Blockchain score voting system based on anonymous convertible votes

Abstract

The application provides a blockchain scoring voting system based on anonymous convertible votes, which is based on a computer system: anonymous votes are based on BBS+ signature and knowledge signature to hide the identity of voters and the score of votes, and are constructed based on a hash chain structure to ensure that the evaluation scores of each candidate encapsulated on the votes are arranged in order and cannot be exchanged; a converter is arranged to perform a conversion mechanism to convert the anonymous votes uploaded to the blockchain, so that illegal votes from the same voter can be displayed without losing anonymity and score secrecy; an aggregation verification algorithm supporting batch verification of votes is adopted to verify a large number of votes at the same time; and optional multiple voting methods are adopted, at least including summation, majority decision and truncated average scoring methods.

Description

Technical Field

[0001] This invention belongs to the technical field of blockchain, scoring and voting devices and systems, and specifically relates to a blockchain scoring and voting system based on anonymous convertible ballots. Background Technology

[0002] With the modernization of electoral systems and voting mechanisms, electronic voting has attracted widespread attention. Compared to paper ballots, electronic voting systems have significant advantages in improving vote counting efficiency and reducing election costs. Many important elections have already supported electronic voting, and some countries even allow its use in national referendums. However, traditional electronic voting systems still lack reliable security guarantees and are vulnerable to cyberattacks. Blockchain plays an increasingly important role in solving the problem of electronic vote tampering. Essentially, blockchain is a distributed, peer-to-peer, append-only digital ledger, a characteristic that gives it strong tamper-proof and decentralized advantages. By recording ballots and election results on the blockchain, most attacks targeting centralized servers can be rendered ineffective, making electronic voting more secure and the results more convincing. To date, numerous researchers have conducted extensive research on blockchain-based electronic voting and achieved impressive progress.

[0003] Score voting allows voters to assign different scores to candidates. In a typical score voting election scenario, each voter can independently choose an evaluation score for each candidate (requiring voters to cast a constant total score). After all voters have cast their ballots, the election organizers tally the scores for each candidate and announce the election results. A recent example of score voting is the 2020 Oregon Independent Party primary, where each voter could assign a score from 0 to 5 for each candidate, with 0 representing the least support and 5 representing the most support. Clearly, score voting provides voters with more choices and is more expressive and flexible than the traditional yes-no voting (a voting method that only allows voters to choose "yes" or "no"). Research on score voting shows that it has a lower ballot corruption rate and produces results closer to the actual outcome than yes-no voting.

[0004] Many schemes have already supported score-based voting in blockchain-based electronic voting. These schemes are designed to encrypt evaluation scores using homomorphic encryption and prove to the blockchain that the encrypted evaluation scores satisfy the constraints of score-based voting. These constraints are mainly twofold. First, the evaluation score assigned to each candidate must be within a specified range—neither too high nor too low—otherwise, severe score overflow may occur during vote counting. Second, the total evaluation score allocated to each voter must be consistent to ensure fairness for every voter. However, existing schemes use inefficient and energy-intensive range-based zero-knowledge proofs to guarantee that the encrypted scores satisfy these two constraints, making the vote verification time cost of score-based voting far greater than that of traditional yes-no voting. Due to the high scalability requirements of blockchain, these schemes are not ideal for use in large-scale elections.

[0005] To prevent unethical candidates from threatening or coercing voters to abstain, ballots recorded on the blockchain should be anonymous to ensure that no one (including election organizers) can link any ballot to its voter. However, anonymous voting can also lead to the spread of forgery, tampering, and impersonation of ballots in elections, becoming a breeding ground for corruption. Unfortunately, this problem is not adequately addressed in existing voting systems. One direct solution is to deanonymize questionable ballots. However, this approach may infringe on the privacy of some honest voters because, before deanonymization, it is difficult to distinguish between legitimate and illegitimate votes. Summary of the Invention

[0006] This invention addresses the shortcomings and deficiencies of existing technologies by proposing a blockchain-based scoring and voting system with higher efficiency, flexibility, and privacy. The system is built upon Convertably Linkable Signatures (CLS) proposed by Garms et al. This novel method can be used to convert a set of anonymous signatures, ensuring that the converted signatures remain anonymous while linking signatures from the same signer to the same pseudonym. Based on CLS, this invention creatively designs a new conversion mechanism to convert ballots published on the blockchain. This conversion mechanism has three important characteristics: (1) the ballot remains anonymous after conversion; (2) the score on the ballot is kept confidential after conversion; and (3) if two ballots are generated by the same voter, the converted ballots are marked with the same pseudonym. With these properties, the designed conversion mechanism can disclose illegitimate votes without revealing the identity of any honest voter, which is crucial for preventing the abuse of voter anonymity.

