A lightweight and publicly verifiable electronic voting method

Abstract

The present invention relates to the field of information security technology, and in particular to a lightweight and publicly verifiable electronic voting method, which is executed by an electronic voting system, wherein the electronic voting system comprises: an election management agency, a bulletin board, a plurality of voting user terminals, and a plurality of vote counting parties; the method comprises: S1, the election management agency obtains pre-set system parameters and publishes them on the bulletin board, and the vote counting party generates initial parameters based on the system parameters; S2, the voting user terminal obtains corresponding ballot information based on the system parameters and the initial parameters, and publishes the ballot information on the bulletin board; S3, the vote counting party determines whether the ballot information is legal, obtains a first judgment result, and obtains label information of an output line of each gate circuit in a first circuit C when the first judgment result is that the ballot information is legal; S4, the vote counting party verifies the label information of the output line of each gate circuit in the first circuit C, obtains a final counting result, and puts the final counting result on the bulletin board.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a lightweight and publicly verifiable electronic voting method. Background Art

[0002] In today's digital age, electronic voting, as an application of modern information technology, is gradually becoming a key element in the democratic process, providing citizens with an effective and convenient mechanism to participate in elections.

[0003] The security of electronic voting technology is the most important issue. Electronic voting involves many roles, and the security attributes of the roles will affect the final result of the vote and threaten the privacy rights of the vote counter. The privacy and public verifiability of electronic voting are important aspects of researchers' attention and need to be protected by cryptographic tools. The existing electronic voting schemes have the following three main problems: the ballot encryption scheme involved in the vote counter is not lightweight and efficient enough; the assumption of trustworthy security of the bulletin board is not practical enough; and the legal verification of the ballot is not efficient and fast enough.

[0004] Therefore, in view of the defects and shortcomings of existing solutions, a lightweight and publicly verifiable electronic voting method is urgently needed. Summary of the invention

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a lightweight and publicly verifiable electronic voting method.

[0006] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0007] The embodiment of the present invention provides a lightweight and publicly verifiable electronic voting method, which is executed by an electronic voting system, wherein the electronic voting system includes: an election management agency, a bulletin board, a plurality of voting user terminals, and a plurality of vote counting parties; the method includes:

[0008] S1. The election management agency obtains pre-set system parameters and publishes the system parameters on the bulletin board. The vote counting party generates initial parameters based on the system parameters.

[0009] The initial parameters include a global key;

[0010] The system parameters include: security parameter k, number of candidates, counting function with votes as input, voting start time and end time, list of legal voting users and list of designated counting parties, first circuit C;

[0011] The first circuit C is a logic circuit transformed by a vote counting function;

[0012] S2. The voting user terminal obtains corresponding voting information based on the system parameters and the initial parameters, and publishes the voting information on the bulletin board;

[0013] S3. The vote counting party determines whether the ballot information is legal, obtains a first determination result, and obtains label information of an output line of each gate circuit in the first circuit C if the first determination result is that the ballot information is legal;

[0014] The label information includes: a label for identifying a bit value on the output line and a bit after the output line mask;

[0015] S4. The vote counting party verifies the label information of the output line of each gate circuit in the first circuit C, obtains the final vote counting result and puts the final vote counting result on the bulletin board.

[0016] Preferably, the S1 specifically includes:

[0017] S11, the election management agency obtains system parameters and publishes the system parameters on the bulletin board;

[0018] The first circuit C is:

[0019] I1×...×Ij×...×In→O;

[0020] Where Ij is the input line corresponding to the j-th voting user terminal Vj;

[0021] O is the final output line; n is the total number of voting user terminals;

[0022] S12, after each vote counting direction verifies its identity with the election management agency, it generates a corresponding global key according to the security parameter k;

[0023] is the global key corresponding to the first vote counting party Ti;

[0024] The first counting party Ti is the i-th counting party among all counting parties, and i=1, 2, …, y;

[0025] y is the number of vote counting parties;

[0026] S13. For the line w in the first circuit C that is within the first range, each vote counting party generates a corresponding verifiable mask bit share;

[0027] in, The share of verifiable masked bits generated by the first counting party Ti;

[0028] The first range is I1∪...Ij...∪In∪W; wherein W is a set of output lines of the AND gate in the first circuit C;

[0029] Mask for line w The share of mask bits belonging to the first counting party Ti in ;

[0030] Information-theoretic secure message authentication code containing the mask bit share of the first counting party Ti and the key corresponding to the information theory security message authentication code of each other vote counting party except the first vote counting party and the mask on line w The share of mask bits belonging to the first counting party Ti in ;

[0031] The second vote counting party Tj is any other vote counting party except the first vote counting party; wherein j=1, 2, …, y, and j≠i;

[0032] The key corresponding to the information-theoretic secure message authentication code of the second vote counter Tj's masked bit share;

[0033] S14, the first vote counting party Ti selects a random bit string of k bits as a label with bit 0 , a label with bit value 1 ;in, ;

[0034] S15. For the line w in the second range, the first counting party Ti generates an AND gate triplet. ;

[0035] The second range is a set of output lines W of the AND gates in the first circuit C;

[0036] in, The mask bit share of the first element in the AND gate triplet generated by the first counting party Ti;

[0037] The mask bit share of the second element in the AND gate triplet generated by the first counting party Ti;

[0038] The mask bit share of the third element in the AND gate triplet generated by the first counting party Ti;

[0039] S16. For each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, the first counting method Ti calculates ,as well as ;

[0040] Among them, each gate circuit G= ; , They are the input lines corresponding to the gate circuit type g, is the output line corresponding to the gate circuit type g;

[0041] Mask for line α The share of verifiable masked bits belonging to the first counting party Ti in ;

[0042] Mask for line α The share of mask bits belonging to the first counting party Ti in ;

[0043] Mask for line β The share of verifiable masked bits belonging to the first counting party Ti in ;

[0044] Mask for line β The share of mask bits belonging to the first counting party Ti in ;

[0045] Mask for line γ The share of verifiable masked bits belonging to the first counting party Ti in ;

[0046] Mask for line γ The share of mask bits belonging to the first counting party Ti in ;

[0047] is the label with bit 0 on line γ belonging to the first counting party Ti;

[0048] is the label with bit 0 on line α belonging to the first counting party Ti;

[0049] is the label with bit 0 on line β belonging to the first counting party Ti;

[0050] For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the first counting party Ti, according to the AND gate triple , get and , and based on and , respectively reconstructed and , further based on the AND gate triple , as well as , get the verifiable first mask bit share after the AND gate processing ;

[0051] in, ; ; , ;

[0052] ;

[0053] S17, based on the verifiable first mask bit share after AND gate processing , random number t and random number s, the first counting party Ti locally calculates the verifiable second mask bit share after the AND gate processing ; Where, t∈{0,1}, s∈{0,1};

[0054] in, ;

[0055] S18: The first vote counting party Ti locally calculates the labels of the input line α and the input line β whose bit values ​​are 1. and ;in, , ;

[0056] According to the random number t and the random number s, the first counting party Ti locally calculates the AND gate ciphertext , and the AND gate ciphertext Sent to the designated vote counter T1;

[0057] ;

[0058] in, is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0059] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0060] H() is the hash function;

[0061] S19, the first vote counting party Ti, through a secure channel, sends the secret key r used for voting i，j Sent to voting user terminal Vj; j∈{1,...,n};

[0062] Among them, the secret key r i，j It is based on the mask on line w The share of mask bits belonging to the first counting party Ti What you get.

