Blockchain anonymous electronic voting method based on zk-snark

Abstract

The present application belongs to the technical field of information security, and particularly relates to a blockchain anonymous electronic voting method based on zk-SNARK. The purpose is to prove that the standard model under the standard assumption is safe, and to improve and perfect the characteristics of the existing voting, such as eligibility, privacy, anonymity, double voting, no receipt, anti-coercion and other aspects. Including the following steps: step 1: the initialization algorithm of system running, generating system parameters, and the public and private key pair set corresponding to the candidate; step 2: user registration stage; step 3: when the voter wants to pre-vote the vote vector; step 4: the voter formally votes for the candidate, generates the ciphertext of the encrypted vote and the aggregation result of the ciphertext; step 5: get the final vote number of the candidate.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a blockchain anonymous electronic voting method based on zk-SNARK. Background Technology

[0002] With the continuous development of electronic and network technologies, people's reliance on the internet is increasing, especially communication technology, which has become an indispensable part of people's lives. Network and information security are also receiving increasing attention as technology advances. Voting is a way for people to express their thoughts on a particular issue in real life, and it is widely used in public office elections and decision-making on various matters. The results of voting often have a profound impact on society or individuals. Therefore, the fairness, security, and privacy of voting are extremely important.

[0003] Before the advent of information technology, voting was primarily conducted through methods such as show of hands and anonymous paper ballots. While these traditional voting methods still play an important role today, they have many shortcomings: 1. Traditional voting methods are prone to manipulation; 2. The phenomenon of following the crowd is particularly serious in traditional voting; 3. Traditional voting methods have significant limitations, among other shortcomings.

[0004] With the development of the internet, communication technology, and modern cryptography, a new voting method—electronic voting—has gradually gained social attention. Its aim is to achieve remote voting in an internet environment while ensuring a secure, convenient, efficient, and fair voting mechanism. As long as there is internet access, people can vote from anywhere. Currently, there are three main types of voting systems for this purpose: electronic voting schemes based on blind signatures and ring signatures, electronic voting schemes based on homomorphic encryption, and electronic voting schemes based on hybrid networks. Each of these three voting schemes has its own shortcomings and problems.

[0005] In recent years, with the increasing popularity of cryptocurrencies such as Bitcoin, their underlying ledger technology—blockchain technology—has also attracted much attention from researchers. The essence of blockchain is a transparent database ledger that records all transactions. Blockchain's key feature is that it provides decentralized, immutable, transparent, and secure characteristics without a third-party intermediary. Currently, many electronic voting schemes combining blockchain technology have been proposed. For example, an electronic voting protocol combining Bitcoin was proposed in 2015, which was the first attempt to combine electronic voting with blockchain.

[0006] While the above-mentioned electronic voting methods have largely solved the problems associated with current electronic voting, improvements are still needed in areas such as eligibility, privacy, anonymity, double voting, lack of receipts, and resistance to coercion. Summary of the Invention

[0007] This invention addresses the shortcomings of existing technologies by providing a blockchain-based anonymous electronic voting method based on zk-SNARK. Its aim is to improve and refine existing voting characteristics, such as eligibility, privacy, anonymity, double-voting, receiptlessness, and resistance to duress, based on the proven security of the standard model under standard assumptions. This further enhances the fairness and security of electronic voting. This invention overcomes the deficiencies of existing technologies and provides a more secure electronic voting scheme.

[0008] To achieve the above objectives, the present invention adopts the following technical solution, which includes the following steps.

[0009] Step 1: The system runs an initialization algorithm to generate system parameters and a set of public and private key pairs {mpk, msk} corresponding to the candidates.

[0010] Step 2: User registration phase. This phase consists of two algorithms, both invoked by the authoritative EA (Expert Advisor). The first algorithm is the user registration algorithm, which completes the user registration process. The second algorithm is used to calculate the master private key for decryption. This is to prepare for the subsequent decryption.

