To reduce storage capacity for challenge even in the case of simultaneously receiving plural electronic moneys.

A recipient generates random numbers R1 and R2 and prepares hash values G1 and G2 of respective connections of R1 and R2, recipient ID and public key and challenge identification information ChallID is generated and preserved in a storage part. Then, a received amount (x), R1, R2 and ChallID are enciphered by K and that code eC and challenge (G1, G2, x, ChallID) are sent to a payer. A payer signature S corresponding to the challenge, electronic money and received eC are sent to the recipient. The recipient deciphers the eC and it is verified whether the ChallID in that eC is equal with the preserved ChallID or not. Then, hash values G1 and G2 of respective continuation between the deciphered R1 and R2 and IdUB and PkUB are prepared. While using these hash values, dechiphered (x), ChallID and PkUA, S is verified and the received electronic money passing both the verifications is received.