., b(v,k+m)) of an issued face amount and the respective bits to obtain cash (|ϕ>,v); when this is used, e1,..., em are obtained by EXORing the products of corresponding elements by the row of (n)-bit random columns D and M and the corresponding quantum bits of |ϕ> are converted in quantum state as they are with the bit column D and bits e1,..., em when dj (or ei) is 0 or by 90° rotation when 1 to |ϕ'> to perform payment with (|ϕ'>,v). <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a quantum cash method, a quantum cash method in which a quantum state is used as cash on the basis of a principle of quantum mechanics as a basis for impossibility of forgery, a device thereof, and a program thereof.

[0002]

2. Description of the Related Art Various types of electronic cash have been proposed. These electronic cash have been secured by using tamper resistant media or digital signature technology. However, the tamper-resistant medium can be broken in principle if there are advanced printing technology and device technology. It is also known that the digital signature is also based on computational complexity, and can be broken if it takes a huge amount of calculation time, or if the quantum computer is completed in the future, it will be broken in a realistic calculation time. Quantum cash is S. Wiesner: Conjugate Coding,
Manuscript written circa 1970, unpublished until i
t appeared in Sigact News, Vol.15, No.1 pp.78-88 (1
983). In Wiesner's quantum cash method, the non-clonable theorem of quantum mechanics is the basis for non-counterfeiting. This Wiesner method is briefly explained.
Confidential information K = {ID, (a1, b1), (a2, b2), ...
(An, bn)} is kept secret in the database of the bank device. Here, ID is a serial number attached to each cash,
(Ai, bi) (i = 1, ..., N) is randomly selected from {0, 1}. Quantum cash is a quantum state consisting of ID and n qubits | φ> = | Ψ _{a1, b1} >, | Ψ _{a2, b2} >,
…, | Ψ _{an, bn} >. Here, the qubit | Ψ _{ai, bi} > is one of the following four quantum states.

| Ψ₀₀> = | 0 > │Ψ_Ten> = | 1 > │Ψ₀₁> = (| 0 > + | 1 >) / √2 │Ψ₁₁> = (| 0 >-| 1 >) / √2 The value bi defines the basis. If bi is 0, ai is the basis Z
Encoded with (| 0>, | 1>), and if bi is 1, ai
Is the basis X (| 0 > + | 1 >) / √2, (| 0 >-|
1 >) / √2. For example, if you
When using (| 0> is 0 °, | 1> is 90 °, (|
0 > + | 1 >) / √2 is 45 °, (| 0 >-| 1
>) / √2 is 135 °, bi = 0, ai = 0
Then 0 °, if ai = 1 then 90 ° is encoded, bi = 1
If ai = 0, sign 45 °; if ai = 1, sign 135 °
Be converted.

When the user requests the bank to issue quantum cash, the bank retrieves one of the secret information K from the database, encodes its (ai, bi) sequence into the quantum state | φ>, and the quantum cash Issue (ID, | φ>) to the user. The user pays quantum cash at the retail store. The retail store sends the quantum cash to the bank for verification. The bank extracts K from the ID of the received quantum cash from the database, and according to its (ai, bi), has each quantum bit | Ψ _{ai, bi} > of quantum φ | φ>, and if bi is 0, the basis Observe at Z, and if bi is 1, observe at base X. Then, it verifies that the observation result is ai. (Ai, b
i) If at least one of (i = 1, ..., N) is different from ai, it is determined that the quantum cash is not valid.

[0005]

[Problems to be Solved by the Invention] 1. The basis of the non-counterfeiting of the conventional electronic cash method is based on the realistic assumption that the tamper resistant device is forced to be enforced, or the computational complexity assumption of the digital signature, and does not guarantee the security in principle. It was 2. In the conventional quantum cash method, the bank needs to store the secret information K for each quantum cash, and the database of the bank becomes huge. 3. With conventional quantum cash, after the bank issued it, it was used by the user, and there was no change in the quantum cash before returning to the bank. Therefore, by recording which quantum cash the bank has passed to which user, the bank can identify the user who used the cash and know how the user used the quantum cash. That is, the anonymity of the user was not protected.