[0063] Preferably, the S2 specifically includes:

[0064] S21, the voting user terminal Vj uses the secret key r i，j Encrypt the single-bit vote vj cast by voting user terminal Vj and obtain the corresponding ciphertext c j ;

[0065] in, ;

[0066] S22, the voting user terminal Vj uses the sign signature algorithm to sign the ciphertext c j Sign and obtain the signature of the ciphertext;

[0067] in, ;sign() is the sign signature algorithm;

[0068] is the signature of the ciphertext;

[0069] S23, the voting user terminal Vj publishes the ballot information on the bulletin board;

[0070] The ballot information includes the ciphertext c j , the signature of the ciphertext and the ID of the voting user terminal Vj.

[0071] Preferably, the S3 specifically includes:

[0072] S31, the vote counting party Ti determines whether the ballot information published by the voting user terminal Vj on the bulletin board is legal, and obtains a first determination result;

[0073] S32: If the first judgment result is legal, the first vote counting party Ti, based on the ciphertext c of any legal voting user terminal Vj on the public bulletin board, j , the corresponding label Send to the designated vote counter T1; where i∈{2,...,y} is set;

[0074] S33, input the ciphertext as the masked bits on the input line into the first circuit C, and for each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, designate the vote counter T1 to calculate the masked bits on the output line γ of the gate circuit G. ;

[0075] in, ;

[0076] is the masked bit of the input line α of the gate G; is the masked bit of the input line β of the gate circuit G; The masked bit of the output line γ of gate circuit G;

[0077] Specify the label set of the output line γ of the counting gate circuit G by the counting party T1;

[0078] Among them, the label set of the output line γ is:

[0079] ;

[0080] S34. For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the mask bit of the gate circuit and its corresponding output line label are calculated based on the AND gate ciphertext and the information-theoretic security message authentication code in the verifiable mask bit share of the input line locally owned by the vote counter.

[0081] Preferably, the S31 includes:

[0082] For the ciphertext c in the ballot information j And the signature of the ciphertext And the identification bit of the voting user terminal Vj is obtained to determine whether it is legal or correct. If the ciphertext c j And the signature of the ciphertext and the obtained identification bits of the voting user terminal Vj are all legal or correct, then the first judgment result is that the ballot information is legal;

[0083] Among them, if the ciphertext c j The length is the same as the number of candidates, then the ciphertext c is determined j legitimate;

[0084] If the ciphertext c j If the length is different from the number of candidates, then the ciphertext c is determined j Illegal.

[0085] Preferably, the S34 specifically includes:

[0086] For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, let bit t= ,s= , for i=1,...,y, the designated vote counter T1 calculates:

[0087] ;

[0088] The designated vote counter T1 then checks the accuracy of the Agreement and, if it is incorrect, terminate the Agreement;

[0089] If successful, the designated vote counter T1 will calculate The label set of the output line γ of the AND gate G .

[0090] Preferably, the S4 specifically includes:

[0091] S41, designated vote counting party T1 is published on the notice board , and calculate , then, Send to the second vote counting party Tj, j≠i;

[0092] Where x is a random k-bit string generated by the designated vote counter T1;

[0093] S42, the second counting party Tj retrieves the votes from the bulletin board And judge h i Whether the calculation is correct, obtaining a second judgment result;

[0094] If the second judgment result is h i If it is not calculated correctly, the agreement will terminate;

[0095] If the second judgment result is h i If the calculation is correct, proceed to the next step;

[0096] S43, for each XOR gate circuit in the first circuit C, the second vote counting party Tj calculates the masked bit of the XOR gate circuit output line γ ; ;

[0097] S44, for each AND gate circuit in the first circuit C, the second vote counting party Tj batch checks the correctness of the calculation of the AND gate output line γ;

[0098] S45. When the second vote counting party Tj has batch checked that the AND gate output line γ is calculated correctly, the first vote counting party Ti publishes it on the public bulletin board PBB. Then, the designated counting party T1 calculates and publishes the final counting results and sign the final vote count results on the bulletin board.

[0099] Preferably, the S44 specifically includes:

[0100] S441, the second vote counter Tj calculates locally:

[0101] ;

[0102] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0103] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0104] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0105] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0106] S442, designate the vote counter T1 to calculate:

[0107] ;

[0108] ;

[0109] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0110] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0111] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0112] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0113] ;

[0114] S443, the second counting party Tj calculates and signed it, and posted it on the bulletin board;

[0115] in, It is an almost universal linear hash function;

[0116] S444, designated vote counter T1 calculation and sign it, then post it on the bulletin board; =0, then it is determined that the calculation of the AND gate output line γ is correct.

[0117] Preferably, the method further comprises:

[0118] S5. Publicly verify the final vote counting result to determine whether the final vote counting result is correct and obtain a final judgment result.

[0119] Preferably, the S5 specifically includes:

[0120] S51, any vote counting party or voting user confirms the authenticity of the information on the bulletin board by signing, and verifies the results of voting to determine whether each voting user terminal has cast a legal vote, and , verify whether the counting party has calculated correctly during the counting process;

[0121] S52: When it is determined that each voting user terminal has cast a legal vote and the counting party has calculated correctly during the counting process, the ciphertext c published by the voting user terminal is j As the input of the first circuit C, the final encrypted vote counting result is obtained through the operation of the first circuit C;

[0122] S53, decrypt the final encrypted vote counting result to obtain the actual voting data, compare the actual voting data with the result of the vote counting function issued by the designated vote counting party T1 to obtain the final judgment result;

[0123] If the actual voting data and the result of the counting function published by the designated counting party T1 are correct, it is determined that the final counting result and the counting process are correct.

[0124] The beneficial effects of the present invention are as follows: a lightweight and publicly verifiable electronic voting method of the present invention allows anyone to verify the correctness of the voting process by publishing system parameters and voting information on a bulletin board. The information on the bulletin board is open and transparent, which ensures the verifiability and transparency of the entire voting process and helps to improve the credibility of the voting system.

[0125] The lightweight and publicly verifiable electronic voting method of the present invention relies on a bulletin board for public verification and parameter sharing, which reduces the reliance on computing and storage resources, making the system relatively lightweight and convenient for large-scale application. The lightweight design reduces the complexity of the system while ensuring security, so that it can run smoothly in a resource-constrained environment.

