WO2014040717A1

WO2014040717A1 - Wallet-to-wallet transmission of an electronic amount of money (coin)

Info

Publication number: WO2014040717A1
Application number: PCT/EP2013/002698
Authority: WO
Inventors: Helmut Scherzer
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2012-09-11
Filing date: 2013-09-09
Publication date: 2014-03-20
Also published as: EP2896003A1

Abstract

The invention provides a method for transmitting an electronic amount of money (G), wherein the amount of money (G) is transmitted from a first electronic wallet (A) to a second electronic wallet (B), wherein the amount of money (G) is deducted from the first electronic wallet (A) and is credited to the second electronic wallet (B). The amount of money is locked before transmission and is deducted from the first wallet after transmission. A release token is generated in response to the deduction, which release token is sent to the second wallet and is used to unlock the amount of money there.

Description

Exchange-to-Exchange Transfer of an electronic amount of money (coin)

The invention relates to a method for the transfer (transfer) of an electronic money ("electronic coin", "coin") from a first electronic purse to a second electronic purse.

In an electronic wallet (sometimes called electronic purse or eWallet), for example, the German so-called money card, is stored against payment in advance of a sum of money in a chip of the purse a stock amount corresponding to the amount of money and also the

Amount of money recorded on a shadow account in the background system of the purse. When paying a sum of money with the purse to a merchant terminal, the total amount in the wallet is reduced by the amount of money and a record corresponding to the amount of money is transferred to the merchant's terminal. There is no connection to the background system, i. the payment is made "offline." Only after the close of the box, the dealer terminal settles the money collected from payments with wallets with the background system, only then the account balances of the shadow accounts of all purses, from which payments were accepted, tracked the receipt of funds from a purse It is not possible to transfer money directly from one purse to another, as there is a risk that money may be duplicated in the course of the direct transfer from one purse to another.

Electronic purses are mainly used for the payment of small amounts (small amounts) of a few euros, in the field of so-called micropayment. Meanwhile, there are also a number of micropayment systems. At BitCoin, the customer acquires electronic units in BitCoin currency and The units can redeem for goods from partners who accept the BitCoin currency or sell them again. The BitCoin units are not tied to any physical electronic purse. At Bitmint, a customer receives a cash payment

Bitstring comprising an N (e.g., 32) multiplied by the amount of bytes-long random number. The smallest available unit of 1 cent is an N (e.g., 32) byte long random number. An amount of money of x cents consists of an N * x byte long random number. The bit string can also be stored in a physical data carrier and taken away.

WO 2007/106866 A2 describes the transmission of electronic money managed by a financial background system from a sender to a receiver through the financial background system. In order to transfer a sum of money from the sender to the recipient, the sender can send an identifier for the amount of money from the background system and sends the identifier to the recipient. As soon as a responsible entity in the background system receives the identifier from the recipient, the background system transfers the control over the monetary amount from the sender to the recipient. During the entire payment process, a connection to the background system is required.

From the perspective of the user of an electronic wallet, it would be desirable to transfer funds offline directly from one purse to another, analogous to the transfer of cash. On the one hand, there is the danger that the sender will not delete the money from his purse and spend several times. On the other hand, the sender can not be sure that the recipient has received the money. Loss of money threatens. Once the sender clears the money in his purse, He can not send him to the recipient again if he has any doubt that the recipient has received the money. Expressed in abstract terms, the amount of money is to be reliably teleported from the purse of the sender to that of the recipient, ie reliably disappear at the sender and reliably arrive at the recipient.

The invention is based on the object to provide a method for transferring an electronic amount of money (an electronic coin) from a first electronic purse to a second electronic purse, which is secured against both loss and improper duplication of the amount of money.

The object is achieved by a method according to claim 1. Advantageous embodiments of the invention are given in the dependent claims.