An object of the present invention is to provide a quantum cash method, an apparatus thereof and a program thereof capable of solving the above problems 1 and 2 at the same time. Another object of the present invention is to provide a quantum cash method, an apparatus and a program thereof which can solve the above problems 1, 2, and 3 at the same time.

[0007]

In the present invention, the principle of quantum mechanics is used and the quantum state is used for cash to prevent copy in principle, like Wiesner's quantum cash. According to this, information B ^(v) peculiar to each cash face value v is secretly prepared, and random information for cash is encoded into a quantum state based on each element of the information B ^(v) peculiar to this face value. The basis of the case is determined, and the amount of data that is kept secret is small. Furthermore, random information A for cash is generated for each quantum cash, the related information c related to the random information A is generated using the random information A and the public matrix M, and the related information is also included in the face value specific information B ⁽ By encoding to the quantum state by ^{v), the} amount of quantum cash data is also small.

According to the second aspect of the present invention, when the user device uses quantum cash (| φ>, v), it generates conversion random information D, and the random information D and the public matrix M are used.
, The related information e is generated in the same manner as the generation of the related information c.
Is generated, and the quantum state | φ> of the quantum cash is unitarily transformed by the random sequence B and the related information e to obtain the quantum state |
φ ′>, and send the quantum cash (| φ ′>, v) to the retail store device, the retail store device sends (| φ ′>, v) to the bank device to request verification, and the bank device | φ '> Is observed by a basis based on a unique random face value sequence corresponding to v, and it is verified whether the observation result of each quantum state element satisfies the relevance used to generate the above-mentioned related information c, and It is judged to be valid if the above condition is satisfied at a predetermined rate or more. As a result, the quantum state of the quantum cash is different between when the quantum cash is issued and when it is verified, and anonymity is obtained.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION A system to which the method of the present invention is applied is, for example, as shown in FIG. 1, a device (hereinafter, referred to as a bank device) 100 included in an institution (hereinafter, referred to as a bank) that issues quantum cash and a device (hereinafter, referred to as a bank device). , Those who are issued quantum cash (hereinafter,
A device (hereinafter referred to as a user device) 200 included in a user and a device (hereinafter referred to as a retail store device) included in an institution (hereinafter referred to as a retail store) that receives quantum cash 30
0 and 0 can communicate with each other through a communication path. The face value v of quantum cash to be issued to the bank device 100 is, for example, 1 yen, 10 yen, 100 yen, 1000 yen, 10000.
For each circle, a k + n-bit denomination-specific random sequence, B ^(v) = (b (v, 1), ..., b (v, k), b (v, k + 1), ..., b
(v, k + n)) b (v, j), b (v, k + i) ε {0,1}, j = 1,
, K, i = 1, ..., N are secretly stored in the secret information storage unit 101 (see FIG. 2). In other words, a k + n-bit random sequence of 0 and 1 may be generated for each face value v and secretly stored for each face value v. v may be represented by a 3-bit face value identifier if the number of types is 5 according to each face value of 1 yen, 10 yen, ....

A random matrix of n rows and k columns

[Equation 7] Is generated as related information generating information, which is released so that each user device can freely use it and is stored in the public information storage unit 102.

Issuance of quantum cash When a user wants to issue quantum cash, a quantum cash issuance request including the amount of money to be issued and user identification information is transmitted from the user device 200 to the bank device 100. . The bank device 100 issues a quantum cash issuance request to the communication unit 103.
When received at, the random sequence generation unit 104 generates a k-bit cash unique random sequence A = (a1, ..., Ak), ajε {0,1}. This random sequence A is generated by the related information generation unit 105.
And public information M, and for each row of M, the exclusive OR of products of corresponding elements with A ci = a1 · m _{i, 1} (+) ... (+) ak · m _{i, k} (2) The calculation is performed to generate the related information c = (c1, ..., Cn). A (+) B represents the exclusive OR of A and B. That is, the relation bit ci represents the relation between the random column A and each row of the public information M.