[0126] In a lightweight and publicly verifiable electronic voting method of the present invention, in step S1, the set security parameter k and global key can ensure the security of the system and prevent data from being tampered with or leaked. In addition, the logic circuit of the first circuit C is generated based on the counting function, and can verify and count the ballot information, thereby reducing counting errors or fraud caused by human or system vulnerabilities.

[0127] The present invention provides a lightweight and publicly verifiable electronic voting method. In step S3, the counting party makes a legality judgment on the ballot information to ensure that only ballots that comply with the system rules can participate in the counting, thereby excluding illegal voting and maintaining the fairness of the election.

[0128] The lightweight and publicly verifiable electronic voting method of the present invention processes the output line information of each gate circuit through labels and masks, thereby protecting the privacy of voters and avoiding direct exposure of ballot information. The integrity verification of the voting process is achieved without leaking the voting content.

[0129] The lightweight and publicly verifiable electronic voting method of the present invention standardizes the processing of ballot information and the calculation of vote counting results through the logical calculation in the first circuit C. The counting party verifies the output result according to the label information of each gate circuit, ensuring that each ballot is correctly counted, thereby improving the accuracy of the voting results. BRIEF DESCRIPTION OF THE DRAWINGS

[0130] Figure 1 The figure is a flow chart of a lightweight and publicly verifiable electronic voting method of the present invention. DETAILED DESCRIPTION

[0131] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0132] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0133] Election Management Body: Every election is initiated by an election management body, which is responsible for establishing election parameters, voter registration, and publishing key information, including the identity of eligible voters, candidate lists, and vote counting functions that use ballots as input.

[0134] Bulletin Board: The bulletin board serves as a repository for public information related to the election. It includes details of voters’ valid ballots, voting results, and other relevant information that is accessible to the public. The choice of blockchain as a bulletin board in the solution can achieve tamper-proof public records and facilitate public verification.

[0135] Voting User Terminal (Voter): The eligible voter group consists of n individuals, n greater than 1, denoted as V1, ..., Vn. In actual electronic voting scenarios, voters may choose to use voting support devices or their mobile devices to vote. Voters send their ballots to the bulletin board for publication and send parameter information to the obfuscated circuit to evaluate the counting circuit. Finally, information is obtained to verify the election count.

[0136] Counters: The election management body appoints y counting parties to carry out the counting operation and publish the intermediate and final results and proofs on a public bulletin board for the public to verify correctness.

[0137] See also Figure 1 This embodiment provides a lightweight and publicly verifiable electronic voting method, which is executed by an electronic voting system, which includes: an election management agency, a bulletin board, multiple voting user terminals, and multiple vote counting parties; the method includes:

[0138] S1. The election management agency obtains pre-set system parameters and publishes the system parameters on the bulletin board. The vote counting party generates initial parameters based on the system parameters.

[0139] The initial parameters include a global key;

[0140] The system parameters include: security parameter k, number of candidates, counting function with votes as input, voting start time and end time, list of legal voting users and list of designated counting parties, first circuit C;

[0141] The first circuit C is a logic circuit transformed by a vote counting function;

[0142] This step publishes system parameters (such as security requirements, number of candidates, voting time, counting logic, etc.) on the bulletin board in advance, so that all voters and counting parties can obtain the same initial information. This ensures the transparency of the election before voting begins, prevents disputes caused by opaque parameters, and enhances the credibility of the election process. The public system parameters also provide voters with a checkable public basis to ensure that they can exercise their voting rights under a clear set of rules, while facilitating the audit and verification of the system.

[0143] S2. The voting user terminal obtains corresponding voting information based on the system parameters and the initial parameters, and publishes the voting information on the bulletin board;

[0144] The voting user terminal generates ballot information based on system parameters and initial parameters, which ensures the structure and encryption consistency of the ballot, so that each ballot can be verified and calculated. The ballot information is encrypted to ensure privacy, and its publication on the bulletin board makes it possible to make all ballot data public. This not only avoids possible black box operations, but also prevents data tampering after voting, effectively increasing the credibility of the election process. By publicly publishing ballot information on the bulletin board, everyone can monitor and verify whether there are any abnormalities in the data.

[0145] This embodiment uses the public blockchain as a bulletin board to ensure that user votes are confirmed in a timely manner and cannot be changed by adversaries; at the same time, the intermediate counting process of the counting party will be placed on the blockchain public board for notarization to ensure the legality and compliance of the counting process and resist malicious counting parties.

[0146] S3. The vote counting party determines whether the ballot information is legal, obtains a first determination result, and obtains label information of an output line of each gate circuit in the first circuit C if the first determination result is that the ballot information is legal;

[0147] The label information includes: a label for identifying a bit value on the output line and a bit after the output line mask;

[0148] The vote counter ensures that each ballot complies with the rules through legitimacy judgment in this S3 step, avoiding duplicate voting or invalid voting, thereby ensuring the fairness of the election. In addition, obtaining the label information of each gate circuit output line helps to verify and record the state of the ballot in the logic circuit and ensure the accuracy of the calculation.

[0149] S4. The vote counting party verifies the label information of the output line of each gate circuit in the first circuit C, obtains the final vote counting result and puts the final vote counting result on the bulletin board.

[0150] By verifying the tag information, the counting party can quickly determine whether the status of each ballot in the circuit logic is accurate, thereby obtaining the final counting results. This verification method not only improves the efficiency of counting, but also effectively prevents human errors. In addition, posting the final counting results on the bulletin board allows voters and election management agencies to publicly check the accuracy and consistency of the results, enhancing the transparency of the election. By making the results public, the system also allows external agencies to conduct independent reviews, further enhancing the credibility and tamper-proof capabilities of this electronic voting method.

[0151] This embodiment uses a secret shared key generated by multiple vote counters for encryption, which can ensure that the privacy of voters cannot be obtained when fewer than y vote counters collude.

[0152] In this embodiment, S1 specifically includes:

[0153] S11, the election management agency obtains system parameters and publishes the system parameters on the bulletin board;

[0154] In this embodiment, the vote counting function with votes as input may be:

[0155] f=a1*v1+...+aj*vj+...+an*vn;

[0156] Wherein, vj represents a single-bit vote cast by voting user terminal Vj; aj represents an identification bit indicating whether voting user terminal Vj has voted legally;

[0157] The first circuit C is:

[0158] I1×...×Ij×...×In→O;

[0159] Where Ij is the input line corresponding to the j-th voting user terminal Vj;

[0160] O is the final output line; n is the total number of voting user terminals;

[0161] The election management agency obtains the preset system parameters (such as security parameter k, number of candidates, counting logic, voting time, etc.) and publishes these parameters on the bulletin board so that all participants can view them. Publicizing system parameters ensures the transparency of the voting process, ensuring that all voters and counting parties operate under unified standards and preventing disputes that may arise due to information asymmetry.

[0162] Specifically, in the scenario of voting for a single candidate, an example is given below: Assume that a company is holding a vote to decide whether the only candidate A will take up a new management position. All voting users can choose "agree" or "disagree" and complete the vote through the electronic voting system. The entire system consists of an election management agency, a bulletin board, voting user terminals, and a vote counting party, and the vote is based on a simple majority pass system.