The method of claim 1 is for transmitting an electronic amount of money from a first purse of a sender to a second purse of a recipient provided. The money is transferred from the first electronic purse to the second electronic purse. The amount of money is deducted at the first electronic purse, i. deleted, ie deducted from the total balance of the first wallet, and on the second electronic wallet booked, i. added to the existing balance on the second wallet. The method is characterized in that

a) the amount of money is blocked before being transferred to the second electronic purse, so that the amount of money through the second purse can not be used for a payment; b) the blocked amount of money is transferred from the first electronic purse to the second electronic purse;

c) the blocked amount of money is stored in the second electronic purse;

d) an acknowledgment of receipt is transmitted from the second electronic purse to the first electronic purse;

e) the receipt is received at the first electronic purse;

f) in response to receipt of the acknowledgment, the amount of money is cleared at the first electronic purse;

g) releasing a release token at the first electronic purse for transmission to the second electronic purse in response to the debiting of the amount of money;

h) the release token is transferred from the first electronic purse to the second electronic purse;

i) the release token is received at the second electronic purse; and

j) is unlocked at the second electronic purse with the release token of the blocked amount of money, so that the amount of money can be used by the second wallet for a payment.

Blocking the amount of money in step a) lays the foundation for not having the money in two purses at the same time in usable (payable, payable) form. Incidentally, it also causes a third party to steal the money, but can not use it. If the recipient, ie the holder of the second wallet, has not received the amount of money, the sender, ie the holder of the first wallet, can simply send it back to the recipient. On the other hand, once the sender (first purse) has received the receipt has received the transmission according to step e), the transmitter can be sure that the receiver has received the amount of money. Thus, the sender can debit the amount of money in the first purse calmed down (ie delete). The amount of money is thus secured against loss. The sender can also expect to actually receive the acknowledgment from the recipient. Namely, the receiver is motivated to send the acknowledgment to the sender because he still needs the sender's token to unlock the amount of money received. Conversely, the sender would have no benefit in retaining a generated release token instead of sending it to the recipient. Because the amount of money is at the sender, if there is a release token already deleted. A non-ending of the free-go-to-dok would only upset the recipient and prevent him from future dealings with the broadcaster. The amount of money is also secured against duplication at the transmitter. Once the sender has sent the amount of money to the recipient, and once the recipient has received the amount of money, the sender is required to send the release token. The sender only reaches the release token after he has cleared (debited) the amount of money in his (first) wallet. If the sender wants to fulfill his obligation, he must therefore forcibly delete the amount of money and can not keep the amount of money, eg for a second transfer, eg to a third party.

The sender preferably keeps the release token with him until he can be sure that the recipient has received the release token. If the recipient has not received the release token, which may occur due to transmission problems between sender and receiver, for example, he will request it again from the sender. The sender can safely retransmit the sharing token as often as necessary. Therefore, according to claim 1, there is provided a method of transferring an electronic money (electronic coin) from a first electronic purse to a second electronic purse, which is secured against loss as well as against improper copying of the money.

According to step g), the release token is released in response to the clearing of the amount of money. Optionally, the release token already exists. Depending on the embodiment, it may alternatively be provided that the release token is generated only in response to the deletion of the amount of money and then released for sending.

If, after repeated sending of the money at the first purse no receipt confirmation is received, it is preferably assumed by the first purse that the second purse has not received the amount of money. Therefore, if the receipt is not received at the first electronic purse after a predetermined time interval has elapsed at step e), then at the first purse, step a) of sending the money is repeated. Since the money is blocked, resending does not duplicate the money.

Optionally, further, after the transmission after step b) has been repeated once or several times, a release token according to step g) can be generated only at the last amount of money sent. This causes the re-transmission to be an acknowledgment of the first sending of a sum of money and not the sending of a new additional amount of money. Optionally, the holder of the first wallet can be provided with a choice between either sending the same amount of money again as a confirmation (amount of money is debited only once), or alternatively sending a new amount of money (amount is deducted as often as sent).

