An electronic voting system in which the validity of votes can be verified

Abstract

The application relates to the field of cryptography, and discloses an electronic voting system capable of verifying the validity of votes. In the electronic voting system, basic characteristics such as legality, privacy, integrity, accuracy and the like need to be met. In order to realize the privacy of votes, a voter usually needs to submit a vote after blinding or encrypting the vote. However, the receiver cannot identify the validity of the vote after blinding or encrypting the vote. The application provides a voting scheme based on homomorphic encryption, which can verify the validity of the form of the vote under the condition of keeping the content of the vote secret, and can meet the characteristic demands of the legality, privacy, integrity, accuracy and the like of the electronic voting.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy protection and secure multi-party computation, in particular to a privacy protection based vote verifiable electronic voting scheme. BACKGROUND

[0002] Electronic voting has incomparable efficiency advantage over traditional paper voting, and is beneficial to cost saving, environmental protection, but electronic voting also faces certain security threats, such as the legality of voters, the validity of votes, the correctness and verifiability of voting results. In view of the security problems of electronic voting, many methods use the technology in cryptography to ensure the privacy of voters and the correctness of voting results, such as electronic voting based on blind signature or ring signature, electronic voting based on homomorphic encryption, etc. In 1992, Japanese scholars Fujioka, Okamoto and Ohta proposed the first protocol suitable for large-scale voting, Foo voting scheme. Voters need to blind the filled vote, and then send it to the vote manager, the manager signs it and sends it to the voter, and the voter unblinds and sends it to the vote center. Later, Foo scheme was proved to have the defect of vote collision, so there are many improved methods for Foo scheme, such as the non-receipt electronic voting scheme based on Foo voting protocol proposed by Luo Fufen et al. in 2015. The recent blind signature based voting scheme such as Mahender Kumar in 2020 proposed a perfect end-to-end verifiable voting scheme. Since the voting system needs the function of vote counting, the homomorphic encryption based algorithm is applied to the voting system, such as using Paillier encryption system to realize the operation of vote in the form of ciphertext, and finally get the vote counting result. In 2019, Liu Yin proposed an electronic voting scheme using secret sharing and K-anonymity, which uses secret sharing method to build voting system, expresses the vote as a polynomial value, and finally restores the polynomial to get the vote counting result.

[0003] The common feature of the above methods is that in order to realize the privacy of the vote, the voter first blinds or encrypts the vote, which makes the vote manager unable to determine whether the vote is reasonable from the blinded or encrypted data, for example, it is stipulated that a maximum of m candidates are selected, and the voter selects more than m+1; or the voter gives more than 1 vote to the candidate he supports, such votes should all be invalid. However, due to the need for vote content privacy, the vote collector cannot judge whether the form is correct. Most of the existing methods assume that the voter is an honest model, which has certain limitations in actual application. SUMMARY

[0004] The technical problem to be solved by the present application is that the existing voting scheme lacks validity check, and an electronic voting scheme for checking the legality of the vote is proposed.

[0005] The technical method adopted by the present application is: after verifying the identity legitimacy of the voter, firstly, the ciphertext vote of the voter is added by bit homomorphism, then the sum is compared with the specified maximum number of candidates m through a comparison protocol, if it exceeds m, the vote is invalid. Further, each bit of the vote, that is, the selection of each candidate, is compared with 2, if there is a bit greater than 2 or less than 0, the vote is invalid. Only the vote that passes the vote verification can be counted in the total. Through the above vote verification steps, the unreasonable vote of the voter can be successfully excluded, thereby ensuring the fairness and correctness of the electronic voting.

[0006] Compared with the prior art, the present application has the beneficial effect of reducing the trust requirement for the voter, thereby making the voting scheme more suitable for real life.

[0007] An electronic voting system capable of verifying the validity of votes in the present application involves entities of: a voting management center MC, a voter v i , a voting center VC, and a vote counting center CC. BRIEF DESCRIPTION OF DRAWINGS

[0008] The comparison protocol involved in the present application will be further described below in combination with the drawings:

[0009] Figure 1 The comparison protocol between the voter and the voting center is described.

[0010] Through the protocol, the voting center can judge whether the vote of the voter meets the format requirement without knowing the content of the vote of the voter. DETAILED DESCRIPTION

[0011] The specific algorithm implementation steps are as follows:

[0012] (1) System initialization setup:

[0013] (a) The voting manager MC publishes the information of n candidates, the number of optional candidates m, wherein m < n, the voter list, and the voting rules, etc.