[0011] Step 3: When voter v i To adjust the vote vector $val i Perform the preliminary voting operation by calling AdvanceVote(v i $val i This is done by generating the data ξ for minting coins, and the vote vector $val. i Each and every one of them has made a commitment and provided proof.

[0012] Step 4: Voter v i For candidates Conduct a formal vote and generate the encrypted vote ciphertext Ct. i and the aggregation results of the ciphertext

[0013] Step 5: CountVote() → (T m，num , π i The algorithm is executed at the arrival timestamp T4 of EA to obtain candidates. The final number of votes.

[0014] Further, step 1 includes...

[0015] Step 1-1: GroupGen(1 λ → params; (The system obtains the system parameter params using this algorithm); By inputting the security parameter 1λ Output system parameters in It is a product of The generated group is of order p, where p is a prime number of order λ.

[0016] Steps 1-2: Setup (1 λ 1 m → {mpk, msk}; (This algorithm) generates candidates through the authoritative Expert Advisor (EA). The corresponding public / private key pair; (this algorithm) is achieved by inputting security parameter 1. λ Given the number of candidates m, obtain m pairs of public and private keys (sk1, pk1), ..., (sk j , pk j ) j∈[m] Where mpk = (pk1, ..., pk) m ),msk=(sk1,...,sk m ).

[0017] Furthermore, step 2 includes...

[0018] Step 2-1: Register(v i :(cred))→{v i ,C};Register(v i :(cred, addr))→{v i C} represents the registration agreement executed between the user and the EA; this agreement is the one between the user v i After EA verifies the transaction by entering a cred string, payment is made to v. i A virtual coin C with a value of 1 is used as a voting qualification to trigger a transaction tx;

[0019] Step 2-2: The algorithm inputs candidates The private key set msk is used in conjunction with the weight value set mw of all voters to obtain the master key used for decryption by each candidate. For later decryption.

[0020] Furthermore, step 3 includes...

[0021] Step 3-1: Mint(v i $val i →ξ; This algorithm is for voters v l First, submit the voting vector $val. i Generate a pre-voting coin ξ: = {v i ,com i coin i , sni}, where the vector commitment comm i Vector coin i Serial number sn i .

[0022] Step 3-2: Proof(v i $val i The algorithm is based on the submitted vote vector $val. i Each person makes a commitment and provides proof, and receives To ensure that each bit is either 0 or 1.

[0023] Furthermore, step 4 includes...

[0024] Step 4-1: Encrypt(mpk, [$val i ])→{v i Ct i} i∈[n] Encrypt(mpk, [$val]) i r i ) i∈[n] →{v i Ct i} i∈[n] The algorithm is for voter v i By inputting the public key set mpk published by EA and the voter v in step 3 i The voting vector $val used for pre-voting i and random number r i Generate the voting vector $val i Each encrypted ciphertext Ct i .

[0025] Step 4-2: This algorithm is SC for ciphertext {v i Ct i} i∈[n] The set first categorizes them to obtain the corresponding candidates. ciphertext sequence Then the sequence In Partial aggregation yields Partial aggregation yields

[0026] Furthermore, step 5 includes...

[0027] Step 5-1: This algorithm allows EA to obtain aggregated ciphertext from BC. The algorithm is triggered based on the timestamp T4, and the EA can only call this algorithm at this stage to obtain the aggregated ciphertext data in order to decrypt it.

[0028] Step 5-2: The algorithm inputs aggregated data. and master key Decrypt to obtain each candidate number of votes

[0029] Step 5-3: The algorithm is called after decrypting and counting the number of candidate votes in step 5-2, and the input is the sequence of vote results for each candidate. Output a new sequence from largest to smallest.

[0030] Compared with the prior art, the present invention has the following advantages.

[0031] 1. The solution of this invention can guarantee voter v i The anonymity of voting is ensured through the aggregation of ciphertext, guaranteeing that even if the authoritative body EA possesses the private key, it cannot know the voter's identity. i Which candidate did you vote for?