Optionally, if the release token is not received or not received at the second electronic purse after a predetermined time interval according to step i), the second electronic purse causes step h) of the release token to be sent to the first purse is repeated. For example, the second wallet sends a request to the first wallet as many times as necessary to resend the release token until the release token arrives at the second wallet. In the first wallet, a secure runtime environment is preferably set up under administration of a first secure operating system, a secure runtime environment is set up in the second wallet under the management of a second secure operating system, and between the secure runtime environment of the first wallet and the secure runtime environment of the second wallet cryptographically secured transmission channel set up. In this case, a secure transmission system is formed by the secure runtime environments of the first and second wallet and the cryptographically secured transmission channel. The operations of blocking the amount of money in step a), releasing the release token in step g) and unlocking in step j) are carried out within the secure transmission system, in particular without the possibility of interference of a user of the first wallet and no possibility of action of a user of the second wallet , This ensures particularly reliably that the amount of money and the release can not be sent multiple times so that several recipients can receive it and subsequently unlock it.

Optionally, the amount of money is individualized by marking the amount of money with a unique identifier, in particular a random number, newly generated for each transaction of transferring a sum of money according to step b). This makes each transaction of sending money unique. Sending the money again is a distinguishable new process.

Optionally, for each iteration of transmission after step b), the amount of money is re-personalized and any existing previously individualized funds are deleted without releasing a release token for transmission to the second purse. Each retransmission with a newly individualized amount of money and a subsequent retention of the release tokens means a confirmation of the same amount of money. The amount of money will, after it has been sent several times, only (at the most) once on the first purse debited. On the other hand, according to an alternative, optionally additionally possible new sending of an amount of money with a new generation of a release token, on the other hand, causes the amount of money to be debited and sent as often as possible.

Optionally, the amount of money and the release token are tailored to one another in such a way that with the correspondingly individualized release token, only the individualized amount of money blocked according to step a) can be unlocked.

Optionally will continue

in step a) the amount of money through operational processing, in particular XOR-ung, with the identifier blocked and at the same time individualized to a blocked, individualized amount of money;

in step b) the blocked, individualized amount of money is sent;

in step d) the blocked, individualized amount of money is sent as an acknowledgment of receipt;

in step f) additionally the individualized amount of money deleted;

in step g) the identifier is released as a release token; and

in step j) the blocked, individualized amount of money is unlocked with the identifier by operational processing, in particular renewed XOR-ung.

As an identifier, for example, a random number can be provided. For example, an encryption with a session key can be provided as operational processing that simultaneously brings about blocking and individualization.

Optionally, on the occasion of the blocking of a cash amount according to step a) or on the occasion of the transfer of a cash amount in step b), it is checked whether one or more release tokens are stored in the first wallet, and release tokens stored in the first wallet are deleted. This ensures that share tokens can not be used multiple times to unlock multiple different amounts of money. Optionally, in the first purse, a symmetrical or asymmetrical key pair is generated with an encryption key and a decryption key, wherein further: in step a) the amount of money is blocked by means of the encryption key, in particular by encrypting the amount of money with the encryption key; in Step g) is released in response to debiting the amount of the decryption keys as release tokens at the first electronic purse for transmission to the second electronic purse; and in step h) the blocked amount of money is unlocked, in particular decrypted, with the decryption key in the second electronic purse. In the symmetric variant, the encryption key and the decryption key are identical; in the asymmetrical variant, they are identical. Optionally, the key pair is kept in a secure transmission system, as stated above, in particular without accessibility of a user of the first purse and without access of a user of the second purse to the key pair. Optionally, a new key pair is generated for each transaction of blocking of a cash amount according to step a), so that the release token generated according to step g) is usable only at most for unlocking the associated amount of money previously transferred in step b). In particular, as keys (encryption and decryption keys), session keys are generated which are usable only once.

In the following, the invention will be explained in more detail with reference to exemplary embodiments and with reference to the drawing, in which: Fig. 1 shows a system for illustrating the invention;

Fig. 2 shows another system for illustrating the invention.