[0014] (b) Paillier encryption key generation: two independent large prime numbers p and q are randomly selected, which satisfy the greatest common divisor Gcd(pq, (p-1)(q-1)) = 1, N = pq is calculated, λ = Lcm(p-1, q-1), a random number is selected , without loss of generality, g = N + 1 is selected, the public key is pk = (N, g), and the private key is sk = (λ);

[0015] (c) ElGammal signature key generation: another large prime number p' is selected, g' is Z p'generator, private key x, x < p', corresponding public key y' = g' x mod p', p', g', y' are public;

[0016] (d) MC initializes list list V = {(ID i , 0)} i∈[1,vn] , where v n is the total number of voters;

[0017] (e) The voting center VC initializes list list C to be empty;

[0018] (f) The counting center CC initializes n-dimensional vector P = (p1, p2,...p n ) = (1, 1,... 1) ;

[0019] (2) Voter registration and authentication:

[0020] (a) The voter v i (identity information ID i ) registers with the MC using a pseudonym pID i to achieve the effect of anonymous voting. The voter sends the message ID i and pID i to the MC through a secure channel;

[0021] (b) The MC checks the voter list list V . If (ID i , 0) is in the list, it replaces the corresponding (ID i , 0) with (ID i , 1). If there is already (ID i , 1) in the list, it means that v i has already registered. If there is no corresponding item ID i in the list, it means that v i is not a legal voter. In the latter two cases, the MC feeds back a rejection message to v i ;

[0022] (c) The MC selects a random number k, k < p', and Gcd(k, p'-1) = 1, calculates r = g' k mod p' and s = k -1 (pID i -xr) mod (p'-1), and lets = (r, s) be the MC's signature on the pseudonym. The MC sends to the voter v i through a secure channel;

[0023] (d) When v i receives the signature , it first verifies its pID i according to its own pID , if the verification is passed, v i can get the voting certificate cert=(pID i , ) as the voting voucher, meanwhile, the voting center VC adds an element (pID i , 0) to the list list C ;

[0024] (e) The authenticated voter v i then selects its encryption key and signature key according to (1) (b) and (1) (c), and publishes the pseudonym and public key;

[0025] (3) The voter votes for the candidate according to its own will:

[0026] (a) The voter v i expresses its vote as a bit string (b1, b2,...b n ), 1 means approval, 0 means otherwise, and encrypts the vote bit by bit using its public key pk i to form the vote in the form of [ b j ] p k i j ∈ 1. . n ;

[0027] (b) The voter connects the vote [ b j ] p k i j ∈ 1. . n , connects cert i , gets the message m i , and signs it with its private key , then encrypts m i and σ i with the public key of the voting center VC to get C i , and sends it to the voting center VC;

[0028] (4) The voting center VC verifies the validity of the vote C i without decryption when it receives one:

[0029] (a) Verify the legitimacy of the voter:

[0030] Decrypt the voting certificate: Let L(x)=(x-1) / N, first calculate the plaintext , separate σ i and cert i from M i , according to cert i , check certi validity, if not, the vote is invalid;

[0031] Otherwise, further verify the voter's signature: according to cert i contains a pseudonym, obtain pID i and the corresponding public key, verify the signature σ i validity, if not, the vote is invalid;

[0032] If the verification is passed, further check whether the voter has voted repeatedly: check list C If (pID i , 1) is in the list, it is a repeated vote, otherwise go to (b);

[0033] (b) Check the validity of the vote form:

[0034] First, the voting center separates from and m i blt= , calculates x=sumc= , and encrypts m with the public key of v i to get y=[m] pki ;

[0035] The voting center secretly selects a function f(x)=k1x+k2 where k1, k2 are non-zero integers in Z N secret, calculates the ciphertext of f(x) and f(y) using the encryption key of v i ; , ; Send ( , ) to v i ;

[0036] v i receives and , respectively, and then compares f(x) and f(y), if f(x)>f(y), com=1, otherwise com=0, v i send com to the voting center;

[0037] The voting center receives com, if com=1 and k1>0 or com=0 and k1<0, it is determined that the vote is invalid; otherwise go to (c);

[0038] (c) Check the validity of the vote bit by bit:

[0039] The voting center secretly selects a random binary string C i =(c1,c2,...c n ), c j∈ {0, 1}, and according to c j The following two vectors A i = (a1, a2,...a n ), D i = (d1, d2,...d n ) are determined.