[0007] The basic description of the technical solution of this invention is as follows: First, this invention designs an anonymous ballot using BBS+signature and knowledge signature. This ballot can hide the voter's identity and vote score, ensuring the anonymity of the vote. The designed ballot is built based on a hash chain structure, ensuring that the evaluation scores of each candidate encapsulated on the ballot are arranged in order and cannot be swapped. Second, this invention constructs a conversion mechanism to convert the anonymous ballot uploaded to the blockchain. Without losing anonymity and score confidentiality, the conversion can reveal illegal votes from the same voters. The ballot designed in this invention does not use time-consuming range proofs, and the generation and verification of electronic ballots are very fast. To further reduce the overhead of the blockchain, this invention designs an aggregate verification algorithm that supports batch verification of ballots, supporting the simultaneous verification of a large number of ballots. Finally, this invention supports flexible vote counting methods; the final score of a candidate can be calculated based on summation, majority decision, truncated average, or other statistical scoring methods.

[0008] The technical solution adopted by this invention to solve its technical problem is:

[0009] A blockchain-based scoring and voting system for anonymous convertible ballots, characterized by being based on a computer system:

[0010] Anonymous ballots are based on BBS+ signatures and knowledge signatures to hide the voter's identity and ballot score, and are built on a hash chain structure to ensure that the evaluation scores of each candidate encapsulated on the ballot are arranged in order and cannot be swapped.

[0011] A converter is set up to perform a conversion mechanism to convert anonymous ballots uploaded to the blockchain, revealing illegitimate votes from the same voters without losing anonymity and score confidentiality.

[0012] Aggregate verification algorithm that supports batch verification of ballots is used to verify a large number of ballots simultaneously;

[0013] In addition, multiple optional counting methods are adopted, including at least the summation, majority decision, and truncated average scoring methods.

[0014] Furthermore, it includes the following entities:

[0015] election organizers Used to determine whether a voter is eligible to vote. If a voter is eligible to vote, a voter key is issued to them during the voter registration phase.

[0016] Blockchain Node Peer nodes in the blockchain network perform blockchain data storage, check transactions, and generate new blocks, and are used to execute smart contracts to verify and store votes;

[0017] Voters With the candidate

[0018] Let the number of voters in the system be n. v Voters are recorded as follows: The number of candidates is n c The candidates are denoted as follows: use Indicates the i-th voter. Indicates the j-th candidate;

[0019] During the voter registration phase Towards Register and obtain the voter key VSK issued by it. i Then, the voters are the candidates. Assign a fraction p i,j ; Use your own private key VSK i Generate an anonymous, convertible ballot and its corresponding signature, and encapsulate the voter's score for each candidate within the ballot. Ballots and signatures are submitted during the voting phase. For verification and subsequent vote counting;

[0020] converter Used for vote conversion, and the responsibility of the converter is assigned to two non-colluding entities.

[0021] Furthermore, the system incorporates the following algorithms:

[0022] ·Setup(1 κ →PP.: By Execute, with security parameter 1 κ The input and output system common parameter PP;

[0023] ·EKeyGen(PP)→(ESK,EPK).:By Execute the process, taking the public parameter PP as input, to generate its private key-public key pair (ESK, EPK);

[0024] ·CKeyGen(PP,i)→(CSK i CPK i ).: by converter Execute the command, taking the public parameter PP as input, to generate its private key-public key pair (CSK). i CPK i ); where the public key (CPK1, CPK2) of the converter is simplified to CPK;

[0025] · Through with Run this algorithm interactively; With its identity identifier ID i , The public key EPK is the input; Its private key ESK is used as input; the interaction will Identity registration And for Return its private key VSK i ;

[0026] · Depend on Execute using the private key VSK i The converter's public key CPK, and the score assigned to each candidate. As input, generate Anonymous voting B i , signature σ i and a label τ i ;

[0027] · Depend on Execution, in order to Public key EPK, vote and signature set The input is the ballot; if the input ballot and its signature are valid, the algorithm outputs 1; otherwise, the algorithm outputs 0.

[0028] · via converter and Interactive execution; With its private key CSK1, Public key CPK2, ballot For input, Using its private key CSK2 as input, the ballot Perform the transformation and output the transformed ballots.

[0029] · After the converter executes the Convert algorithm, the voters The previously generated label τ i The votes are uploaded to the blockchain; afterwards, any entity can run this counting algorithm to count the votes; the algorithm uses the converted ballots. Tag collection The scoring function ψ is taken as input and outputs the total score for each candidate. Where P j as a candidate Total score;

[0030] The system operation is divided into the following stages:

[0031] System initialization phase

[0032] During the system initialization phase, the election organizer First, the Setup algorithm is executed to generate the common parameters PP; then... Run the EKeyGen algorithm to generate your private key ESK and public key EPK;

[0033] and CKeyGen is executed to generate private key-public key pairs (CSK1, CPK1) and (CSK2, CPK2) respectively; the public key (EPK, CPK1, CPK2) is broadcast to the blockchain storage.

