Public counting hidden weighted distributed responsibility-traceable electronic voting method

Abstract

The invention discloses a public counting hidden weighted distributed responsibility-traceable electronic voting method, which comprises the following steps of: dividing a vote into a certain number of shares by a voter, carrying out password commitment, disclosing the commitment, encrypting the shares of the vote, and sending the encrypted shares to a corresponding distributed bill server; the bill servers verify the correctness of the vote shares and aggregate the vote shares of each voter after weighting the vote shares, and after the voting stage is finished, all the bill servers send the aggregated value of the collected vote shares to a certain specific bill server; and entrusted to carry out final aggregation to obtain a complete vote counting result and publish the final vote counting result in a verifiable manner. According to the invention, the vicious bill server cannot obtain the vote information of a single voter and the vote counting result is not known by participants except the selected bill server, so that the privacy of the voters and candidates is protected, the verifiability of the vote result is ensured, and the vicious behaviors of the participants can be responsibilized.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic voting, and in particular to a weighted distributed and accountable electronic voting method with hidden public vote counting. Background Art

[0002] Compared with traditional paper voting, electronic voting plays an increasingly important role in many scenarios that require consensus in the contemporary information society due to its advantages of high voting efficiency, low organizational cost, and strong scalability. In electronic voting, there is usually an authoritative election body responsible for managing the entire voting process. Each legal voter casts a ballot representing his or her personal wishes to the election body. After receiving the ballots from all legal voters, the election body outputs the final election results according to certain rules in accordance with the needs of the actual business scenario. For example, in the process of electing a company's board of directors, all shareholders cast corresponding votes based on the number of shares they hold. After counting the number of votes for each director candidate, the board of directors calculates the members of the next board of directors based on the number of votes.

[0003] However, in the actual deployment of electronic voting systems, only a single election agency is often used to manage the entire voting process, which makes the system prone to single point failure problems. Once the election agency has malicious behavior or is hacked by an adversary, the voter's ballot information will be leaked, which will greatly damage the voter's personal privacy. In order to alleviate this problem, a group of independent ticket servers can usually be introduced so that each ticket server is only responsible for collecting part of the ballot information. However, if the ballots are not additionally processed, the ballot information of some voters may still be directly leaked, which is still unacceptable in the electronic voting system. In order to better protect the voter's voting privacy, two methods are usually used to process the ballots: the obfuscated shuffle method and the homomorphic aggregation method. The obfuscated shuffle method refers to each ticket server randomly replacing all encrypted ballots, disrupting the correspondence between each ballot and the voter's identity. After multiple rounds of obfuscated shuffles, the output ballots can no longer correspond one-to-one with the voter's identity information. After that, the ciphertext ballots are decrypted to obtain the counting results and output the voting results. Homomorphic aggregation means that voters split their ballots into certain shares and encrypt them to different ticket servers. In this way, each ticket server can only get a share of the ballot and cannot restore the entire ballot information. After receiving the shares of all voters' ballots, the ticket server aggregates all the shares of the ballots together, and then all the ticket servers work together to restore the complete counting results, ensuring that the ballot information of a single voter is not leaked. In the obfuscated shuffling method, although the adversary cannot know the one-to-one correspondence between the ballot and the voter, the adversary can know the specific content of each ballot, while in the homomorphic aggregation method, the adversary can only know the complete counting results at most. Therefore, the homomorphic aggregation method is usually used to better protect the privacy of voters.

[0004] In addition to the privacy of voters' votes, the privacy of candidates' votes is also a problem worthy of attention. In reality, directly publishing the vote information of each candidate may face the following problems: publishing the vote information of the losing candidate may put him in an embarrassing situation; directly publishing the specific vote information of the previous round in multiple rounds of voting may affect the votes of the next round of voters; publishing the specific vote information of the winning candidate may affect the authority of the power of the lower-ranked candidates, etc. In order to alleviate this problem, the attribute of vote hiding is usually introduced, which allows the election agency to publish only the final voting results in a verifiable way, without publishing the vote counting results and other information unrelated to the voting results. Vote hiding is divided into complete vote hiding, partial vote hiding and public vote hiding. Complete vote hiding means that all participants, including the counting agency, can only know the final voting results but not the intermediate counting information. This usually requires the introduction of general verifiable multi-party secure computation, which brings heavy computational overhead; partial vote hiding means that some counting results that lead to certain specific security issues are hidden, while other results are made public. This is usually only effective for a specific security issue but cannot defend against other attacks that are not taken into consideration; public vote hiding means that only a specific elected agency knows the intermediate counting results, while other participants can only know the final voting results. This usually only requires the introduction of relatively lightweight general zero-knowledge proofs.