[0040] First, select a random permutation π of (1, 2…, n), and randomly permute to get , if c j =1, set a j =[ ], d j =Enc pki (1), if c j =0, set d j =[ ], a j =Enc pki (1) ;

[0041] The voting center secretly selects a function f(x)=k1x+k2, where k1, k2 are secret non-zero integers in Z N , and uses the encryption key of v i to calculate the ciphertext of f(A) and f(D): , , send , ) to v i ;

[0042] After v i receives , , it decrypts each bit respectively and compares a j and d j bit by bit, if a j >=d j , then g j =1, otherwise g j =0; finally, v i gets the comparison result of all bits G=(v i ) j∈[1..n] ;

[0043] Next, v i performs a key exchange operation, and encrypts f(A) and f(D) with the public key of MC bit by bit to get [f(A)] MC and [f(D)] MC , and sends (G, [f(A)] MC , [f(D)] MC ) to the voting center.

[0044] Upon receiving G, the voting center, for all j∈[1..n], if there exists c j =g j , it deems the vote invalid, otherwise, it deems the vote valid, sets (pID i , 0) to (pID i , 1), and feeds back a confirmation message to v i within a specified time;

[0045] (d) The voting center extracts the vote:

[0046] For a valid vote, the voting center extracts [b j ] from [f(A)] MC , [f(D)] MC , first generates vector i according to C j : if c j= =1, take f j [f(a MC )] j= , otherwise, take f j [f(d MC )] j ; for each f , calculate

[0001] , and finally execute to get , the voting center sends

[0002] and signature to the vote counting center;

[0047] (5) The vote counting center multiplies the received ciphertexts bit by bit without decryption:

[0048] Upon receiving the vote and signature, the vote counting center calculates if the signature is verified; when the voting time is up or the number of participants reaches a specified number, the vote counting center sends and signature to the vote manager;

[0049] (6) The vote manager decrypts each using its private key λ, to get the plaintext of each bit, , which is the final vote result of the jth candidate, and publishes .

