The basic concept of electronic cash system, electronic cash (E-cash), also known as electronic money or digital currency, is a very important electronic payment system, which can be regarded as an electronic or digital simulation of real money. Electronic cash exists in the form of digital information and circulates through the Internet. But it is more convenient and economical than real money. Its simplest form includes three subjects: merchants, users and banks; And four security protocol processes: initialization protocol, withdrawal protocol, payment protocol and deposit protocol. Chaum [2] put forward the first electronic cash scheme in 1982. It is implemented by blind signature technology, which can completely protect the privacy of users. However, this completely anonymous electronic cash has also provided convenience for many criminals, who use its completely anonymity to carry out some illegal and criminal activities, such as corruption and illegal purchases (such as buying drugs and arms). ), extortion and so on. Even if the police get the stolen money, they can't catch the criminal. Therefore, a reasonable electronic cash system should be incomplete or conditionally anonymous. In 1995, Stadhle et al [3] put forward the concept of fair blind signature, which can be used in conditional anonymous payment system. In 1996, Camenisch et al. [4] and Frankel et al. [5] independently put forward the concept of fair off-line electronic cash for the first time, and gave two schemes at the same time. The anonymity of users in fair electronic cash is incomplete, and it can be revoked by a trusted third party (TTP), thus using the complete anonymity of electronic cash to prevent criminal activities. In its life cycle, electronic cash has to go through three processes: withdrawal, payment and deposit, involving users, merchants and banks. The basic circulation mode of electronic cash is shown in figure 1. The user signs a withdrawal agreement with the bank to withdraw electronic cash from the bank; The user and the merchant execute a payment agreement to pay electronic cash; The merchant and the bank execute the deposit agreement and deposit the electronic cash obtained from the transaction into the bank. The basic process of electronic cash design is as follows: 1. Withdrawal agreement: users withdraw electronic cash from their bank accounts. In order to obtain legal electronic cash with bank signature on the premise of ensuring users' anonymity, users will interact with banks to realize blind signature protocol, and banks must be sure that electronic cash contains the necessary user identity. The general withdrawal agreement is divided into the following two steps: * account opening agreement. This step is usually computationally intensive and is used to provide users with an electronic license containing their identity information. * Withdraw from the agreement. This step is just a simple blind signature process, and users can withdraw electronic cash from their accounts. 2. Payment agreement: users use electronic cash to buy goods from stores. It is usually divided into two sub-protocols: * Verifying the signature of electronic cash, which is used to confirm whether electronic cash is legal or not. * Knowledge disclosure agreement. Buyers will disclose some of their identity information to sellers to prevent buyers from abusing electronic cash. 3. Deposit agreement: users and businesses deposit electronic cash into their bank accounts. In this step, the Bank of China will check whether the deposited electronic cash is legally used. If illegal use is found, the bank will use reuse detection protocol to track the identity of illegal users and punish them.