[0034] ·Setup(1 κ →PP.: With safety parameter 1 κ As input, Running the bilinear group generation algorithm We obtain a bilinear group of order p; then, Select generator Define a collision-resistant hash function H:{0,1} * →{0,1} l A method that maps an l-bit string to The encoding function Encode: With a from The above function decodes the string: Decode. also, Define the maximum voter score P, where P ≤ 2. l The scoring function ψ is used to output the system public function PP = (g, g0, g1, g2, h, H, Encode, Decode, P, ψ);

[0035] EKeyGen(PP)→(ESK,EPK). Select calculate Output (ESK, EPK) = (x eo ,Y eo );

[0036] ·CKeyGen(PP,i)→(CSK i CPK i ).: Select calculate Output

[0037] Voter registration phase

[0038] During the voter registration phase, each voter Before the vote The Register protocol will run, which will connect voters. Identity and public key sent to And for The interaction returns a private key (VSK) used to generate the vote. i ;

[0039] · First select calculate For Y i Calculate a knowledge signature And send Give After verifying the validity of the knowledge signature, Select calculate Return (A) i ,e i ,s i After receiving the returned message, calculate And verify the equation If the equation holds true Output

[0040] Voting phase

[0041] During the voting phase, Run the Vote algorithm to generate votes B i , signature σ i and tag τ i When a given number of votes are received, Run the batch verification algorithm Verify to verify the ballots submitted by voters:

[0042] · The voting algorithm includes the following three steps:

[0043] (1) First, select τ. i ∈{0,1} l Calculate the fractional encryption key K i,1 =H(τ) i ) and identifier bid i,1 =H(K) i,1 To ensure the confidentiality of the scores, calculate η i,1 =Encode(P i,1 ), ζ i,1=Encode(bid) i,1 To prevent opponents from swapping any two scores in their votes, subsequent score encryption keys and identifiers are constructed based on a hash chain; for j∈[2,n] c ], Calculate K i,j =H(K) i,j-1 ||bid i,j-1 ), bid i,j =H(K) i,j And encapsulate the score as

[0044] (2) Generate convertible ballot B i ; Select calculate For j∈[1,n c ], Select calculate make Output

[0045] (3) Generate the signature σ corresponding to the ballot i ; Select Calculate c i =(a i ) -1 d i =s i -b i ·c i , Generate knowledge signatures for the above components: And output signature tuple (B) i ,σ i Publicly uploaded to the blockchain, and secretly held τ i Until the vote counting stage;

[0046] · Each peer node in the blockchain network runs this algorithm to verify submitted votes; for i∈[n] v Each signature σ in ] i =(U i W i ,T i ,Π i ), Verify knowledge signature Πi Whether it is effective; then, Test formula If the above knowledge signature and formula are both true. Output 1; otherwise Output 0;

[0047] Voting transition phase

[0048] During the ballot conversion phase, the converter and Run the interactive protocol to convert ballots;

[0049] · converter Select For i∈[n v ],j∈[1,n c ], calculate Will Send to For i∈[n v ], calculate Output During the voter registration phase and Identity Identifier ID i Binding, and x i quilt Secret possession, knowledge signature This ensured x i Embedded Of all the generated votes; if two votes B α and B β By the same voter Generate, then the converted kana It is the same; Check for duplicate pseudonyms among different ballots and discard ballots with the same pseudonym;

[0050] Vote counting stage

[0051] During the vote counting phase, each voter Anonymously assign the tags τ generated during the voting phase i The results are uploaded to the blockchain; then, any participant can run the Tally algorithm to obtain the vote count.

[0052] · This algorithm allows for public vote counting; after collecting tags... Then, the algorithm executor performs operations on i∈[n] v],j∈[1,n c Calculate K i,1 =H(τ) i ), bid i,1 =H(K) i,1 ), K i,j =H(K) i,j-1 ||bid i,j-1 ), bid i,j =H(K) i,j ); where bid i,j Representing voters Vote for the candidate The votes; then, the algorithm executor selects i∈[n]. v Retrieve by identifier The converted ballots Calculate the score And check the constraints Whether the condition is true or false; if any condition is not met, the algorithm executor discards the algorithm. And continue; after all valid scores have been restored, the algorithm executor performs a check on each candidate. Running the scoring function Calculate its total score.

