Privacy-preserving secure offline payments

1 . A processor-implemented method for an interim commitment scheme maintaining security during offline transactions, the method comprising:

adding, by a paying user, funds from a funding source to an initial token using an initial commitment scheme, the initial commitment scheme including a paying user identification (ID), an initial monetary value of the initial token, and an initial random seed number;

creating, by the paying user, a new token for an offline transaction with a receiving user, the new token being based on the initial token, a new commitment scheme of the new token includes the initial commitment scheme and adds the paying user ID, a new monetary value of the new token, and a new random seed number, wherein creating the new token without an internet connection includes:

producing a proof that a value of the new token is equal to a value of the initial token, the proof being a zero-knowledge proof;

producing, by a secure element, a signature for the new token using anonymous credentials, via blind signatures, wherein producing the signature includes checking the signature for validity;

executing a transaction between the paying user and the receiving user based on the initial token, the new token, the proof, and the signature; and

in response to executing the transaction with the receiving user, deleting, by the secure element, the initial token;

depositing the new token into a receiving intermediary;

settling the value between a central authority and the receiving intermediary, wherein the new monetary value of the new token is equal to the initial value of the initial token; and

upon successfully settling the value, deleting the new token, as a post-transaction value of the new token is zero.

2 . The method of claim 1 , wherein the initial token is stored on the secure element.

3 . The method of claim 1 , further comprising:

creating a ciphertext of paying user's identity corresponding to the new token; and

sending the ciphertext along with the executed transaction between the paying user and the receiving user corresponding to the initial token, the new token, the proof, and the signature.

4 . The method of claim 3 , further comprising:

identifying that the initial token was spent twice; and

decrypting the ciphertext.

5 . A computer system for an interim commitment scheme maintaining security during offline transactions, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable storage media, and program instructions stored on at least one of the one or more computer-readable storage media for execution by at least one of the one or more processors via at least one of the one or more computer-readable memories, wherein the program instructions cause the one or more processors to perform a method comprising:

adding, by a paying user, funds from a funding source to an initial token using an initial commitment scheme, the initial commitment scheme including a paying user identification (ID), an initial monetary value of the initial token, and an initial random seed number;

creating, by the paying user, a new token for an offline transaction with a receiving user, the new token being based on the initial token, a new commitment scheme of the new token includes the initial commitment scheme and adds the paying user ID, a new monetary value of the new token, and a new random seed number, wherein creating the new token without an internet connection includes:

producing a proof that a value of the new token is equal to a value of the initial token, the proof being a zero-knowledge proof;

producing, by a secure element, a signature for the new token using anonymous credentials, via blind signatures, wherein producing the signature includes checking the signature for validity;

executing a transaction between the paying user and the receiving user based on the initial token, the new token, the proof, and the signature; and

in response to executing the transaction with the receiving user, deleting, by the secure element, the initial token;

depositing the new token into a receiving intermediary;

settling the value between a central authority and the receiving intermediary, wherein the new monetary value of the new token is equal to the initial value of the initial token; and

upon successfully settling the value, deleting the new token, as a post-transaction value of the new token is zero.

6 . The computer system of claim 5 , wherein the initial token is stored on the secure element.

7 . The computer system of claim 5 , further comprising:

creating a ciphertext of paying user's identity corresponding to the new token; and

sending the ciphertext along with the executed transaction between the paying user and the receiving user corresponding to the initial token, the new token, the proof, and the signature.

8 . The computer system of claim 7 , further comprising:

identifying that the initial token was spent twice; and

decrypting the ciphertext.

9 . A computer program product comprising:

one or more computer-readable storage media and program instructions stored on at least one of the one or more computer-readable storage media, the program instructions executable by a processor capable of performing a method comprising:

adding, by a paying user, funds from a funding source to an initial token using an initial commitment scheme, the initial commitment scheme including a paying user identification (ID), an initial monetary value of the initial token, and an initial random seed number;

creating, by the paying user, a new token for an offline transaction with a receiving user, the new token being based on the initial token, a new commitment scheme of the new token includes the initial commitment scheme and adds the paying user ID, a new monetary value of the new token, and a new random seed number, wherein creating the new token without an internet connection includes:

producing a proof that a value of the new token is equal to a value of the initial token, the proof being a zero-knowledge proof;

producing, by a secure element, a signature for the new token using anonymous credentials, via blind signatures, wherein producing the signature includes checking the signature for validity;

executing a transaction between the paying user and the receiving user based on the initial token, the new token, the proof, and the signature; and

in response to executing the transaction with the receiving user, deleting, by the secure element, the initial token;

depositing the new token into a receiving intermediary;

settling the value between a central authority and the receiving intermediary, wherein the new monetary value of the new token is equal to the initial value of the initial token; and

upon successfully settling the value, deleting the new token, as a post-transaction value of the new token is zero.

10 . The computer program product of claim 9 , wherein the initial token is stored on the secure element.

11 . The computer program product of claim 9 , further comprising:

creating a ciphertext of paying user's identity corresponding to the new token; and

sending the ciphertext along with the executed transaction between the paying user and the receiving user corresponding to the initial token, the new token, the proof, and the signature.

12 . The computer program product of claim 11 , further comprising:

identifying that the initial token was spent twice; and

decrypting the ciphertext.