[0163] The election management body sets system parameters, including:

[0164] Security parameter k=256 (used for system encryption to ensure security);

[0165] The candidate is a single person, that is, the number of candidates is 1;

[0166] The voting rule is "simple majority voting" (the counting function is "yes" and more than half of the votes are passed);

[0167] Voting will be from 9:00 a.m. to 5:00 p.m. on October 1;

[0168] A list of legal voting users, a list of unique candidates, and two lists of vote counting parties.

[0169] The management body posts the system parameters on a notice board, ensuring that all participants can see them.

[0170] S12, after each vote counting direction verifies its identity with the election management agency, it generates a corresponding global key according to the security parameter k;

[0171] is the global key corresponding to the first vote counting party Ti;

[0172] The first counting party Ti is the i-th counting party among all counting parties, and i=1, 2, …, y;

[0173] y is the number of vote counting parties;

[0174] Before voting begins, each counting party performs identity authentication. After passing the authentication, each counting party generates a unique global key based on the security parameter k. For example, the global key of a counting party is a string of 256-bit random numbers to ensure that the data is protected during its operation. Counting party identity authentication ensures that only authorized counting parties can participate in the counting process, and the global key of each counting party is generated independently, which further ensures the security of the system and prevents tampering or leakage in the counting process.

[0175] S13. For the line w in the first circuit C that is within the first range, each vote counting party generates a corresponding verifiable mask bit share;

[0176] in, The share of verifiable masked bits generated by the first counting party Ti;

[0177] The first range is I1∪...Ij...∪In∪W; wherein W is a set of output lines of the AND gate in the first circuit C;

[0178] Mask for line w The share of mask bits belonging to the first counting party Ti in ;

[0179] Information-theoretic secure message authentication code containing the mask bit share of the first counting party Ti and the key corresponding to the information theory security message authentication code of each other vote counting party except the first vote counting party and the mask on line w The share of mask bits belonging to the first counting party Ti in ;

[0180] The second vote counting party Tj is any other vote counting party except the first vote counting party; wherein j=1, 2, …, y, and j≠i;

[0181] The key corresponding to the information-theoretic secure message authentication code of the second vote counter Tj's masked bit share;

[0182] The vote counter generates a mask bit share for encryption based on the system parameters to protect the content of each vote. For example, for the choice of "agree" or "disagree", a mask bit string is generated for each voting user's ballot line and assigned to the output line in line W that represents the number of votes.

[0183] The mask bit share generates independent encryption protection for each voting line, ensuring the privacy of voting information during transmission. At the same time, this mask prevents any single counting party from reading or tampering with voting information, improving the security and fairness of the system.

[0184] S14, the first vote counting party Ti selects a random bit string of k bits as a label with bit 0 , a label with bit value 1 ;in, ;

[0185] To prevent the leakage of voting content, each counting party generates a random bit string label to cover the binary value of the vote. For example, the bit label of "agree" may be assigned "100101" and the label of "disagree" may be assigned "011010". Random bit labels increase the unpredictability of voting data, making voting information unbreakable even during transmission. The randomization of labels ensures data privacy and prevents illegal reading of voting content.

[0186] S15. For the line w in the second range, the first counting party Ti generates an AND gate triplet. ;

[0187] The second range is a set of output lines W of the AND gates in the first circuit C;

[0188] in, The mask bit share of the first element in the AND gate triplet generated by the first counting party Ti;

[0189] The mask bit share of the second element in the AND gate triplet generated by the first counting party Ti;

[0190] The mask bit share of the third element in the AND gate triplet generated by the first counting party Ti;

[0191] The circuit includes AND gates to determine whether the vote has passed. In this step, the counting party generates an AND gate triple to indicate in encrypted form whether the "yes" votes have reached the majority. For example, the AND gate triple (mask bit share 1, mask bit share 2, mask bit share 3) is used to compare and count the "yes" votes. The generation of AND gate triples can quickly calculate and verify the accuracy of the AND gate logic output, ensuring the correctness and efficiency of the calculation during the counting process, while preventing any counting party from tampering with the data.

[0192] S16. For each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, the first counting method Ti calculates ,as well as ;

[0193] Among them, each gate circuit G= ; , They are the input lines corresponding to the gate circuit type g, is the output line corresponding to the gate circuit type g;

[0194] Mask for line α The share of verifiable masked bits belonging to the first counting party Ti in ;

[0195] Mask for line α The share of mask bits belonging to the first counting party Ti in ;

[0196] Mask for line β The share of verifiable masked bits belonging to the first counting party Ti in ;

[0197] Mask for line β The share of mask bits belonging to the first counting party Ti in ;

[0198] Mask for line γ The share of verifiable masked bits belonging to the first counting party Ti in ;

[0199] Mask for line γ The share of mask bits belonging to the first counting party Ti in ;

[0200] is the label with bit 0 on line γ belonging to the first counting party Ti;

[0201] is the label with bit 0 on line α belonging to the first counting party Ti;

[0202] is the label with bit 0 on line β belonging to the first counting party Ti;

[0203] For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the first counting party Ti, according to the AND gate triple , get and , and based on and , respectively reconstructed and , further based on the AND gate triple , as well as , get the verifiable first mask bit share after the AND gate processing ;

[0204] in, ; ; , ;

[0205] ;

[0206] In this embodiment, each vote counting party verifies the logic of each XOR gate and AND gate in the circuit according to the label and mask bit share. For example, the XOR gate is used to count the bit values ​​of agreement and disagreement to ensure the accuracy of vote counting. This classification of logic circuits improves the calculation and verification efficiency of the system, ensures the accuracy of the counting logic, and effectively reduces the counting deviation caused by logic gate processing errors.

[0207] S17, based on the verifiable first mask bit share after AND gate processing , random number t and random number s, the first counting party Ti locally calculates the verifiable second mask bit share after the AND gate processing ; Where, t∈{0,1}, s∈{0,1};

[0208] in, ;

[0209] Specifically, when the counting party verifies the AND gate triplet, it uses a random number to generate the mask bit share of the AND gate output. For example, to determine whether the number of "agree" votes exceeds half, the system randomly generates a mask bit string to ensure the uniqueness of the calculation. The S17 step increases the randomness and uniqueness of the data, ensures the unpredictability of the voting line, and makes the system more secure. The verifiable mask bit share of the AND gate improves the independence of each line and reduces the possibility of interference and tampering.

[0210] S18: The first vote counting party Ti locally calculates the labels of the input line α and the input line β whose bit values ​​are 1. and ;in, , ;

[0211] According to the random number t and the random number s, the first counting party Ti locally calculates the AND gate ciphertext , and the AND gate ciphertext Sent to the designated vote counter T1;

[0212] ;

[0213] in, is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0214] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0215] H() is the hash function;

[0216] In this embodiment, the vote counter generates a bit value label for the input line and converts the label into ciphertext and transmits it to the bulletin board. For example, the label of "Agree" is "100101" and is encrypted into a set of ciphertext. By generating bit labels and encrypting them, the security of data in transmission is ensured, the bit values ​​are prevented from being directly read or modified, and the privacy and authenticity of voting information are further protected.