[0005] After introducing multiple ticket servers, the electronic voting system faces the problem of difficulty in verifying voting results and holding malicious behavior accountable, as it cannot guarantee that all ticket servers are honest and trustworthy. Verifiable results are one of the most basic security attributes of electronic voting systems. An electronic voting system with unverifiable results is not authoritative. Accountability is also an important security attribute of electronic voting systems. It not only ensures the verifiability of electronic voting methods, but also can trace the malicious behavior of participants and promptly discover malicious participants. In order to ensure the verifiability and accountability of electronic voting systems, it is often necessary to introduce cryptographic primitives such as cryptographic commitment, zero-knowledge proof, and secure multi-party computation to ensure the correctness of each step in the electronic voting system.

[0006] In addition, weighted voting is a promising attribute in electronic voting, especially in scenarios where the status and weight of each participant are unequal, such as proof-of-stake blockchain consensus, hierarchical management, and corporate elections. However, in previous weighted voting methods, voters with multiple weights often need to cast multiple single-weighted votes equal to the number of weights through virtualization, or need to generate a universal zero-knowledge proof to prove that the votes they cast are consistent with the weights, which brings a lot of additional computing overhead to voters. Summary of the invention

[0007] The purpose of the present invention is to overcome the deficiencies of the prior art and to provide a method for weighted distributed and accountable electronic voting with hidden public vote counting.

[0008] The objective of the present invention is achieved through the following technical solutions: The present invention discloses a method for electronic voting with rights, distribution and accountability with hidden public vote counting, which specifically comprises the following steps: S1, System initialization phase: The initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the numbers and weights of all legal voters on the bulletin board; the ticket server publishes its own public key on the bulletin board; S2, voting stage: the voter selects a legal ballot and splits it into several sub-ballots; the voter makes a cryptographic commitment with homomorphic properties for each sub-ballot; the voter encrypts the information for opening the sub-commitment with the public key of the corresponding ticket server, and the sub-commitment information includes the sub-ballot and the random number used to generate the sub-commitment. The voter performs a first zero-knowledge proof of the legitimacy of his or her ballot; the voter publishes the number, the first zero-knowledge proof of the legitimacy of the ballot, the commitment of the sub-ballot and the ciphertext of the opening information on the bulletin board; the bulletin board verifies the first zero-knowledge proof of the legitimacy of the ballot and verifies that any of the sub-commitment and the ciphertext appear in the legal ballot that has been verified before. If the verification fails, the bulletin board refuses to receive the ballot; the ticket server decrypts all the encrypted sub-ballots and the corresponding random numbers sent to it; the ticket server verifies the correctness of the sub-ballot and the corresponding random number in combination with the public commitment information. If the verification fails, a correctly decrypted second zero-knowledge proof is generated to report the malicious behavior of the voter and discard the ballot; S3, vote counting stage: the ticket server weights all legal sub-votes and corresponding random numbers and adds them up to obtain their respective partial vote counting results; all ticket servers send their respective partial vote counting results to a specific ticket server; the ticket server adds up all partial votes to obtain the overall vote counting result, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof to prove the correctness of the result; the ticket server publishes the final election result and the third zero-knowledge proof on the bulletin board; S4, Public Verification Phase: All participants verify the correctness of the election results based on the information on the bulletin board.

[0009] Furthermore, the step S1 specifically includes the following steps: S11. Electronic voting system Voters , Ticket Server and Voting ; S12, initialize the server according to the security parameters Determine the set of common parameters of the system ,in is a prime number, It is The multiplicative cyclic group of Both The discrete logarithmic relationship between the generators of is unknown to all participants. is a function that calculates the election result based on the vote count. is the public reference string for the universal zero-knowledge proof; S13. Initialize the server to publish the numbers of all legal voters and weight ; S14. Ticket Server Randomly generate a public-private key pair And publish the public key .