[0053] Furthermore, the system's built-in scoring function ψ supports at least one of the following: summation, majority decision, and truncated average.

[0054] (1) Summation:

[0055] (2) Majority decision: Find the set The median, i.e.

[0056] Cut-off mean: Let the set For set Calculate the number of elements.

[0057] Compared to existing technologies, this invention and its preferred embodiment propose an efficient, flexible, and privacy-preserving blockchain-based scoring and voting system. Based on convertible linked signatures (CLS), it implements an anonymous convertible ballot and a secure ballot conversion mechanism. The ballot is implemented using BBS+ signature and knowledge signature technologies, which can hide the voter's identity and vote score, ensuring voting anonymity. The ballot is constructed with a hash chain structure to ensure that the evaluation scores for each candidate encapsulated on the ballot are arranged sequentially and cannot be swapped. Based on the anonymous convertible ballot, a unique ballot conversion mechanism is constructed. If multiple ballots are generated by the same voter, the converted ballots will be marked with the same cryptographic token. This mechanism efficiently detects illegitimate ballots while also ensuring voter anonymity and score confidentiality. Furthermore, the system avoids cumbersome range proofs, achieves batch ballot verification, and enables a convenient and flexible scoring method.

[0058] Its advantages mainly include:

[0059] (1) Convertible Voting Mechanism: Due to the anonymity of elections, multiple voting is common in electronic voting, while directly exposing voter identity may infringe on the privacy of honest voters. To address this issue, this invention proposes a novel voting conversion mechanism. This novel mechanism allows anonymous ballots to be converted into non-linkable pseudonyms, ensuring that ballots generated by the same voter have the same pseudonym after conversion. Simultaneously, the converted ballots retain the voter's anonymity and the confidentiality of the scores.

[0060] (2) Flexible Voting Method: This invention implements score-based voting, where voters can assign individual scores to each candidate, and the candidate with the highest score wins the election. Compared to traditional yes-no voting, score-based voting offers greater expressiveness and flexibility. Furthermore, this invention supports the use of flexible scoring functions in vote counting, allowing candidates' final scores to be calculated based on summation, majority decision, truncated average, or other statistical scoring methods.

[0061] (3) Efficient Ballot Verification: This invention supports efficient and large-scale scoring voting. The ballots designed in this invention do not use time-consuming range proofs, and the generation and verification efficiency of ballots is very high. In order to further reduce the computational overhead of blockchain networks in large-scale voting scenarios, this invention designs a batch ballot verification algorithm that supports the simultaneous verification of a large number of ballots.

[0062] (4) Fairness and Anonymity: This invention achieves fairness and anonymity in voting. Fairness requires that publicly available ballots not be partially counted before the voting deadline, as this could influence the behavior of voters who have not yet voted. This invention encrypts the scores to ensure that the scores on the ballots remain confidential before the votes are counted. This invention also achieves anonymity for voters; publicly available ballots cannot be associated with any particular voter, and voters will not be subject to blame or threats for voting or abstaining. Attached Figure Description

[0063] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0064] Figure 1 This is a schematic diagram of the system model of an embodiment of the present invention.

[0065] Figure 2 This is a hash chain structure diagram of the electronic ballot system in an embodiment of the present invention. Detailed Implementation

[0066] To make the features and advantages of this patent more apparent and understandable, specific embodiments are provided below for detailed explanation:

[0067] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0068] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0069] The voting model of this invention is as follows: Figure 1 As shown, the system proposed in this invention consists of the following entities:

[0070] (1) Election organizers

[0071] It is an entity that organizes and prepares for elections, which can be political parties, companies, schools, or other institutions. The department is responsible for verifying the identity of voters and determining their eligibility to vote. If a voter is eligible to vote, A voter key will be issued to them during the voter registration phase.

[0072] (2) Blockchain Node

[0073] These are peer nodes in a blockchain network that perform blockchain data storage, transaction inspection, and new block generation. In this invention, Responsible for executing smart contracts to verify and store votes.

[0074] (3) Voters With the candidate

[0075] Assume the number of voters in the system is n. v Voters are recorded as follows: The number of candidates is n c The candidates are respectively recorded as This invention uses Indicates the i-th voter. Let j represent the j-th candidate. During the voter registration phase, Towards Register and obtain the voter key VSK issued by it. i Then, he spoke for the candidates. Assign a fraction p i,j . You can use your own private key to VSK i This generates an anonymous, convertible ballot and a corresponding signature, encapsulating the vote score for each candidate within the ballot. Ballots and signatures will be submitted during the voting phase. For verification and subsequent vote counting.