A face value v corresponding to the amount of quantum cash to be issued, for example, a face value specific random sequence B for 1000 yen
^(v) is read from the storage unit 101, the k + n bits thereof are sequentially associated with the k-bit random sequence A and the n-bit related information c, and the quantum state encoding unit 107 uses the buffer 1
Random face-specific random sequence B ^{(v) in} 06 and related information insertion part 1
The pair of bits associated with each other in 05 are sequentially taken out, and b
Quantum bit | Ψ _{aj, b (v, j} ) by encoding aj (or ci) into a quantum state with a basis determined by (v, j) (or b (v, k + 1))
₎ > (Or | Ψ _{ci, b (v, k + i)} >). For example, assuming that the four quantum states are equation (1), if b (v, j) is 0, then ai is encoded with the basis Z and b (v, j) is 1 as in the case of the prior art. Then, aj is encoded with the base X. c
i is encoded by b (v, k + i). As a result, the quantum state | φ> = (| Ψ _{ai, b (v, 1)} >, ..., | Ψ _{ak, b (v, k)} >, |
Ψ _{c1, b (v, k + 1)} >, ..., │Ψ _{cn, b (v, k + n)} >) is obtained.

The quantum state | φ> and the face value v are transmitted as quantum cash to the requested user device 200 from the communication unit 103, and the issued amount v is withdrawn from the user's account. The user device 200 stores the quantum cash (| φ>, v) received by the communication unit 201 in the storage unit 202 as illustrated in FIG. 3. In the bank device 100, the control unit 108 sequentially operates each unit for the quantum cash issuing process. Quantum cash (| φ>, v) is transmitted by using a quantum communication channel for | φ> and a classical communication channel for v, or by converting v into a quantum state code and transmitting the quantum cash channel. Good.

Quantum cash user The user device 200 uses public information for generating related information as necessary.

[Equation 8] The public information M may be stored in advance in the public information storage unit 203, or the public information M may be ordered from the bank device 100 or the public bulletin board device as necessary. The user is quantum cash (| φ
>, V), the user device 200 (see FIG. 3) uses the k + n-bit conversion random sequence D from the random sequence generation unit 204 as D = (d1, ..., dk, dk + 1, ,, dk + n) is generated. In the related information generation unit 205, the exclusive OR of the product of the random sequence D and the public information M with the corresponding element of the random column D for each row of the public information M ei = d1 · m _{i, 1} (+) ... (+) _Dk · mi _{, k} (3) is calculated to generate related information e = (e1, ..., En).

The quantum state | φ> is extracted from the storage unit 202, the k + n-bit quantum bits of | φ>, the k-bit random sequence D and the n-bit related information e are sequentially associated with each other, and both associated bits are associated with each other. In the unitary conversion unit 206
Corresponding quantum bit | Ψ according to j
_{aj, b (v, j)} >. Unitary conversion

[Equation 9] And substituting (π / 2) dj for θ, | Ψ _{aj, b (v, j)}
> Is converted. That is, if dj = 0, then | Ψ
_{aj, b (v, j)} > remains, and if dj = 1, then |
Ψ _{a j, b (v, j)} > is rotated by 90 °. That is, four states of the polarization direction of quantum (0 ° (180 °), 45 ° (225
, 90 ° (270 °), 135 ° (315 °)), the polarization direction of the qubit remains unchanged when dj = 0, but the polarization direction of the qubit changes when dj = 1. It is rotated by 90 ° and the bit of dj is inverted. The unitary transformation for | φ> is U = U ((π / 2) d1), ..., U ((π / 2) dk), U
((Π / 2) e1), ..., U ((π / 2) en). The quantum state thus transformed is represented as | φ ′>. Since the method of generating the related information e for the conversion random sequence D and the method of generating the related information c for the random sequence A unique to quantum cash are the same, | φ ′> is A and c existing in | φ>. This means that the quantum state was converted while maintaining the relationship with. The | φ ′> and v are transmitted as quantum cash from the communication unit 201 to the retail store apparatus 300. The control unit 208 causes the user device 200 to sequentially operate the above-described units. The storage unit 20
2 may convert | φ> into | φ ′> and hold it, and may read | φ ′> at the time of payment and send it together with v to the retail store apparatus 300. Alternatively, | φ> received from the bank device 100 may be unitarily converted without being stored in the storage unit 202 and transmitted to the retail store device 300.