[0032] 2. The solution of this invention can guarantee voter v i A vote can be cast if and only if only one vote can be cast. The Mint() algorithm in this invention guarantees this, ensuring that each voter can only mint one coin with a valid vote, which is guaranteed by the sequence number sn.

[0033] 3. No receipt required: The present invention ensures that no entity can provide evidence of which voter the ballot belongs to. After the ciphertext is aggregated by SC, no one knows which specific ballot it is.

[0034] 4. Resistance to coercion; malicious individuals coerce voters. i To a candidate Because voting guarantees no receipts, malicious actors cannot know the voter's identity. i Did you vote for the candidate? Therefore, the present invention ensures resistance to stress. Attached Figure Description

[0035] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. The scope of protection of the present invention is not limited to the following description.

[0036] Figure 1 System architecture diagram (initialization phase, registration phase, pre-voting phase).

[0037] Figure 2 System architecture diagram (voting phase, vote counting phase).

[0038] Figure 3 This is a table explaining some symbols in the present invention. Detailed Implementation

[0039] like Figure 1-3 As shown in the specific implementation, it includes five stages: initialization stage, registration stage, pre-voting stage, voting stage, and vote counting stage. The detailed algorithm implementation for each stage is described below.

[0040] 1. Initialization phase.

[0041] The initialization phase first calls GroupGen(1) λ The algorithm generates the parameters required for this purpose. Then call Setup(1) λ 1 m The algorithm generates m pairs of public and private keys (sk1, pk1), ..., (sk m , pk m ), The public key set mpk will be published for use in the subsequent encrypted voting phase.

[0042] 2. Registration phase.

[0043] This stage is achieved by calling Register(v i :(cred)),Register(v i (cred, addr)) is user v i This process involves communication and coordination with the authoritative body, EA. This stage transforms ineligible users into eligible voters. Users submit their valid credentials (e.g., ID card, email address, passport) to EA, and EA verifies them before distributing the votes to voters. i A voting coin C with a value of 1 triggers a corresponding transaction tx. Since our focus is not on this, we haven't implemented the transaction tx specifically. This transaction tx is uploaded to BC for verification in later stages. This stage needs to be completed within the time period T < T1. After the registration process is complete, EA needs to complete the verification of voter v before the time period T3. i Role (for different voters) i The weights are assigned to the identities of employees. For example: Chairman: 5; General Manager: 3; Department Manager: 2; Employee: 1) Weight mw = {w1, w2, ..., w nThe settings for} are not detailed in our paper because our focus is not on setting different user weights. The KeyDer(msk, mw) algorithm (the decryption master key used during the vote counting phase) is configured before time period T4. The main process at this stage is as follows: (This is the initial call to the function.)

[0044] 1> Users participating in the election v i First, you need to create an empty wallet, then send the user's wallet address (addr) to EA. i (Changed to addr) and cred.

[0045] 2>EA first verifies T < T1, and then verifies the validity of cred.

[0046] 3> After EA verification is passed, it will be sent to qualified voters. i Paying a virtual coin C with a value of 1 indicates that the user is eligible to vote, and the transaction tx is uploaded to BC for subsequent verification of the voter's eligibility.

[0047] 4. Before the T4 time period of the vote counting phase, complete the call to the algorithm KeyDer(msk, mw) to generate the master key. Right now

[0048] 3. Pre-voting stage.

[0049] The pre-voting stage is for voters to vote. i Voter's intention to vote is determined before the official vote, and this phase is completed within the time period T1 < T < T2. i The pre-voting algorithm AdvanceVote(v) needs to be called. i $val i ), <The algorithm is for voters v i Submit vote vector $val i Through the algorithm Mint(v i $val i ) for the vote vector $val i Perform the minting operation; then call Proof(v i $val i The algorithm applies the vote vector $val i Each element makes a commitment and provides a proof to guarantee the vector $val. i Each digit in the data consists of either 0 or 1. The data is then submitted to the SC for verification, and finally uploaded to the BC. Below is a detailed process and algorithm for the pre-voting phase.