[0217] S19, the first vote counting party Ti, through a secure channel, sends the secret key r used for voting i，j Sent to voting user terminal Vj; j∈{1,...,n};

[0218] Among them, the secret key r i，j It is based on the mask on line w The share of mask bits belonging to the first counting party Ti What you get.

[0219] Each counting party distributes the generated secret key to each voting user terminal through a secure channel to ensure that users can encrypt and protect their votes. i，jSent to the jth voting user so that the user can encrypt his or her "agree" or "disagree" ballot information. The independent distribution of secret keys provides each voting user with unique encryption support, ensuring the authenticity and immutability of the ballot information. The secret keys are protected during transmission, making it impossible to tamper with the voting information before it is posted on the bulletin board, increasing the reliability of the voting process.

[0220] In this embodiment, S2 specifically includes:

[0221] S21, the voting user terminal Vj uses the secret key r i，j Encrypt the single-bit vote vj cast by voting user terminal Vj and obtain the corresponding ciphertext c j ;

[0222] in, ;

[0223] For example, assume that user terminal V1 casts a "yes" vote, which is represented by a bit value vj = 1. Voting user terminal V1 uses the secret key r distributed by the vote counting party to i，j Encrypt the bit value to generate ciphertext c j After encryption, the ciphertext may appear as "1100101010", and the voting content cannot be directly read. Through encryption, the content of the ballot is protected to prevent tampering or identification by others during transmission and storage. The encrypted ciphertext ensures voting privacy, keeping the voting results opaque before the final decryption, and preventing anyone from knowing the voting content in advance before the votes are counted.

[0224] S22, the voting user terminal Vj uses the sign signature algorithm to sign the ciphertext c j Sign and obtain the signature of the ciphertext;

[0225] in, ;sign() is the sign signature algorithm;

[0226] is the signature of the ciphertext;

[0227] The voting user terminal Vj uses the signature algorithm sign() to sign the generated ciphertext and generate the signature of the ciphertext. The signing process ensures the authenticity of the ciphertext and the credibility of its source.

[0228] For example, the signature may be "5d41402abc4b2a76b9719d911017c592", which is a unique identifier generated based on the ciphertext. The ciphertext signature can ensure that the source of the ballot is a legitimate user terminal and has not been forged. Through signature verification, the system can ensure that each ballot comes from a valid voter when counting votes, prevent voting information from being forged, replaced or submitted repeatedly, and ensure the integrity of voting data.

[0229] S23, the voting user terminal Vj publishes the ballot information on the bulletin board;

[0230] The ballot information includes the ciphertext c j , the signature of the ciphertext and the ID of the voting user terminal Vj.

[0231] Posting ballot information on the bulletin board makes all voting records transparent and accessible, and anyone can view the encrypted voting data and signatures. Due to data encryption, the content of the ballot cannot be read directly, which protects privacy and ensures process transparency. At the same time, the records in the bulletin board provide data support for subsequent counting and verification, ensuring the verifiability and traceability of voting information.

[0232] Specifically, the S3 specifically includes:

[0233] S31, the vote counting party Ti determines whether the ballot information published by the voting user terminal Vj on the bulletin board is legal, and obtains a first determination result;

[0234] For example, if the length of the ciphertext uploaded by a voting user does not match the number of candidates, the system will mark the ballot as illegal, thereby refusing the ballot from entering the counting process, thus maintaining the fairness of the system. This embodiment ensures that only qualified voting information enters the subsequent counting process by judging the legitimacy of the ballot information, thereby preventing invalid or malicious ballots from interfering with the counting results.

[0235] S32: If the first judgment result is legal, the first vote counting party Ti, based on the ciphertext c of any legal voting user terminal Vj on the public bulletin board, j , the corresponding label Send to the designated vote counter T1; where i∈{2,...,y} is set;

[0236] Specifically, if the ballot information is determined to be legal, the first counting party Ti sends the ticket label to the designated counting party T1, so that the designated counting party T1 can accurately process the ballot in the circuit C. Ensure that the label information of all legal ballots is mastered by the counting party, so that the subsequent logic circuit C can correctly process the input and obtain accurate counting results.

[0237] S33, input the ciphertext as the masked bits on the input line into the first circuit C, and for each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, designate the vote counter T1 to calculate the masked bits on the output line γ of the gate circuit G. ;

[0238] in, ;

[0239] is the masked bit of the input line α of the gate G; is the masked bit of the input line β of the gate circuit G; The masked bit of the output line γ of gate circuit G;

[0240] Specify the label set of the output line γ of the counting gate circuit G by the counting party T1;

[0241] Among them, the label set of the output line γ is:

[0242] ;

[0243] Process each XOR gate circuit and calculate the output line mask and label information of the gate to lay the foundation for the overall circuit calculation and ensure the correctness of the calculation. For example, if the bits on the input lines α and β are 0 and 1, after the XOR gate processing, the mask bit of the output line γ is 1. The designated vote counter T1 calculates the label set of γ for subsequent output verification and statistics.

[0244] S34. For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the mask bit of the gate circuit and its corresponding output line label are calculated based on the AND gate ciphertext and the information-theoretic security message authentication code in the verifiable mask bit share of the input line locally owned by the vote counter.

[0245] In this embodiment, the mask bits and label information of the AND gate circuit are calculated to ensure that the logic of the AND gate is correctly applied to the ballot data, so that the logical calculation of the voting result is consistent with the circuit design.

[0246] Specifically, the S31 includes:

[0247] For the ciphertext c in the ballot information j And the signature of the ciphertext And the identification bit of the voting user terminal Vj is obtained to determine whether it is legal or correct. If the ciphertext c j And the signature of the ciphertext and the obtained identification bits of the voting user terminal Vj are all legal or correct, then the first judgment result is that the ballot information is legal;

[0248] Among them, if the ciphertext c j The length is the same as the number of candidates, then the ciphertext c is determined j legitimate;

[0249] If the ciphertext c j If the length is different from the number of candidates, then the ciphertext c is determined j Illegal.

[0250] For example, suppose there are three candidates in an electronic voting system, and the votes of voting users will be encrypted into ciphertext (for example, ciphertext c j ) and upload it to the bulletin board. The counting party needs to verify the legitimacy of each ballot. The specific operations are as follows:

[0251] The ciphertext c generated by the voting user terminal Vj j Used to represent voting content. If there are 3 candidates in the system, the legal ciphertext length should be 3 bits.

[0252] Example: If the ciphertext c j If the length is 3 bits, the ciphertext length is considered legal (for example, the ciphertext c j is "101", indicating that the user voted for a certain candidate combination).