Verification of Quantum Cash The retail store apparatus 300 sends the quantum cash (|
When the payment by φ ′>, v) is received, the quantum cash (| φ ′>, v) is sent to the bank device 100 to request verification. When the verification request is received by the communication unit 103, the bank device 100 takes out the face value-specific random sequence B ^(v) from the secret information storage unit 101 with the face value ^v , and the observation unit 111 uses each bit b (v, j) thereof. , B (v, k + i), the corresponding qubits | φ ′ _{aj, b (v, j)} ＞,
Observe the quantum state of | Ψ ′ _{ei, b (v, k + i)} >. The bit strings read by this observation are defined as a'1, ..., a'k, c'1, ..., c'n. In the verification unit 112, a ′ in this observed bit string c
, ..., a′k, and the exclusive OR of the product of each row of the public information M in the public information storage unit 102 and its corresponding element c ″ i = a′1 · m _{j, 1} (+) ... (+) A′k · m _{i, k} (4) is calculated, that is, the related information c ″ i is generated by the calculation unit 112a by the same method as described above, and the related information c ″ i is generated.
Is determined by the determination unit 112b to match the corresponding bit c′i in the observed bit string, and if all i = 1, ..., N are satisfied, then | φ ′> corresponds to | φ>. That is, it is determined that the quantum cash is legitimate, and if even one is not satisfied (| φ ′>, v), it is determined that the quantum cash is illegal, and the communication unit 103 notifies the retail store apparatus 300 of the determination result.

As described above, in unitary conversion, if dj and ei are 0, the corresponding quantum bit is left unchanged,
If dj and ei are 1, the corresponding qubit is rotated by 90 °. Therefore, regarding aj, the value obtained by taking the exclusive OR of dj and aj is a'j. Therefore a
, Ak and d1, ..., Dk corresponding bits a'1, ..., a'k, the result c'of the related information generating operation of equation (4) ″ I is a1,
Is equal to the value ci obtained by performing the related information generation operation by the equation (2) on ak, and the result ei by performing the related information generation operation on the d1, ..., dj by the equation (3). Become. That is, a1, ..., By the formula (2)
The relation between ak and each ci is held also in | φ ′>, and it is checked whether or not the relation between the related information c and the random string A is held by the equation (4) for the observed bit string. .

The control unit 108 sequentially operates each unit when the verification request is received. The verification unit 112 determines that the quantum cash (| φ ′>, v) is valid,
When the retail store device 300 receives the notification, the retail store device 300 receives the quantum cash (| φ ′ by the user device 200).
>, V), and the quantum cash (| φ ′
>, V) into the bank's retail account or (|
φ ′>, v) is returned, and the bank device 100 is instructed whether or not to use it as own quantum cash. If the verification fails, the retail store device 300 does not allow payment by the (| φ ′>, v) of the user device 200. When the bank device 100 receives an instruction to deposit money into the account, it deposits the amount v into the account of the retail store, and then discards (| φ ′>, v),
If the verification fails, discard it.
>, V) is returned.

When the bank device 100 issues (| φ ′>, v) to the user device 200 and when the retail store device 300 requests verification of (| φ ′>, v), the quantum state becomes ｜
Since φ> and | φ ′> are different, (| φ ′>, v)
Cannot know to which user device 200 it was issued. Moreover, since the related information is generated by using the public information, the quantum cash data amount can be reduced. When the number of issuances of quantum cash of the same face value increases, the face value random sequence B ^(v) may be known. From this point, it is better that the value of k + n is large, for example 100 or a value larger than that. Similarly, from the viewpoint of safety, k> n, for example, n may be about 100 and k may be about twice as large as n. In the above description, the issuance request amount is equal to one of the face values v. However, if the request amount is 1,300 yen, the face value is 10,000 yen (| φ
>, V5) and the face value of 1,000 yen (| φ>, v4), (| φ
>, V4), (| φ>, v4), (v5 represents a face value of 10,000 yen, v4 represents a face value of 1,000 yen, and each | φ> is different from each other).