[0050] 1> Voter v i Submit voting vector $vali ∈[0,1} m ∧||$val i || = 1, call Mint(v) i $val i The algorithm completes the vote vector $val i The minting operation in the scheme uses the vector commitment algorithm Commit($val) for the commitment. i ;r) Generates the commitment value comm. And generates the proof π for the coin.

[0051] 2> After completing the minting operation, in order to ensure that the voter's submitted ballot vector $val i Each digit is composed of 0 or 1 (where 0 represents no vote; 1 represents vote), and Proof(v) is called. i $val i The algorithm makes a commitment and proof for each bit, and guarantees |$val i |==1, to ensure that each voter can only vote for one candidate.

[0052] 3> Send the pre-selected ballots {ξ, π, ζ} to SC for verification. Once verified, upload them to BC.

[0053] SC received from voter v i The preliminary vote data {ξ, π, ζ} is verified, and the valid preliminary vote data {ξ, π, ζ} is uploaded to BC.

[0054] 4. Voting stage.

[0055] This stage takes place after all voters have completed the pre-voting phase and the formal voting is completed within the specified timestamps T2 < T < T3.

[0056] Voter v i First, obtain candidates from BC. The public key set mpk, and the encrypted public key of each candidate. Call Encrypt(mpk, [$val i ], r i ) i∈[n] Encrypt(mpk, [$val) i ], r i ) i∈[n] The algorithm provides voters with Mint(v) during the pre-voting phase. i $val i The vote vector $val used in ) i and random number r iThen, each item is encrypted. This is to ensure that this stage and the pre-voting stage use the same vote vector $val. i This resulted in a proof of π, which was used to verify its validity.

[0057] SC receives voter v i Submitted ballot b i First, obtain voter data from BC. i In the pre-voting algorithm Mint(v i $val i The pledge value of the ballot coin (comm) i Then, for ballot b i Verification is required.

[0058] Call Aggregate({v i Ct i} i∈[n] The algorithm first processes valid tickets b. i The ciphertext {v i Ct i} i∈[n] Classify to obtain sequences Then SC obtains the weight set mw of all voters from BC and begins processing the sequence. The items inside are aggregated to obtain the ciphertext aggregation result needed for decryption. in Decryption sequence All The aggregation results Decryption sequence All The aggregated result of the calculation of the voter weight value mw.

[0059] This algorithm effectively prevents the Expert Analyst (EA) from decrypting a specific voter's ciphertext when it already knows the ciphertext, thus avoiding the possibility of knowing the voter's ciphertext. i The voting results will be aggregated. Uploaded to BC.

[0060] 5. Voting stage.

[0061] The vote counting phase is completed by EA calling CountVote(). EA first calls GetCiphertext() to obtain the aggregated ciphertext from BC. Then call the decryption algorithm. The aggregated ciphertext is decrypted. After EA completes the decryption, zk-SANRK is used to generate proof π of the correctness of the decryption result, and the tuples are... Send to SC for verification. EA needs to perform the following steps to decrypt:

[0062] 1. Call GetCryptograph() to retrieve the aggregated ciphertext of valid encrypted ballots from BC.

[0063] 2. Decryption algorithm by calling the inner product encryption function. Encrypt the aggregated ciphertext of each candidate to obtain the candidate. number of votes And the correct use of the results is demonstrated by zk-SNARK to produce proof π.

[0064] 3. EA will pair the two elements. Submit to SC for verification.

[0065] SC receives the set of tuples sent by EA For candidates Verify the correctness of the vote results; after successful verification, call... Algorithm, to select candidates Voting results Sort the data from largest to smallest, and then sort the results. Uploaded to BC.

[0066] It is understood that the above specific description of the present invention is only for illustrating the present invention and is not limited to the technical solutions described in the embodiments of the present invention. Those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention to achieve the same technical effect; as long as the use needs are met, they are all within the protection scope of the present invention.

