A Study in Electronic Commerce: Bank User Manual

Cornell University
Computer Science Department
Masters of Engineering Project
Spring 1998

Han-Yang Lo
Sanjeev Topiwala
Joyce Wang
with assistance from Keith Sollers

Under the supervision of: Professor Fred B. Schneider
Last modified: Friday, April 24, 1998

Bank User Manual

The central V-Cash bank is currently run by V-Cash employees.  The central bank will eventually support the availability of V-Cash system in various banks internationally.  The reason for a central bank is three-fold. First of all, the simplifying assumption is that the merchant and consumer have accounts at the same bank. In addition, the bank can serve as a certifying authority, assigning public/private keypairs for each of their clients. This property also makes it easier to check the double spending of coins. The obvious vulnerability here is that the spent coin database is a single point of failure. The bank logs all connections from Consumers or Merchants.

Initialization

The software is initialized upon starting up the V-Cash bank server.

There is a utility program which generates account number and public/private key pairs for the consumer at the bank side. The bank runs this utility to genrate the following files:

• user?pub.rsa
  • which consists of the user's public key
• user?pv.rsa
  • which consists of account number and associated private key for the user.
• merc?pub.rsa
  • which consists of the merchant's public key.
• merc?pv.rsa
  • which consists of the merchant's account number and associated private key for the merchant.
• account.bnk
  • which consists of the information about all account numbers, associated public keys and opening balance for each account.

    The bank uses the file account.bnk which is the account database for the bank.

Setting Up Consumer Accounts

In addition, the same utility program is used to generate:

• The file user?pv.rsa
  • sent to the user along with the software. The account number in the file corresponds to the user.

Setting Up Merchant Accounts

The utility program is also used to generate:

• The file merc?pv.rsa and merc?pub.rsa is sent to the merchant along with the software.
  • The merchant uses the merc?pub.rsa for setting up the web site and the other file is used by the server program.

Providing Software and Documentation

The bank should be able to provide easily accessible software and documentation. We recommend setting up an FTP server for bank customers.

Generating Public/Private Keypairs

A utility is included to generate keypairs for each user. For detailed description refer to "setting up Consumer Accounts". This utility can be found in the Application pages. The source will also be provided.

Storing Account and Coin Information

The key management/account and coin databases are beyond the scope of this project. We are currently implementing a flat file, read in by the bank server upon startup. This is not scaleable, but serves for demonstration purposes. The account "database" is the account.bnk file described above. The spent coin "database" is the serials.bnk file.

Logs

The bank logs contains:

• Date
• Withdraw/Deposit/Change
• Success/Failure
• Account Number
• Amount of transaction

Security Issues

• Public/Private keypair generation
• Duplication of serial number generation

Future Features and Functions

Future improvements include:

• Developing a key management database for the bank
• Developing a coin management database for the bank
• Extending Elliptical Curve Cryptography for blinding, in order to incorporate ECC (instead of RSA) for coin signing and encryption
• Using a Multiple Linear Congruential Generator for generating serial numbers, instead of the Linear Congruential Generator we are currently using to make it less likely for a serial number collision.
• Adding functionality for SSL
• Coin recovery after a crash by an automatic rebuild from logs
• Improvement of the serial number generator
• Scaleability testing
• Making the logs tamper-proof

Available Documentation

Specifications
Design Documentation
Consumer User Manual
Merchant User Manual
Bank User Manual
Demonstration of V-Cash