The quantum states that can be taken by each qubit are not limited to the equation (1), and │Ψ ₀₀ > = │Ψ _x > │Ψ ₁₀ > = │Ψ ′ _x > │Ψ ₀₁ > = │Ψ _y > │Ψ _It may be four states of ₁₁ > = | Ψ ′ _y >. | Ψ _x > and | Ψ _x ′> are orthogonal to each other, and | Ψ _y > and | Ψ _y ′> are also orthogonal to each other, but | Ψ _x > and | Ψ _y > are non-orthogonal. If b (v, j) (or b (v, k + 1)) is 0, the basis X (| Ψ _x >, | Ψ _x ′
>), If 1 then aj in the basis Y (| Ψ _y > and | Ψ _y ′>)
(Or ci) is encoded.

In the above description, if the equation (4) is not satisfied even for one i, it is determined to be unacceptable. However, if the equation (4) is 90% or more, it may be determined to be acceptable. By doing this, some false detections and malfunctions are allowed,
It becomes possible to operate at such a high speed or to configure at a low cost. Furthermore, the element b (v,
j) and b (v, k + i) are not limited to binary cases of 0 and 1, and b (v, j), b (v, k + i) ε {0,1, ..., q-1}, q
May be an integer of 2 or more, that is, q may be 3 or more. Similarly, ajε {0, 1, ..., P-1}, and p may be an integer of 2 or more. The related information ci, ei is generated with the value of the function f having variables a1, ..., Ak as ci = f (a1, ..., Ak).

The qubit | Ψ _{aj, b (v, j)} >, | Ψ
_{ci, b (v, k + i)} > is one of q × p kinds of quantum devices,
The unitary transformation holds the relationship of ei = f (d1, ..., Dk), and the verification verifies whether or not c'i = f (a'1, ..., a'k) holds. FIG. 4 shows the bank device 100.
An example of the processing procedure of is shown. When the quantum cash issuance request is received from the user device 200 (S1), a random sequence A made up of n elements is generated (S2), and the random sequence A and the product of corresponding elements of each row of the public information M are calculated. The exclusive OR is calculated to generate the related information c = (c1, ..., cm) (S
3) The quantum face-specific random sequence B ^(v) consisting of n + m elements of the face value corresponding to the amount requested to be issued is fetched from the storage unit (S4), and the face-value-specific random sequence B ^(v) is arranged in the order of elements. On the basis of the above, each element of the random sequence A and the related information c is sequentially encoded into one of the quantum states to generate a quantum bit, and the quantum state | φ> consisting of the quantum bit sequence is obtained (S5). The | φ> and v are transmitted to the user device 200 as quantum cash (S6).

Next, it is checked whether or not the verification request is received from the retail store apparatus 300 (S7). If the verification request is received, the storage unit 1 is determined by the face value v of the received quantum cash (| φ '>, v).
The random facet-specific random sequence B ^(v) is read from 01 (S
8), using the element b (v, j) (or b (v, k + i)) as a basis reference, sequentially observe and observe the quantum states of the corresponding quantum bits of the quantum state | φ ′> Find element sequence (S
9). The first n a'1, ..., a'n of the observed element sequence
For each row of and the public information M, the exclusive OR of the product with the corresponding element is obtained, and it is verified whether or not this matches the corresponding observed value c′i (S10). If so, the quantum cash (| φ ′>, v) is determined to be valid, the result is notified to the retail store apparatus 300, and the process returns to step S1 (S11).

If the issuance request has not been received in step S1, the process proceeds to step S7, and if the verification request has not been received in step S7, the process returns to step S1. The bank device 100 shown in FIG. 2 and the user device 200 shown in FIG. 3 can be made to function by executing a program by a computer. In that case, for example, a bank device processing program for causing a computer to execute the processing procedure shown in FIG. 4 is installed in the computer from a recording medium such as a CD-ROM or a flexible magnetic disk, or is downloaded via a communication line. Then, the computer may execute the program.