Claims

1.A method for anonymous electronic voting based on a zk-SNARK blockchain, characterized in that, The method comprises the following steps: Step 1: the system runs an initialization algorithm to generate system parameters and a candidate's corresponding public-private key pair set {mpk, msk}; Step 2: a user registration stage, which is composed of two algorithms, and the algorithms are completed by calling an authority EA; The first algorithm is a user registration algorithm, by which a user registration operation is completed; and the second algorithm is used for calculating a main private key SK used in decryption j , where j is an integer and j∈[0, m], and m is the number of candidates; Step 3: voter v i Call the algorithm AdvanceVote(v i , $val i ) to perform the pre-vote operation on the vote vector $val i , generate the pre-vote coin ξ and the commitment and proof ζ of each bit of the vote vector $val i , where i is an integer and i ∈ [0, n], n represents the number of voters, specifically including: Step 3-1: voter v i Submit the vote vector $val i , call the algorithm Mint(v i , $val i )→ξ, generate a pre-vote coin ξ:={v i , comm i , coin i , sn i}, where comm i is a vector commitment, coin i is a vector coin, and sn i is a serial number; Step 3-2: Call the algorithm proof(v) i $val i )→ζ, that is, based on the submitted vote vector $val i Each voter must make a commitment and provide proof to ensure that each vote vector is either 0 or 1. Step 4: voter v i For candidate M j Official voting, generating voting vector each person's ciphertext Ct i And aggregate ciphertext Step 5: At time stamp T4, the final vote count of the candidate M is computed by the authority EA. j Step 5: At time stamp T4, the final vote count of the candidate M is computed by the authority EA. 2.The zk-SNARK-based blockchain anonymous e-voting method according to claim 1, wherein, The step 1 comprises: Step 1-1: Call algorithm GroupGen(1 λ )→params; i.e., input security parameter 1 λ , output system parameters where is a group of order p generated by p is a prime number of λ bits; Step 1-2: Call algorithm Setup(1 λ , 1 m )→{mpk, msk}; i.e., input security parameter 1 λ and the number of candidates m, the authority EA generates the candidate M j corresponding public-private key pair mpk = (pk1,..., pk m ), msk = (sk1,..., sk m ). 3.The zk-SNARK-based blockchain anonymous e-voting method of claim 2, wherein, The step 2 comprises: Step 2-1: Register(v i :(cred, addr)) -> {v i ’C} is a registration protocol executed between the user and the EA, where cred represents the valid credentials of the user, and addr represents the wallet address of the user; the voter v i inputs a cred, and the EA pays the voter v i a virtual coin C with a value of 1 as voting qualification, while triggering a transaction tx; Step 2-2: Call algorithm KeyDer(msk, mw)→SK j That is, input the private key set msk of the candidate M j and the weight value set mw of all voters, and calculate the main private key SK j used by each candidate when decrypting, for use in the following decryption. 4.The zk-SNARK-based blockchain anonymous e-voting method according to claim 3, wherein, The step 4 comprises: Step 4-1: Call algorithm Encrypt(mpk, [$val i , r i ])→{v i , Ct i}, that is, the voter v i inputs the public key set mpk published by the EA, the voting vector $val i used by the voter v i in the pre-voting in step 3, and the random number r i , to generate the ciphertext Ct i for each bit of the voting vector $val i ; Step 4-2: Call algorithm The algorithm is executed by the smart contract SC, including classifying the ciphertext set {v i , Ct i} to obtain the ciphertext sequence N j corresponding to the candidate M j , and then aggregating the ct j part in the ciphertext sequence N 0，i，j to obtain ct i，j part aggregation 5.The zk-SNARK-based blockchain anonymous e-voting method of claim 4, wherein, The step 5 comprises: Step 5-1 : Authority EA calls algorithm Get aggregated ciphertext from blockchain BC In order to decrypt, the algorithm is triggered according to timestamp T4; Step 5-2: input the aggregated ciphertext and the master private key SK j , call the algorithm to decrypt and obtain the vote result T j of each candidate M j，num ; Step 5-3: input the vote result T of each candidate j，num , call algorithm OT(T j，num )→{T′ j，num}, output the new sequence T′ j，num in descending order of votes.

Images