Claims

1. An electronic voting scheme with verifiable vote validity, characterized in that: (1) A voter must be authenticated by an authentication center to obtain a voting certificate and participate in voting; (2) The voting scheme is applicable to a scenario of selecting m candidates from n candidates, where m < n, a voter makes his own vote in the form of a binary bit and sends it to a voting center after encryption; (3) After receiving the vote, the voting center first verifies the legality of the voter's identity, then checks the validity of the vote, and only the vote of a legal voter and the vote that passes the validity check can be counted; (4) The vote counter performs homomorphic operation on the vote ciphertext, and sends the operation result in the form of ciphertext to the vote manager; (5) The vote manager decrypts to obtain the final voting result; The specific implementation steps of the scheme are as follows: Step 1: System initialization setup, specifically including the following sub-steps: (a) The vote manager MC publishes the information of n candidates, the number of optional candidates m, where m < n, the list of voters and the voting rules, etc. (b) Paillier encryption key generation: two independent large prime numbers p and q are randomly selected, which satisfy the greatest common divisor Gcd(pq, (p-1)(q-1))=1, calculate N=pq, λ=Lcm(p-1, q-1), randomly select , without loss of generality, select g=N+1, the public key is pk=(N, g), and the private key is sk=(λ); (c) ElGammal signature key generation: another large prime p', g' is Z p' , generator, private key is x, x < p', corresponding public key is y' = g' x mod p', p', g', y' are public (d) MC initialization list list V = { (ID i , 0)} i∈[1,vn] where vn is the total number of voters; (e) a list of voting centers, VC C is empty; (f) The vote counting center CC initializes an n-dimensional vector P=(p1, p2,...p n = (1, 1,... 1); Step 2: Voter registration and authentication, specifically including the following sub-steps: (a) voter v i identity information ID i using a pseudonym pID i de-registered from the MC to achieve the effect of an anonymous vote, the voter sends the message ID i and pID i to the MC via a secure channel; (b) MC checks the list of voters list V If (ID i , 0) is in the list, then the corresponding (ID i , 0) is set to (ID i , 1). If (ID i , 1) is already in the list, it means that v i has already registered. If there is no corresponding entry for (ID i , 0) in the list, it means that v i is not a legal voter. In the latter two cases, MC sends a rejection message to v k . (c) MC selects a random number k, k < p', and Gcd(k, p'-1) = 1, calculates r = g'k mod p' and s = k k -1 (pID i -xr) mod (p'-1), let = (r, s) be the signature of the MC on the pseudo-name, and the MC sends to the voter v i ;​ (d) When v i Received signature Then, first, based on its own pID i verify If the verification passes, then v i The voting certificate cert=(pID) can be obtained i , As voting credentials, the voting center VC adds an element (pID). i , 0) to list C ; (e) authenticated voters v i Then, according to step 1(b) and step 1(c), select own encryption key and signature key, and disclose pseudonym and public key; Step 3: The voter votes, specifically including the following sub-steps: (a) voter v i Expresses his vote as a bit string (b1, b2,...b n ), 1 means yes, 0 means other, and his public key pk i Encrypts the vote bit by bit to form a vote form ; (b) the voter sends the vote , connects cert i , gets message m i , signs with his private key , encrypts with the public key of the voting center VC and gets , sends to the voting center VC; Step 4: The voting center verifies the validity of the vote, specifically including the following sub-steps: (a) Verify the legality of the voter: Decryption of the voting certificate: Let L(x) = (x-1) / N, first compute the plaintext , from M i , separate out and cert i , according to cert i , check the legality of cert i with the signature public key of MC, if the verification fails, the vote is invalid; Otherwise, further verify the voter's signature: according to cert i Obtain pID i and the corresponding public key, verify the signature correctness, if the verification fails, the vote is invalid; If the verification passes, further check if the voter has voted repeatedly: check list C If (pID i , 1) is in the list, then it is a repeated vote, otherwise go to (b). (b) Check the validity of the vote form: First, the voting center sends and m i to the voter , computes x = sumc , and encrypts m with the public key of v i to get y = [m] pki ; The voting center secretly selects a function f(x) = k1x + k2, where k1 and k2 are Z. N The non-zero integer that is kept secret is v. i The encryption key is used to calculate the ciphertext of f(x) and f(y): , ;send( , ) give v i ; v i Upon receipt And are decrypted separately, then f(x) and f(y) are compared, and if f(x) > f(y), com = 1, otherwise com = 0,v i com is sent to the voting center; If com = 1 and k1 > 0 or com = 0 and k1 < 0, the vote is invalid; otherwise, go to (c); (c) Check the validity of the vote bit by bit: The voting center secretly chooses a random binary string C i = (c1, c2,... c n ), c j ∈ {0, 1}, and determines the following two vectors A j = (a1, a2,... a i ), D n = (d1, d2,... d i ) depending on c n ​ First, choose a random permutation π of (1, 2, ..., n), then... By shuffling the order, we get If c j =1, set a j =[ ], d j =Enc pki (1), if c j =0, set d j =[ ], a j =Enc pki (1); The voting center secretly chooses a function f(x) = k1x + k2, where k1, k2 are nonzero integers in Z N i i ;​​​​​​ v i Upon receipt of (a , ), each bit is decrypted and compared to a j and d j , respectively. If a j >=d j , then g j =1, otherwise g j =0; finally, v i is the result of the comparison of all bits, G=(g j ) j∈[1..n] ; Next, v i The key exchange operation is performed to encrypt f(A) and f(D) with the public key of MC to get [f(A)] MC and [f(D)] MC respectively. (G, [f(A)] MC , [f(D)] MC ) is sent to the voting center; Upon receiving G, the voting center will, for all j∈[1..n], if there exists c j =g j , deem the vote invalid, otherwise, deem it a valid vote, set the corresponding (pID i , 0) to (pID i , 1), and feed back a confirmation message to v i within a specified time. (d) The voting center extracts the vote: For a valid vote, the voting center extracts [f(A)] MC , [f(D)] MC , [f(B)] j , [f(C)] i_MC , [f(E)] i , and generates the vector : if c j =1, take f j= [f(a j )] MC , otherwise, take f j= [f(d j )] MC ; for each f j , compute , and finally execute to get , the voting center sends , the signature to the tally center; Step 5: The vote counter multiplies the received ciphertext bit by bit without decryption, and this step is specifically: The vote center receives the vote and signature, if the signature is verified, the vote center calculates ; when the voting time is up, or the number of participants reaches the specified number, the vote center sends signature to the vote manager; Step 6: The vote manager decrypts each of the encrypted votes using his private key λ to obtain the plaintext for each vote. decrypts, obtaining the plaintext for each bit, , i.e., the final vote count for the jth candidate, is published .

Images