[0025]

As described above, according to the present invention, since the information which has the forgery by the principle of quantum mechanics and which is secretly stored in the bank device is only the random sequence for each face value, The storage capacity can be significantly reduced as compared with the case where each piece of information corresponding to all quantum cash is stored. Moreover, since the related information is generated using the public information M, the data amount of each quantum cash can be made relatively small. Quantum cash (| φ ′>, v) issued by a bank device and quantum cash (| φ ′>, v) that is used for payment and verified by the bank device have a quantum state of | φ> Since it is changed to | φ ′>, it is not known to which user device (| φ ′>, v) is issued and anonymity is maintained. Moreover, the change from | φ> to | φ ′> makes it possible to verify the legitimacy of quantum cash based on whether the method of generating related information is the same and whether the relationship is satisfied.

[Brief description of drawings]

FIG. 1 is a diagram showing a minimum configuration example of a system to which the method of the present invention is applied.

FIG. 2 is a diagram showing a functional configuration example of a bank device according to the present invention.

FIG. 3 is a diagram showing a functional configuration example of a user device according to the present invention.

FIG. 4 is a flowchart showing an example of a processing procedure of a bank device.

Claims (12)

[Claims] 1. A device (hereinafter, referred to as a bank device) of a quantum cash issuing institution (hereinafter, referred to as a bank) has secretly holds face value specific information for each face value and discloses related information generating information. When a quantum cash issuance request is received from a device (hereinafter, referred to as a user device) of a person who issues quantum cash (hereinafter referred to as a user), quantum cash unique information is generated and associated with the quantum cash unique information. Generating related information from the information for information generation, based on the face value specific information corresponding to the requested face value of the quantum cash, the quantum cash specific information and the related information are encoded into a quantum state, and the quantum state and the request. A quantum cash method, characterized in that the calculated face value information is sent to a user device as quantum cash. 2. When the user uses the quantum cash, the user device generates conversion information, and based on the conversion information and the related information generating information, the quantum cash unique information and the related information. The second related information having the same relationship as the relationship of 1 is generated, and by using the conversion information and the second related information, the quantum state of quantum cash is changed to another quantum state while maintaining the relationship. The converted quantum state and the face value information are converted and sent to a device (hereinafter, a retail store device) of an institution (hereinafter, a retail store) that receives the quantum cash, and the retail store device receives the quantum cash. When the bank device receives a request for verification of validity, the received quantum state retains the above relevance using the face value information and the corresponding face value specific information. Check whether or not Quantum cash method of claim 1, wherein the verify the validity of the quantum cash, and sends the verification result to the retail store system. 3. A device (hereinafter, referred to as a bank device) of an institution that issues quantum cash (hereinafter, referred to as a bank) has a face value v.
A denomination-specific random sequence B ^(v) = (b (v, 1), b (v, 2), ..., b (v, k), b (v, k +)
1), ..., b (v, k + n)) b (v, j) ε {0,1, ..., q-1,
j = 1, ..., k, b (v, k + i) ε {0,1, ..., q-1}
i = 1, ..., N, k> n, q holds integers of 2 or more in the storage unit in secret, and a matrix of n rows and k columns When the quantum cash issuance request is received from a device (hereinafter, referred to as a user device) of a person (hereinafter, referred to as a user) who issues quantum cash as related information generation information, the quantum with the number k of elements is received. Random sequence for cash, A = (a1, a2, ..., Ak), ajε {0, 1, ...,