[0253] If the ciphertext c j If the length is 2 bits (such as "10") or 4 bits (such as "1001"), it does not match the number of candidates and will be considered illegal.

[0254] The system requires each voting user to generate the ciphertext c j The voting party needs to verify the validity of the signature. For example, the voting user terminal Vj signs and uploads the ciphertext "101". The voting party verifies the authenticity and integrity of the signature and confirms that the ciphertext has not been tampered with. If the signature is invalid, the ballot is deemed illegal.

[0255] The counting party checks whether the identification bit of the voting user terminal Vj is correct to ensure that the user is a valid voting user. If the identification bit of user Vj matches the voting user list registered in the system, the user is confirmed to be eligible to vote. If the identification does not match, the ballot is invalid and does not participate in the counting.

[0256] This embodiment can ensure that the uploaded ballot data has not been tampered with and guarantee the integrity and accuracy of the voting information by verifying the ciphertext length, signature and user identification bits.

[0257] Specifically, the S34 specifically includes:

[0258] For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, let bit t= ,s= , for i=1,...,y, the designated vote counter T1 calculates:

[0259] ;

[0260] The designated vote counter T1 then checks the accuracy of the Agreement and, if it is incorrect, terminate the Agreement;

[0261] If successful, the designated vote counter T1 will calculate The label set of the output line γ of the AND gate G .

[0262] This embodiment sets a verification step on each AND gate circuit separately, which prevents the mask bit share from being forged or tampered with, and ensures that the information of each ballot is accurately verified. This can prevent malicious users from using the AND gate circuit to improperly influence the voting results. By using a secure message verification code (such as a mask bit share information theory secure message verification code) to verify the accuracy of the calculation, the system can immediately terminate the protocol when an incorrect mask bit share is detected, thereby effectively maintaining the reliability of the voting data.

[0263] Specifically, the S4 specifically includes:

[0264] S41, designated vote counting party T1 is published on the notice board , and calculate , then, Send to the second vote counting party Tj, j≠i;

[0265] Where x is a random k-bit string generated by the designated vote counter T1;

[0266] In this embodiment, the designated vote counting party T1 generates a random k-bit string and publishes it on the bulletin board. Subsequently, the designated vote counting party T1 uses this string to perform calculations and sends the results to other vote counting parties (such as Tj). Publicizing the random string and preliminary calculation results helps ensure the openness and transparency of the vote counting process, allowing all participants to observe the calculation process and prevent tampering and falsification of voting information.

[0267] S42, the second counting party Tj retrieves the votes from the bulletin board And judge h i Whether the calculation is correct, obtaining a second judgment result;

[0268] If the second judgment result is h i If it is not calculated correctly, the agreement will terminate;

[0269] If the second judgment result is h i If the calculation is correct, proceed to the next step;

[0270] In this embodiment, the second vote counter Tj obtains the calculation results of the designated vote counter T1 from the bulletin board and verifies its accuracy. If the calculation is correct, the counting process continues; if the calculation is incorrect, the protocol terminates. The accuracy and fairness of each counting step are ensured by verifying the calculation results of the designated vote counter T1 through the independent vote counter Tj. Any calculation errors can be discovered and terminated in time, increasing the reliability and transparency of the counting process.

[0271] S43, for each XOR gate circuit in the first circuit C, the second vote counting party Tj calculates the masked bit of the XOR gate circuit output line γ ; ;

[0272] For each XOR gate circuit, the second counting party Tj calculates the bit value after the output line mask and uses the result for subsequent verification. The output calculation of the XOR gate circuit ensures the correct application of the circuit logic, helping the system to retain the integrity of each ballot when processing voting data and avoid inaccurate voting results due to logical errors.

[0273] S44, for each AND gate circuit in the first circuit C, the second vote counting party Tj batch checks the correctness of the calculation of the AND gate output line γ;

[0274] For each AND gate circuit in the circuit, the second counting party Tj batch checks the calculation results of the output line to ensure the correctness of the mask bits and the accuracy of the label set. The batch checking mechanism improves the verification efficiency, ensures that the output calculation of each AND gate circuit is correct, and helps maintain the integrity and reliability of the final counting results. At the same time, batch operations reduce the computational cost in the verification process and improve the computing performance of the system.

[0275] S45. When the second vote counting party Tj has batch checked that the AND gate output line γ is calculated correctly, the first vote counting party Ti publishes it on the public bulletin board PBB. Then, the designated counting party T1 calculates and publishes the final counting results and sign the final vote count results on the bulletin board.

[0276] When all verification steps are passed, the designated counting party T1 publishes the final counting results on the bulletin board and signs them to ensure that they cannot be tampered with. Signing and publicly publishing the final counting results ensures the authenticity and tamper-proof nature of the results, making the final voting results authoritative, and anyone can publicly verify the accuracy and completeness of the results on the bulletin board.

[0277] In this embodiment, the S44 specifically includes:

[0278] S441, the second vote counter Tj calculates locally:

[0279] ;

[0280] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0281] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0282] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0283] is the share of verifiable mask bits middle Information-theoretic secure message authentication codes;

[0284] The second vote counter Tj locally calculates the secure message verification code of each mask bit output by the AND gate to verify the correctness of the mask bit. These verification codes are compared with the pre-set information theory secure message verification code. By calculating the message verification code locally, the second vote counter Tj can independently verify the mask bit share to ensure that there is no tampering or calculation error, and to ensure the integrity and security of the output bit value of each AND gate circuit.

[0285] S442, designate the vote counter T1 to calculate:

[0286] ;

[0287] ;

[0288] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0289] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0290] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0291] is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code;

[0292] ;

[0293] The designated vote counter T1 calculates the key value associated with the message authentication code locally to ensure that the correctness of the mask bits can be further verified by the key when publishing data. This step enhances the verification strength of the message authentication code through the generation and application of the key, allowing the system to ensure the accuracy and non-tamperability of each calculation step at a higher security level.

[0294] S443, the second counting party Tj calculates and signed it, and posted it on the bulletin board;

[0295] in, It is an almost universal linear hash function;

[0296] After completing the local calculation and verification, the second vote counter Tj signs and confirms the results, and publishes these calculation results on the bulletin board for other parties to view. By signing and publishing to the bulletin board, the second vote counter Tj discloses the verification process and results, improves the transparency of the system, and enables other vote counters and observers to publicly verify the correctness of the second vote counter Tj's calculations, ensuring the credibility of the entire process.

[0297] S444, designated vote counter T1 calculation and sign it, then post it on the bulletin board; =0, then it is determined that the calculation of the AND gate output line γ is correct.

[0298] The designated vote counter T1 recalculates and verifies the relevant information locally, and publishes the verification results on the bulletin board after completing the signature. If all verifications pass, it is finally confirmed that the output calculation of the AND gate is correct. The final signature and confirmation by the designated vote counter T1 ensures the authority of the verification results, so that everyone can check the final and correct AND gate output calculation results through the bulletin board, which increases the reliability and openness of the system.