1 shows a first electronic wallet (eWallet) A implemented in a mobile telephone and an implemen- tation in another mobile telephone. second money wallet (e Wallet) B. A sum of money G, a coin (analogously an electronic coin), is to be teleported from A to B. The first purse A locks the amount of money G so as to be unlockable with a release token FT, and sends the restricted amount of money G / FT together with a random number as the identifier ID to the second purse B. The second purse B stores the locked coin G. / FT and sends to the first purse A an acknowledgment EB / ID, which includes the identifier ID. As soon as the first wallet A has received the receipt confirmation EB / ID and has recognized that the identifier ID matches the identifier of the amount of money G, the first wallet A clears the amount of money G in it. Immediately by the deletion, a release token appears in the first wallet A. FT released for the amount of money G with the identifier ID. The first purse A sends the release token FT together with the identifier ID to the second purse B. The second purse B identifies that the identifier ID of the release token FT matches the identifier ID of the previously stored restricted amount G, and unlocks the amount of money G with the release token FT.

As a result, the total amount of money G has been destroyed in the first wallet A and has been generated at the second wallet B, ie teleported from A to B.

FIG. 2 shows a system similar to that shown in FIG. In the system of Fig. 2, the amount of money G COIN is thereby locked in the first wallet A and simultaneously individualized to be encrypted with a public session key SKPUK derived from the public key PUK of an asymmetrical key pair to ENC Coin (SKPUK). In step b), the thus encoded monetary amount G * = ENC Coin (SKPUK) is sent to the second purse B, together with the public public session key SKPUK. The second wallet B sends d) the public session key SKPUK as a receipt EB back to the first wallet A. In response to receipt of the receipt EB, at the first purse A, the amount of money G f) is cleared and then the private session key SKPRK g) corresponding to the public session key SKPUK is released and h) sent to the second purse. In the second wallet B i) the encrypted amount of money ENC Coin (SKPUK) is decrypted with the received private session key SKPRK to G = Coin = DEC ENC Coin (SKPUK) (SKPRK). The amount of money G is now freely available at the second wallet B and deleted successfully at the first wallet A. Each session key SKPUK, SKPRK can only be used for a single transfer of a monetary amount, for example, by deriving the key PUK or PRK using a random number. This individualization is achieved.

According to FIG. 2, the amount of money G has been blocked and individualized by encryption with a session key SKPUK. Alternatively, the amount of money can be locked and unlocked by encryption with a symmetric key, in particular session key. As acknowledgment of receipt, e.g. a hash over the symmetric

Keys, in particular session keys, are used. As a release token, the key or session key is used for decryption. Alternatively, the amount of money can be locked and customized by encrypting with an identifier ID, in particular a random number RND, to GxID. The acknowledgment of receipt is GxID. For unlocking, again with the random number ver-XOR-t, i. the identifier ID, in particular random number RND, is transmitted from A to B as the release token.

Claims

Patent claims

A method for transferring an electronic money amount (G), wherein the amount of money (G) is transferred from a first electronic wallet (A) to a second electronic wallet (B), the amount of money (G) at the first electronic wallet (A ) is deducted by being deleted and posted on the second electronic purse (B),

characterized in that

a) the amount of money (G) is blocked before being transferred to the second electronic purse (B) so that the amount of money (G) can not be used for payment by the second purse (B);

b) transferring the blocked amount of money (G) from the first electronic purse (A) to the second electronic purse (B);

c) the blocked amount of money (G) is stored in the second electronic purse (B);

d) an acknowledgment of receipt (EB) is transmitted from the second electronic purse (B) to the first electronic purse (A);

e) the receipt (EB) is received at the first electronic purse (A);

f) in response to receipt of the receipt (EB), the amount of money (G) at the first electronic purse (A) is deleted;

g) in response to the deletion of the amount of money (G) a release token (FT) is released at the first electronic wallet (A) for transmission to the second electronic wallet (B);

h) the release token (FT) is transferred from the first electronic purse (A) to the second electronic purse (B);

i) the release token (FT) is received at the second electronic purse (B); and j) is unlocked at the second electronic purse (B) with the release token (FT) of the locked amount of money (G), so that the amount of money (G) through the second wallet (B) can be used for a payment.