p-1}, p generates an integer of 2 or more, and an association function value ci = f (m _{i, 1} ··) in which the product of each element of the random column A and the corresponding element of each row of the public matrix M is a variable a1, ..., M _{i, k} · ak) to generate related information c = (c1, ..., cn), and each element of the random sequence A and related information c is set as the face value of the amount requested to be issued. A quantum state encoded into one of q × p kinds of quantum states, based on the corresponding element of the corresponding denomination-specific random sequence B ^(v) , | φ> = | Ψ _{a1, b (v, 1)} >, ... , | Ψ _{ak, b (v, k)} ＞, ｜ Ψ
_{c1, b (k + 1)} >, ..., | Ψ _{cn, b (k + n)} > is generated, and the quantum state | φ> and the face value v are transferred to the user device as quantum cash (| φ>, v). A quantum cash method characterized by transmitting. 4. When a user uses quantum cash (| φ>, v), the user device uses a conversion random sequence D = (d1, d2, ..., dk), djε {with the number of elements k. 0, 1, ...
p-1} is generated and the product of each element of the random column D and the corresponding element of each row of the public matrix M is used as a variable, and the associated function value ei = f (m _{i, 1} · d1, ..., m _{i, k} · dk) to generate related information e = (e1, ..., ek), and each element of each quantum state element sequence of the quantum state | φ> of the quantum cash is associated with the random sequence D and the related information e. The unit corresponding to each of the elements is converted into another quantum state | φ ′>, and the other quantum state | φ ′> and v are used as quantum cash. Hereinafter referred to as a retail store)
To the bank device (hereinafter referred to as a retail store device), the retail store device sends the received quantum cash (| φ ′>, v) to the bank device to request verification, and the bank device requests the verification request ( | Φ ′>, v) and the face-value-specific random sequence B ^(v) corresponding to v, and the received quantum state | φ ′ according to the basis based on each corresponding element
, A'k, c'1, ..., C'n are generated from the observed elements, and a'1, ..., A'in the observed element sequence are observed. The product of k and the corresponding element of each row of the public matrix M is obtained, and the product is used as a variable to associate the association function value fc ″ i = f (m _{i, 1} · a′1, ..., m _{i, k} · a′k ) Is verified, and it is verified whether or not the calculation result c ″ i matches the corresponding element c′i in the observation element sequence. If the number of matching is equal to or more than a predetermined rate, the quantum cash is valid. The quantum cash method according to claim 3, wherein the determination result is transmitted to the retail store device. 5. The above q and p are respectively integers 2 and
Calculation of the association function value f ci = m_{i, 1} ・ A1 (+) ... (+) m_{i, cn}・ AK Where A (+) B represents the exclusive OR of A and B
Then Quantum state of q × p = 4 │Ψ₀₀> = | Ψ_x> │Ψ_Ten> = | Ψ ′_x> │Ψ₀₁> = | Ψ_y> │Ψ₁₁> = | Ψ ′_y> , Where | Ψ_x＞ ⊥ ｜ Ψ ′_x>, | Ψ_y＞ ⊥ ｜
Ψ ′_y>, And | Ψ_x> And | Ψ_y> Is non-orthogonal,
A⊥B indicates that A and B are in an orthogonal relationship, and b
If (v, j) and b (v, k + i) are 0, base aj and ci respectively
X (| Ψ_x>, | Ψ ′ _x>) Respectively, and b
If (v, j) and b (v, k + i) are 1, then aj and ci are set to the basis Y (| Ψ
_y>, | Ψ ′_y>) Is used to encode each
The quantum cash method according to claim 3 or 4. 6. The unitary conversion is expressed as follows: Then, for each qubit of | φ>, U = U ((π / 2) d1), ..., U ((π / 2) dk), U
6. The quantum cash method according to claim 5, wherein conversion of ((π / 2) e1), ..., U ((π / 2) en) is performed. 7. The four quantum states are | Ψ ₀₀ > = | 0 ＞ ｜ Ψ ₁₀ ＞ ＝ ｜ 1 ＞ ｜ Ψ ₀₁ ＞ ＝ (| 0 > + | 1 >) / √2 | Ψ ₁₁ > = (| 0 >-| 1 >) / √2. 7. The quantum cash method according to claim 6, wherein 8. A denomination-specific random sequence for each denomination v B^(v) = (B (v, 1), b (v, 2), ..., b (v, k), b (v, k +
1), ..., b (v, k + n)) b (v, j), b (v, k + i) ε {0,
1}, j = 1, ..., K, i = 1, ..., N, k> n