[0076] (4) Converter

[0077] The converter is responsible for converting ballots. To prevent voters' privacy from being leaked to the converter, this invention assigns the converter's responsibilities to two independent entities. The responsibility for the converter can be undertaken by third-party judicial institutions such as courts and arbitration tribunals.

[0078] The following provides further details of the embodiments of the present invention: 1. Definition of variable symbols

[0079] Table 1: Symbolic Variables

[0080]

[0081]

[0082] 2. Formal Definition of the System

[0083] The system of this invention includes the following algorithm.

[0084] ·Setup(1 κ →PP. This algorithm is derived from... Execute, with security parameter 1 κ The input is the common system parameter PP.

[0085] • EKeyGen(PP)→(ESK,EPK). This algorithm is derived from... Execute the operation, taking the public parameter PP as input, to generate its private key-public key pair (ESK, EPK).

[0086] ·CKeyGen(PP,i)→(CSK i CPK i This algorithm is derived from the converter. Execute the command, taking the public parameter PP as input, to generate its private key-public key pair (CSK). i CPK i In this invention, the public keys (CPK1, CPK2) of the converter are simplified to CPK.

[0087] · Through with Run this algorithm interactively. With its identity identifier ID i , The public key EPK is the input; The interaction will take its private key ESK as input. Identity registration And for Return its private key VSK i .

[0088] · The algorithm is... Execute using the private key VSK i The converter's public key CPK, and the score assigned to each candidate. As input, generate Anonymous voting B i , signature σ i and a label τ i .

[0089] · The algorithm is... Execution, in order to Public key EPK, vote and signature set This is the input. If the input ballot and its signature are valid, the algorithm outputs 1; otherwise, the algorithm outputs 0.

[0090] · The algorithm uses a converter. and Interactive execution. With its private key CSK1, Public key CPK2, ballot For input, Using its private key CSK2 as input, the algorithm processes the votes. Perform the transformation and output the transformed ballots.

[0091] · After the converter executes the Convert algorithm, the voters The previously generated label τ i Upload the ballot to the blockchain. Then, any entity can run this counting algorithm to count the votes. The algorithm uses the converted ballots... Tag collection The scoring function ψ is taken as input and outputs the total score for each candidate. Where P j as a candidate The total score.

[0092] 3. System Initialization Phase

[0093] During the system initialization phase, the election organizer First, the Setup algorithm is executed to generate the common parameters PP. Then, Run the EKeyGen algorithm to generate your own private key ESK and public key EPK. Similarly, and CKeyGen is executed to generate private-public key pairs (CSK1, CPK1) and (CSK2, CPK2) respectively. The public key (EPK, CPK1, CPK2) is broadcast to the blockchain storage.

[0094] ·Setup(1 κ →PP. With safety parameter 1 κ As input, Running the bilinear group generation algorithm We obtain a bilinear group of order p. Next, Select generator Define a collision-resistant hash function H:{0,1} * →{0,1} l A method that maps an l-bit string to The encoding function Encode: With a from The above function decodes the string: Decode. also, Define the maximum voter score P (P≤2) l) and the scoring function ψ, output system public function PP=(g,g0,g1,g2,h,H,Encode,Decode,P,ψ).

[0095] ·EKeyGen(PP)→(ESK,EPK). Select calculate Output (ESK, EPK) = (x eo ,Y eo ).

[0096] ·CKeyGen(PP,i)→(CSK i CPK i ). Select calculate Output

[0097] 4. Voter registration phase

[0098] During the voter registration phase, each voter Before the vote The Register protocol will run, which will connect voters. Identity and public key sent to And for The interaction returns a private key (VSK) used to generate the vote. i .

[0099] · First select calculate For Y i Calculate a knowledge signature And send Give After verifying the validity of the knowledge signature, Select calculate Return (A) i ,e i ,s i After receiving the returned message, calculate And verify the equation If the equation holds true Output

[0100] 5. Voting Stage

[0101] During the voting phase, Run the Vote algorithm to generate votes B i , signature σi and tag τ i When a certain number of votes are received, Run the batch verification algorithm Verify to verify the ballots submitted by voters.

[0102] · The voting algorithm includes the following three steps:

[0103] (1) As Figure 2 As shown, First, select τ. i ∈{0,1} l Calculate the fractional encryption key K i,1 =H(τ) i ) and identifier bid i,1 =H(K) i,1 To ensure the confidentiality of the scores, calculate η i,1 =Encode(P i,1 ), ζ i,1 =Encode(bid) i,1 To prevent the opposing team from swapping any two scores in their votes (e.g., swapping p...). i,1 and p i,2 The subsequent fractional encryption key and identifier are constructed based on a hash chain. For j∈[2,n] c ], Calculate K i,j =H(K) i,j-1 ||bid i,j-1 ), bid i,j =H(K) i,j And encapsulate the score as Due to the one-way property of hash functions, this structure records The order of the fractions effectively prevents fraction swapping. Furthermore, due to the fraction encryption key... Unable to obtain from identifier The calculations show that the confidentiality of the scores is guaranteed.