[0299] In this embodiment, the method further includes: S5, publicly verifying the final counting result to determine whether the final counting result is correct and obtain a final judgment result.

[0300] Specifically, the S5 specifically includes:

[0301] S51, any vote counting party or voting user confirms the authenticity of the information on the bulletin board by signing, and verifies the results of voting to determine whether each voting user terminal has cast a legal vote, and , verify whether the counting party has calculated correctly during the counting process;

[0302] Any vote counter or voting user can confirm the voting process by checking the authenticity of the information on the bulletin board. Specifically, through the signature confirmation on the bulletin board, it is verified whether each voting user terminal has voted legally, ensuring that all voting data is signed and not tampered with. This step ensures the transparency of the voting process and the integrity of the information, prevents external attackers or malicious users from tampering with voting information, and ensures that all voting data is legal and verifiable. This helps to establish the credibility and security of the voting system.

[0303] S52: When it is determined that each voting user terminal has cast a legal vote and the counting party has calculated correctly during the counting process, the ciphertext c published by the voting user terminal is j As the input of the first circuit C, the final encrypted vote counting result is obtained through the operation of the first circuit C;

[0304] On the basis of ensuring that the votes cast by each voting user terminal are legal, the legal ballot ciphertexts are input into the first circuit C for operation to obtain the final encrypted vote counting results. All legal ballots are uniformly input into circuit C to ensure that the system can perform comprehensive vote counting and ensure the fairness and accuracy of the final results. At the same time, the generation of encrypted vote counting results provides a basis for subsequent decryption and result verification.

[0305] S53, decrypt the final encrypted vote counting result to obtain the actual voting data, compare the actual voting data with the result of the vote counting function issued by the designated vote counting party T1 to obtain the final judgment result;

[0306] If the actual voting data and the result of the counting function published by the designated counting party T1 are correct, it is determined that the final counting result and the counting process are correct.

[0307] After the encrypted counting results are generated, the counting party will decrypt them to obtain the actual voting data. Next, the system will compare the decrypted actual voting data with the counting function results published by the designated counting party T1 to verify the correctness of the final counting results. Through decryption and comparison, the system can verify that every step of the counting process is accurate. If the comparison results are consistent, it means that the entire voting process and counting process are correct; if they are inconsistent, further inspections can be carried out to find the source of the error. This step enhances the verifiability of the voting system and the credibility of the counting results.

[0308] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0309] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0310] In the present invention, unless otherwise clearly specified and limited, when a first feature is “on” or “below” a second feature, it may be that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. Moreover, when a first feature is “above”, “above” or “above” a second feature, it may be that the first feature is directly above or obliquely above the second feature, or it may simply mean that the first feature is higher in level than the second feature. When a first feature is “below”, “below” or “below” a second feature, it may be that the first feature is directly below or obliquely below the second feature, or it may simply mean that the first feature is lower in level than the second feature.

[0311] In the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0312] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may alter, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A lightweight and publicly verifiable electronic voting method, characterized in that: The method is performed by an electronic voting system, which includes: an election management agency, a bulletin board, multiple voting user terminals, and multiple vote counting parties; the method includes: S1. The election management agency obtains pre-set system parameters and publishes the system parameters on the bulletin board. The vote counting party generates initial parameters based on the system parameters. The initial parameters include a global key; The system parameters include: security parameter k, number of candidates, counting function with votes as input, voting start time and end time, list of legal voting users and list of designated counting parties, first circuit C; The first circuit C is a logic circuit transformed by a vote counting function; S2. The voting user terminal obtains corresponding voting information based on the system parameters and the initial parameters, and publishes the voting information on the bulletin board; S3. The vote counting party determines whether the ballot information is legal, obtains a first determination result, and obtains label information of an output line of each gate circuit in the first circuit C if the first determination result is that the ballot information is legal; The label information includes: a label for identifying a bit value on the output line and a bit after the output line mask; S4. The vote counting party verifies the label information of the output line of each gate circuit in the first circuit C, obtains the final vote counting result and puts the final vote counting result on the bulletin board.

2. The lightweight and publicly verifiable electronic voting method according to claim 1, characterized in that: The S1 specifically includes: S11, the election management agency obtains system parameters and publishes the system parameters on the bulletin board; The first circuit C is: I1×...×Ij×...×In→O; Where Ij is the input line corresponding to the j-th voting user terminal Vj; O is the final output line; n is the total number of voting user terminals; S12, after each vote counting direction verifies its identity with the election management agency, it generates a corresponding global key according to the security parameter k; is the global key corresponding to the first vote counting party Ti; The first counting party Ti is the i-th counting party among all counting parties, and i=1, 2, …, y; y is the number of vote counting parties; S13. For the line w in the first circuit C that is within the first range, each vote counting party generates a corresponding verifiable mask bit share; in, The share of verifiable masked bits generated by the first counting party Ti; The first range is I1∪...Ij...∪In∪W; wherein W is a set of output lines of the AND gate in the first circuit C; Mask for line w The share of mask bits belonging to the first counting party Ti in ; Information-theoretic secure message authentication code containing the mask bit share of the first counting party Ti and the key corresponding to the information theory security message authentication code of each other vote counting party except the first vote counting party and the mask on line w The share of mask bits belonging to the first counting party Ti in ; The second vote counting party Tj is any other vote counting party except the first vote counting party; wherein j=1, 2, …, y, and j≠i; The key corresponding to the information-theoretic secure message authentication code of the second vote counter Tj's masked bit share; S14, the first vote counting party Ti selects a random bit string of k bits as a label with bit 0 , a label with bit value 1 ;in, ; S15. For the line w in the second range, the first counting party Ti generates an AND gate triplet. ; The second range is a set of output lines W of the AND gates in the first circuit C; in, The mask bit share of the first element in the AND gate triplet generated by the first counting party Ti; The mask bit share of the second element in the AND gate triplet generated by the first counting party Ti; The mask bit share of the third element in the AND gate triplet generated by the first counting party Ti; S16. For each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, the first counting method Ti calculates ,as well as ; Among them, each gate circuit G= ; , They are the input lines corresponding to the gate circuit type g, is the output line corresponding to the gate circuit type g; Mask for line α The share of verifiable masked bits belonging to the first counting party Ti in ; Mask for line α The share of mask bits belonging to the first counting party Ti in ; Mask for line β The share of verifiable masked bits belonging to the first counting party Ti in ; Mask for line β The share of mask bits belonging to the first counting party Ti in ; Mask for line γ The share of verifiable masked bits belonging to the first counting party Ti in ; Mask for line γ The share of mask bits belonging to the first counting party Ti in ; is the label with bit 0 on line γ belonging to the first counting party Ti; is the label with bit 0 on line α belonging to the first counting party Ti; is the label with bit 0 on line β belonging to the first counting party Ti; For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the first counting party Ti, according to the AND gate triple , get and , and based on and , respectively reconstructed and , further based on the AND gate triple , as well as , get the verifiable first mask bit share after the AND gate processing ; in, ; ; , ; ； S17, based on the verifiable first mask bit share after AND gate processing , random number t and random number s, the first counting party Ti locally calculates the verifiable second mask bit share after the AND gate processing ; Where, t∈{0,1}, s∈{0,1}; in, ; S18: The first vote counting party Ti locally calculates the labels of the input line α and the input line β whose bit values ​​are 1. and ;in, , ; According to the random number t and the random number s, the first counting party Ti locally calculates the AND gate ciphertext , and the AND gate ciphertext Sent to the designated vote counter T1; ； in, is the share of verifiable mask bits middle Information-theoretic secure message authentication codes; is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code; H() is the hash function; S19, the first vote counting party Ti, through a secure channel, sends the secret key r used for voting i，j Sent to voting user terminal Vj; j∈{1,...,n}; Among them, the secret key r i，j It is based on the mask on line w The share of mask bits belonging to the first counting party Ti What you get.