2. The method according to claim 1, wherein, if the acknowledgment of receipt (EB) is not or not received after expiration of a predetermined time interval according to step e) at the first electronic wallet (A), at the first wallet (A) the step b) of Sending the blocked amount (G) is repeated.

3. The method of claim 2, wherein, after the transmission after step b) has been repeated once or several times, only at the last amount of money (G) sent a release token (FT) according to step g) is generated.

4. The method according to any one of claims 1 to 3, wherein, if the release token (FT) or not after a predetermined time interval according to step i) is received at the second electronic wallet (B), at the second electronic purse (B) causing the first purse (A) to repeat step h) of transferring the release token (FT).

5. The method according to any one of claims 1 to 4, wherein

in the first wallet (A) a secure runtime environment is set up under the management of a first secure operating system,

- in the second wallet (B) a secure runtime environment is set up under management of a second secure operating system, and

a cryptographically secured transmission channel is set up between the secure runtime environment of the first wallet (A) and the secure runtime environment of the second wallet (B), wherein a secured transmission system is formed by the secure runtime environment of the first wallet (A), the secure runtime environment of the second wallet (B) and the cryptographically secured transmission channel;

where next

the operations of blocking the amount of money (G) in step a), releasing the release token (FT) in step g) and unlocking in step j) are carried out within the secure transmission system, in particular without the possibility of influencing a user of the first wallet and without being able to act a user of the second wallet.

6. The method according to any one of claims 1 to 5, wherein the amount of money (G) is individualized by the amount of money (G) with a unique identifier (ID), in particular a random number (RND) is marked, for each transaction the transfer of a monetary amount (G) according to step b) is newly generated.

7. The method of claim 2 in conjunction with claim 6, wherein for each repetition of sending after step b) the amount of money (G) is newly individualized and still existing previously individualized amounts of money (G) are deleted without a release token (FT ) is released for transmission to the second purse (B).

8. The method according to claim 6 or 7, wherein the amount of money (G) and the release token (FT) are tailored to one another in such a way that with the corresponding individualized release token (FT) only the individualized amount of money (G) blocked according to step a) is unlocked can.

9. The method according to any one of claims 1 to 8, wherein

in step a) the amount of money (G) is blocked by operational processing, in particular ver-XOR-ung, with the identifier (ID) and at the same time individualized to a blocked, individualized amount of money (GxID); in step b) the blocked individualized amount of money (GxID) is sent;

in step d) the blocked, individualized amount of money (GxID) is sent as an acknowledgment of receipt;

in step f) additionally the individualized amount of money (GxID) is deleted; in step g) the identifier (ID) is released as a release token (FT); and

in step j) the blocked, individualized amount of money (GxID) is unlocked by operative processing, in particular re-XOR-ung, with the identifier (ID).

10. The method according to any one of claims 1 to 9, wherein

on the occasion of the blocking of a cash amount (G) according to step a) or on the occasion of the transfer of a cash amount (G) according to step b), it is checked whether one or more release tokens (FT) are stored in the first wallet (A), and in the first wallet (A) stored release token (FT) are deleted.

11. Method according to one of claims 1 to 10, wherein in the first wallet (A) a symmetrical or asymmetrical key pair with an encryption key (K; PuK; PrK) and a decryption key (K; PrK; PuK) is generated, wherein

in step a) the amount of money (G) is blocked by means of the encryption key (K; PuK; PrK), in particular by encrypting the amount of money (G) with the encryption key (K; PuK; PrK); in step g), in response to the debiting of the amount of money (G), the decryption key is released as the release token (FT) at the first electronic purse (A) for transfer to the second electronic purse (B); and

- In step h) at the second electronic purse (B) with the decryption key of the locked amount of money (G) unlocked, in particular decrypted is.

12. The method according to claim 11, wherein the key pair is kept in a secure transmission system according to claim 5, in particular without access possibility of a user of the first purse and without access of a user of the second purse to the key pair.

13. The method according to claim 11 or 12, wherein a new key pair is generated for each transaction of blocking a cash amount according to step a), so that the release token (FT) generated according to step g) only at most for unlocking the associated, before according to step b) transferred amount of money (G) is usable.