[0104] (2) Generate convertible ballot B i . Select calculate For j∈[1,n c ], Select calculate make Output

[0105] (3) Generate the signature σ corresponding to the ballot i . Select Calculate c i =(a i ) -1 d i =s i -b i ·c i , Generate knowledge signatures for the above components:

[0106] And output signature tuple (B) i ,σ i Publicly uploaded to the blockchain, and secretly held τ i Until the vote counting stage.

[0107] · Each peer node in the blockchain network runs this algorithm to verify submitted votes. For i∈[n] v Each signature σ in ] i =(U i W i ,T i ,Π i ), Verify knowledge signature Π i Is it effective? Next, Test formula If the above knowledge signature and formula are both true. Output 1; otherwise Output 0.

[0108] 6. Voting transition phase

[0109] During the ballot conversion phase, the converter and Run the interactive protocol Convert to convert the ballots.

[0110] · converter Select For i∈[n v ],j∈[1,n c ], calculate

[0111] Will Send to For i∈[n v ], calculate Output Notice During the voter registration phase and Identity Identifier ID i Binding, and x i quilt Secret possession, knowledge signature This ensured x i Embedded Of all the generated votes, if two votes B... α and B β By the same voter Generate, then the converted kana It's the same. Check for duplicate pseudonyms among different ballots and discard ballots with the same pseudonym.

[0112] 7. Voting Stage

[0113] During the vote counting phase, each voter Anonymously assign the tags τ generated during the voting phase i The results are uploaded to the blockchain. Then, any participant can run the Tally algorithm to obtain the vote count.

[0114] · This algorithm allows for public vote counting. After collecting tags... Then, the algorithm executor performs operations on i∈[n] v ],j∈[1,n c Calculate K i,1 =H(τ) i ), bid i,1 =H(K) i,1 ), K i,j =H(K) i,j-1 ||bid i,j-1 ), bid i,j =H(K) i,j ); where bid i,j Representing voters Vote for the candidate The votes. Next, the algorithm executor selects i∈[n]. v Retrieve by identifier The converted ballots Calculate the score And check the constraints Does the condition hold true? If any condition is not met, the algorithm executor discards the result. And continue. After all valid scores have been restored, the algorithm executor performs a check on each candidate. Running the scoring function Calculate its total score.

[0115] 8. Selection of scoring function

[0116] This invention supports the selection of various scoring functions ψ, such as summation, majority decision, and truncated average. The above three scoring methods can be implemented in the following ways: (1) Summation: (2) Majority decision: Find the set The median, i.e. (3) Cut off the average: Let the set For set Calculate the number of elements. The latter two scenarios are suitable for selecting winners in competitions or sporting events. An example of truncated mean voting is the International Skating Union's judging system. This is an anonymous voting system that requires discarding each judge's highest and lowest scores to reduce the influence of judge bias.

[0117] The following are the mathematical foundations that constitute the feasibility of the present invention:

[0118] Bilinear group and difficult hypothesis

[0119] Group generator With safety parameter 1 κ A cyclic group with input and output order p. With bilinear mapping e: For any and The mapping e satisfies the following properties: (1) Bilinearity: e(g a ,h b )=e(g,h) ab (2) Non-degradability: (3) Computability: e(g,h) can be efficiently computed. Meanwhile, this invention requires the following difficult assumptions to be true in the group... established on.

[0120] Assumption 1 (Decision Diffie-Hellman (DDH) Assumption). Given a DDH tuple (g, A = g) a B = g b C = g c The DDH assumption requires that the adversary... Let element C = g ab With random elements The probability of distinguishing them is negligible, that is... If the opponent Advantages If it is negligible, then the DDH hypothesis is considered to be in the group. established on.

[0121] Assumption 2 (q-Strong Diffie-Hellman (q-SDH) Assumption). Given q-SDH tuples q-SDH assumptions require that the adversary Output tuple (A, e) that satisfies the constraints The probability of this is negligible, that is... If the opponent Advantages If it is negligible, then the q-SDH hypothesis is considered to be in the group. established on.

[0122] Assumption 3 (Discrete Logarithm (DL) Assumption): Given a DL tuple (g, g) x ), DL assumptions require that the adversary The probability of outputting x is negligible, that is... If the opponent Advantages If it is negligible, then the DDH hypothesis is considered to be in the group. established on.