A storage unit that stores densely, Public information for generating related information [Equation 3] A storage unit for storing Quantum cash-specific random sequence with k elements A = (a1, a2, ..., ak), ajε {0, 1} A random sequence generator that generates A pair of each element of the random column A and each row of the public information M
Exclusive OR of product with response element ci = a1 · m_{i, 1}(+) ... (+) ak ・ m_{i, k} To generate related information c = (c1, ..., cn)
A related information generator, Quantum states │Ψ₀₀> = | 0 > │Ψ_Ten> = | 1 > │Ψ₀₁> = (| 0 > + | 1 >) / √2 │Ψ₁₁> = (| 0 >-| 1 >) / √2 If b (v, j) and b (v, k + i) are 0, then a
Let j, ci be the basis Z (| 0 >, | 1 >), And b
If (v, j) and b (v, k + i) are 1, they are based on aj and ci, respectively.
Bottom X ((| 0 > + | 1 >) / √2, (| 0 >-| 1
>) / √2) encoded and qubit string | Φ> = (| Ψ_{a1, b (v, 1)}>, ..., | Ψ_{ak, b (v, k)}>, |
Ψ_{c1, b (v, k + 1)}>, ..., | Ψ_{cn, b (v, k + n)}＞) To generate a quantum cash unique random sequence A and its related information.
Face value random sequence B for report c^(v) Quantum state by
A quantum state encoding unit that generates Communication means, The communication means receives the quantum cash issuance request from the user device.
And the above-mentioned quantum
Generate a cash unique random sequence A and its related information c,
Face value specific random sequence B according to the face value v requested to be issued
^(v)The quantum state encoding unit extracts the A and
And c to B^(v)To generate the quantum state | φ>
Let the quantum state | φ> and face value v be quantum cash in the communication means.
Amount provided with control means for transmitting to the user device as
Child cash method banking equipment. 9. Each quantum bit of the quantum state | φ ′> is observed by a basis based on the corresponding element of the denomination-specific random sequence B ^(v) of the denomination v, and the bit sequence A ′ = (a′1, ..., a'k, c'1, ..., C'n), and the observation information and public information [Formula 4] , And a ′ in the bit string A ′ for each row of the public information M, ...
An exclusive OR of a product of corresponding elements with a'k a'1.m _{i, 1} (+) ... (+) a'k.m _{i, k} = c'i is calculated, and this calculation result c It is checked whether'i matches c'i in the observed bit string A ', and if the verification results for all i match, the quantum cash (| φ'>, v)
When the verification unit that determines that the value is valid and the communication unit receives a request for verification of the validity of the quantum cash (| φ ′>, v) from the retail store device, the face value-specific random sequence B ^(v) of the face value v Take out the B
^The control means for observing the quantum state | φ ′> by ^(v), causing the verification unit to perform the above-mentioned verification on the read bit string A ′, and causing the communication means to transmit the verification result to the retail store device. 9. The banking device for the quantum cash method according to claim 8, further comprising: 10. Public information [Formula 5] , A random sequence generator that generates a k-bit random sequence D, an exclusive OR of products of the element of each row of the public information M and the corresponding element of the random sequence D ei = m _{i , 1} · d1 (+) ... (+) m _{i, k} · dk dj ε {0,1} to generate related information e = (e1, ..., en), and a unitary transformation Let U (θ) be Then, for each quantum bit of the quantum state | φ>, U = U ((π / 2) d1), ..., U ((π / 2) dk), U
A unitary transformation unit that outputs the quantum state | φ ′> transformed by performing unitary transformation by associating each transformation element of ((π / 2) ei), ..., U ((π / 2) en) with each other, For the communication unit and the quantum cash (| φ>, v), the random sequence generation unit generates the random sequence D, the related information generation unit generates the related information e, and the unitary conversion unit uses D and e. And a control unit for causing the communication unit to transmit | φ '> and v as quantum cash to the retail store device. 11. A bank device processing program for causing a computer to function as the bank device according to claim 8 or 9. 12. A user device processing program for causing a computer to function as the user device according to claim 10.