3. The lightweight and publicly verifiable electronic voting method according to claim 2, characterized in that: The S2 specifically includes: S21, the voting user terminal Vj uses the secret key r i，j Encrypt the single-bit vote vj cast by voting user terminal Vj and obtain the corresponding ciphertext c j ; in, ; S22, the voting user terminal Vj uses the sign signature algorithm to sign the ciphertext c j Sign and obtain the signature of the ciphertext; in, ;sign() is the sign signature algorithm; is the signature of the ciphertext; S23, the voting user terminal Vj publishes the ballot information on the bulletin board; The ballot information includes the ciphertext c j , the signature of the ciphertext and the ID of the voting user terminal Vj.

4. The lightweight and publicly verifiable electronic voting method according to claim 3, characterized in that: The S3 specifically includes: S31, the vote counting party Ti determines whether the ballot information published by the voting user terminal Vj on the bulletin board is legal, and obtains a first determination result; S32: If the first judgment result is legal, the first vote counting party Ti, based on the ciphertext c of any legal voting user terminal Vj on the public bulletin board, j , the corresponding label Send to the designated vote counter T1; where i∈{2,...,y} is set; S33, input the ciphertext as the masked bits on the input line into the first circuit C, and for each gate circuit G in the first circuit C, if the gate circuit is an XOR gate, designate the vote counter T1 to calculate the masked bits on the output line γ of the gate circuit G. ; in, ; is the masked bit of the input line α of the gate G; is the masked bit of the input line β of the gate circuit G; The masked bit of the output line γ of gate circuit G; Specify the label set of the output line γ of the counting gate circuit G of the counting party T1; Among them, the label set of the output line γ is: ； S34. For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, the mask bit of the gate circuit and its corresponding output line label are calculated based on the AND gate ciphertext and the information-theoretic security message authentication code in the verifiable mask bit share of the input line locally owned by the vote counter.

5. The lightweight and publicly verifiable electronic voting method according to claim 4, characterized in that: The S31 includes: For the ciphertext c in the ballot information j And the signature of the ciphertext And the identification bit of the voting user terminal Vj is obtained to determine whether it is legal or correct. If the ciphertext c j And the signature of the ciphertext and the obtained identification bits of the voting user terminal Vj are all legal or correct, then the first judgment result is that the ballot information is legal; Among them, if the ciphertext c j The length is the same as the number of candidates, then the ciphertext c is determined j legitimate; If the ciphertext c j If the length is different from the number of candidates, then the ciphertext c is determined j Illegal.

6. The lightweight publicly verifiable electronic voting method according to claim 5, characterized in that: The S34 specifically includes: For each gate circuit G in the first circuit C, if the gate circuit is an AND gate, let bit t= ,s= , for i=1,...,y, the designated vote counter T1 calculates: ； The designated vote counter T1 then checks the accuracy of the Agreement and, if it is incorrect, terminate the Agreement; If successful, the designated vote counter T1 will calculate The label set of the output line γ of the AND gate G .

7. The lightweight publicly verifiable electronic voting method according to claim 6, characterized in that: The S4 specifically includes: S41, designated vote counting party T1 is published on the notice board , and calculate , then, Send to the second counting party Tj, j≠i; Where x is a random k-bit string generated by the designated vote counter T1; S42, the second counting party Tj retrieves the votes from the bulletin board And judge h i Whether the calculation is correct, obtaining a second judgment result; If the second judgment result is h i If it is not calculated correctly, the agreement will terminate; If the second judgment result is h i If the calculation is correct, proceed to the next step; S43, for each XOR gate circuit in the first circuit C, the second vote counting party Tj calculates the masked bit of the XOR gate circuit output line γ ; ; S44, for each AND gate circuit in the first circuit C, the second vote counting party Tj batch checks the correctness of the calculation of the AND gate output line γ; S45. When the second vote counting party Tj has batch checked that the AND gate output line γ is calculated correctly, the first vote counting party Ti publishes the results on the public bulletin board PBB. Then, the designated counting party T1 calculates and publishes the final counting results and sign the final vote count results on the bulletin board.

8. The lightweight and publicly verifiable electronic voting method according to claim 7, characterized in that: The S44 specifically includes: S441, the second vote counter Tj calculates locally: ； is the share of verifiable mask bits middle Information-theoretic secure message authentication codes; is the share of verifiable mask bits middle Information-theoretic secure message authentication codes; Verifiable Mask Bit Share middle Information-theoretic secure message authentication codes; is the share of verifiable mask bits middle Information-theoretic secure message authentication codes; S442, designate the vote counter T1 to calculate: ； ； is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code; is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code; is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code; is the share of verifiable mask bits middle The key corresponding to the information-theoretic secure message authentication code; ； S443, the second counting party Tj calculates and signed it, and posted it on the bulletin board; in, It is an almost universal linear hash function; S444, designated vote counter T1 calculation and sign it, then post it on the bulletin board; =0, then it is determined that the calculation of the AND gate output line γ is correct.

9. The lightweight and publicly verifiable electronic voting method according to claim 8, characterized in that: The method further comprises: S5. Publicly verify the final vote counting result to determine whether the final vote counting result is correct and obtain a final judgment result.

10. The lightweight publicly verifiable electronic voting method according to claim 9, characterized in that: The S5 specifically includes: S51, any vote counting party or voting user confirms the authenticity of the information on the bulletin board by signing, and verifies the results of voting to determine whether each voting user terminal has cast a legal vote, and , verify whether the counting party has calculated correctly during the counting process; S52: When it is determined that each voting user terminal has cast a legal vote and the counting party has calculated correctly during the counting process, the ciphertext c published by the voting user terminal is j As the input of the first circuit C, the final encrypted vote counting result is obtained through the operation of the first circuit C; S53, decrypt the final encrypted vote counting result to obtain the actual voting data, compare the actual voting data with the result of the vote counting function issued by the designated vote counting party T1 to obtain the final judgment result; If the actual voting data and the result of the counting function published by the designated counting party T1 are correct, it is determined that the final counting result and the counting process are correct.

Images