[0123] The following is a detailed description of the key technologies used in the system of this invention:

[0124] Convertible link signature

[0125] After a message is anonymously signed by a signer, convertibly linkable (CLS) signatures allow a converter to transform these signatures. If multiple signatures are signed by the same signer, then these signatures will be marked with the same identifier after transformation. Current research on CLS includes the following three categories: converter-controlled CLS (the converter is responsible for the signature transformation), user-controlled CLS (the signer is responsible for the signature transformation), and sequentially linkable CLS (the correctness of the signature order after transformation can be proven). This invention utilizes BBS+ signatures, knowledge signatures, and hash chains to implement converter-controlled transformation and sequentially linkable transformation in anonymous voting.

[0126] BBS + Signature

[0127] BBS+ signature is a high-efficiency multi-message digital signature scheme, consisting of the following algorithms. (1) Setup(1 κ ,1 n →pp: The algorithm selects the security parameter κ and the number of messages n as outputs. Output common parameters pp = (g0, g1, ..., g n+1 (2) KeyGen(pp)→(sk,vk): Outputs the common parameter pp, and the signer is selected. Calculate Y = h x , output sk=x,vk=Y. (3)Sign(sk,m1,…,m n →σ: Using the signing key sk and the message to be signed (m1,…,m) n () is the input, and the signer selects... calculate And output the signature σ=(A,e,s). (4)Verify(vk,m1,…,m n ,σ)→0 / 1: The signature verifier verifies the key vk, message (m1,…,m n ) and signature σ are inputs. If the equation If true, the algorithm outputs 1; otherwise, it outputs 0.

[0128] Knowledge Signature

[0129] Signature of knowledge (SoK) is a special signing technique that allows a signer to sign a message in a zero-knowledge manner. SoK technology allows a verifier to believe that the signer knows the specific witness without revealing other irrelevant information. The notation SoK{(a):h=g a}(m) refers to a signature of message m, where the signer proves that they know the witness h = g. a The knowledge above a. The above SoK can be instantiated using the following computation: (1) Signer selection and return (2) The verifier verifies the equation. and sign A signature is a valid knowledge signature if and only if the above equation holds.

[0130] Hash chain

[0131] A hash chain (also known as a one-way function chain) is a chain-like structure where each element is obtained by hashing the previous element, denoted as h. i =H(h) i-1 ) = H(H(H(…H(·)))). Due to the one-way property of the hash function, given the element h i-1 The next element h is easily obtained. i However, it is difficult to obtain from h i Inversely derived h i-1Hash chains possess strong resistance to eavesdropping and replay attacks, and are widely used in one-time authentication, micro-payments, and electronic cash. A typical application of hash chains is blockchain, where the block header of each block (except the genesis block) contains the hash value of the previous block. This characteristic ensures that any block on the blockchain is difficult to tamper with unless an adversary has the ability to simultaneously tamper with all subsequent blocks. Those skilled in the art will understand that the embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0133] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0135] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

[0136] This patent is not limited to the above-described preferred embodiments. Anyone can derive other forms of blockchain scoring and voting systems based on anonymous convertible ballots under the guidance of this patent. All equivalent changes and modifications made within the scope of this patent application shall fall within the scope of this patent.

Claims

1. A blockchain-based scoring and voting system based on anonymous convertible ballots, characterized in that it is deployed on a computer system: Anonymous ballots are based on BBS+ signatures and knowledge signatures to hide the voter's identity and ballot score, and are built on a hash chain structure to ensure that the evaluation scores of each candidate encapsulated on the ballot are arranged in order and cannot be swapped. A converter is set up to perform a conversion mechanism to convert anonymous ballots uploaded to the blockchain, revealing illegitimate votes from the same voters without losing anonymity and score confidentiality. Aggregate verification algorithm that supports batch verification of ballots is used to verify a large number of ballots simultaneously; In addition, the scoring method shall be one of the following: summation, majority decision, or truncated average; Includes the following entities: election organizers It is used to determine whether a voter is eligible to vote. If a voter is eligible to vote, a voter key is issued to him / her during the voter registration stage. Blockchain Node Peer nodes in the blockchain network perform blockchain data storage, check transactions and generate new blocks, and execute smart contracts to verify and store votes; Voters With the candidate : Let the number of voters in the system be . Voters are recorded as follows: The number of candidates is The candidates are denoted as follows: ;use Indicates the first Each voter Indicates the first One candidate; During the voter registration phase Towards Register and obtain a voter key issued by it. Then, the voters are the candidates. Assign a score ; Use your own private key Generate an anonymous, convertible ballot and its corresponding signature, and encapsulate the voter's score for each candidate within the ballot. Ballots and signatures are submitted during the voting phase. For verification and subsequent vote counting; converter This is used for vote conversion, and the responsibility of the converter is assigned to two non-colluding entities. ; The system has the following built-in algorithms: :Depend on Execution, with security parameters Input and output system common parameters ; :Depend on Execution, with common parameters For input, generate its private key-public key pair. ; : by converter ( ) Execute, with common parameters For input, generate its private key-public key pair. Among them, the public key of the converter Simplified representation as ; , Through with Run this algorithm interactively; With its identity identifier , public key For input; With its private key For input; interaction will Identity registration and for Return its private key ; :Depend on Execute with private key Converter public key The score assigned to each candidate As input, generate Anonymous voting ,sign and a label ; :Depend on Execution, in order to public key Ballots and signatures collection The input is the ballot; if the input ballot and its signature are valid, the algorithm outputs 1; otherwise, the algorithm outputs 0. : via converter and Interactive execution; With its private key , public key ,vote For input, With its private key For input, for the ballot Perform the transformation and output the transformed ballots. ; : During converter execution After the algorithm, voters Use the previously generated tags The votes are uploaded to the blockchain; afterwards, any entity can run this counting algorithm to count the votes; the algorithm uses the converted ballots. tag collection Scoring function Given the input, output the total score for each candidate. ,in as a candidate Total score; The system operation is divided into the following stages: System initialization phase During the system initialization phase, the election organizer First execute Algorithm generates common parameters ;Then, run The algorithm generates its own private key and public key ; and Execute separately Generate private key-public key pair and Public key Broadcast to blockchain storage; : based on safety parameters As input, Running the bilinear group generation algorithm We obtain an order of The bilinear group; then, Select generator , ; Define a collision-resistant hash function One will Bit string mapping to Encoding function on , with one from Decoding function for restoring strings ;also, Define the maximum vote score for each voter. , , and scoring function Output system public functions ; : Select ,calculate Output ; : ( Select ,calculate Output ; Voter registration phase During the voter registration phase, each voter Before the vote Run the interaction protocol The agreement will include voters Identity and public key sent to and for The interaction returns a private key used to generate the ballot. ; , First select ,calculate ; right Calculate a knowledge signature And send Give After verifying the validity of the knowledge signature, Select ,calculate ,return After receiving the returned message, calculate And verify the equation If the equation holds true, Output ; Voting phase During the voting phase, run Algorithm for generating votes ,sign and tags When a given number of votes are received, Run batch verification algorithm Verify the ballot submitted by the voter: The voting algorithm includes the following three steps: (1) First select Calculate the fractional encryption key and identifier To ensure the confidentiality of the scores, calculate , , To prevent opponents from swapping any two scores in their votes, subsequent score encryption keys and identifiers are constructed based on a hash chain; , calculate , And encapsulate the score as ; (2) Generate convertible ballots ; Select ,calculate , , ;right , Select ,calculate , , , ;make , Output ; (3) Generate signatures corresponding to ballots ; Select ,calculate , , , , ; Generate a knowledge signature for the above content: and output signature. ; tuple Publicly uploaded to the blockchain, and secretly held Until the vote counting stage; Each peer node in the blockchain network runs this algorithm to verify the submitted votes; Each signature in , Verify knowledge signature Whether it is effective; then, Test formula If both the above knowledge signature and formula are true, Output 1; otherwise Output 0; Voting transition phase During the ballot conversion phase, the converter and Run interactive protocol Convert ballots; converter Select ;right , calculate , , , , ,Will Send to ;right , calculate , , Output ; During the voter registration phase and Identity identifier Binding, and quilt Secret possession, knowledge signature Ensured Embedded Of all the generated votes; if two votes and By the same voter Generate, then the converted kana It is the same; Check for duplicate pseudonyms among different ballots and discard ballots with the same pseudonym; Vote counting stage During the vote counting phase, each voter Anonymously generate tags during the voting phase Upload to the blockchain; then, any participant can run it. The algorithm obtains the vote count results; This algorithm allows for public vote counting; after collecting tags... Afterwards, the algorithm executor... calculate , , , ;in Representing voters Vote for the candidate The votes; then, the algorithm executor... Retrieval by identifier The converted ballots Calculate the score And check the constraints , Whether the condition is true or false; if any condition is not met, the algorithm executor discards the algorithm. And continue; after all valid scores have been restored, the algorithm executor performs a check on each candidate. Running the scoring function Calculate its total score.

2. The blockchain scoring and voting system based on anonymous convertible ballots according to claim 1, characterized in that: Built-in scoring function of the system Supports using one of the following: summation, majority decision, or truncated mean: (1) Summation: ; (2) Majority decision: Find the set The median, i.e. ; (3) Cut-off mean: Let the set , For set Calculate the number of elements. .

Images