[0010] Preferably, the step S2 specifically includes the following steps: S21, Voters Encode your vote to get , and Each sub-dimension of , so that ,in To encode the votes Algorithm for dimensional orthonormal basis vectors; S22, Pair Voting , voters use the cryptographic commitment algorithm Commit to commit to it and obtain commitment information , let the second random number ,in is the first random number; S23, for each ticket server , voters use the public key Encrypted Sub-Votes and the first random number Get encrypted information ;in is a secure probabilistic public key encryption algorithm, || is the concatenation of two strings; S24. Relationship , voters call protocol Generating the first zero-knowledge proof To prove the legitimacy of the ballot, is a universal zero-knowledge proof protocol; [s] is the set of all positive integers not greater than s; S25. Voters cast their ballots Post on a bulletin board; S26. Bulletin board verification of the first zero-knowledge proof The correctness of the subcommitment and the ciphertext are verified to be present in the previously verified legal ballot. If the verification fails, the ballot is rejected. ; S27. For ballots that have passed verification , each ticket server Encrypted information Decrypt it to get ; S28, Ticket Server verify Is it true? If not, then the relationship Generate the second zero-knowledge proof To prove the correctness of the decryption, Post on the bulletin board to report a voter Malicious behavior, including and It is a secure probabilistic public key encryption algorithm.

[0011] Preferably, the step S3 specifically includes the following steps: S31. For all ballots that have passed the legality verification , each ticket server Multiply the sub-votes and random numbers sent to him by the corresponding weights and add them up to get the partial counting results. and ; S32. All ticket servers send their partial counting results to a specific ticket server. After receiving all partial counting results, the ticket server adds up the sub-ballot counting results and the random number counting results to obtain the final counting result. and ; S33, the ticket server calculates the final election result based on the vote counting result and the result function , then the relationship Generate the third zero-knowledge proof To prove the correctness of the results.

[0012] Preferably, step S4 specifically includes: all participants can verify the third zero-knowledge proof based on the information on the bulletin board correctness.

[0013] The beneficial effects of the present invention are: 1) The present invention introduces a group of distributed ticket servers. By outsourcing part of the voter's calculations to the ticket servers, the legitimacy of the vote weights is proved with the assistance of the ticket servers, which greatly reduces the computational overhead of voters' voting with rights.

[0014] 2) The present invention introduces accountability, which not only ensures the verifiability of the electronic voting method, but also can trace the malicious behavior of the participants and promptly discover malicious participants. In order to ensure the verifiability and accountability of the electronic voting system, cryptographic primitives such as cryptographic commitment, zero-knowledge proof and secure multi-party computing are introduced to ensure the correctness of each step in the electronic voting system.

[0015] 3) The present invention introduces the property of hidden vote counting, which allows the election body to publish only the final voting results in a verifiable manner without publishing the vote counting results and other information unrelated to the voting results; public vote hiding means that only a specific elected body knows the intermediate vote counting results, while other participants can only know the final voting results, which only requires the introduction of a relatively lightweight universal zero-knowledge proof. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The present invention is a flowchart of the steps of a method for weighted distributed and accountable electronic voting with hidden public vote counting according to an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0018] The invention discloses a method for electronic voting with rights and distributed accountability in which public vote counting is hidden. The method aims to solve the problem of how to realize rights and electronic voting for any voting rules while ensuring the vote privacy of voters in the electronic voting system, the vote privacy of candidates, the verifiable voting results, and the accountability of malicious behavior. The invention introduces an initialization server, a group of distributed ticket servers, and a secure bulletin board. Voters split their votes into a certain number of shares and then make a password commitment. Then, they make a public commitment and encrypt the shares of the votes and send them to the corresponding distributed ticket servers. The ticket servers verify the correctness of the vote shares and aggregate the vote shares of each voter after weighting. After the voting phase is over, all ticket servers send the aggregated values ​​of the collected vote shares to a specific ticket server, entrusting it to perform the final aggregation to obtain the complete vote counting results and publish the final vote results in a verifiable manner. In terms of security, the method ensures that a malicious ticket server cannot obtain the vote information of a single voter and the vote counting results are not known to the participants other than the selected ticket server, thereby protecting the privacy of voters and candidates. The method also ensures the verifiability of the voting results and can hold the participants accountable for malicious behavior. In addition, this method greatly improves the convenience of voters voting by outsourcing part of the calculation to a ticket server with powerful computing power. The flowchart of the steps is as follows: Figure 1 As shown, the specific steps include: S1, System initialization phase: The initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the numbers and weights of all legal voters on the bulletin board; the ticket server publishes its own public key on the bulletin board; S2, voting stage: the voter selects a legal ballot and splits it into several sub-ballots; the voter makes a cryptographic commitment with homomorphic properties for each sub-ballot; the voter encrypts the information for opening the sub-commitment with the public key of the corresponding ticket server, and the sub-commitment information includes the sub-ballot and the random number used to generate the sub-commitment. The voter performs a first zero-knowledge proof of the legitimacy of his or her ballot; the voter publishes the number, the first zero-knowledge proof of the legitimacy of the ballot, the commitment of the sub-ballot and the ciphertext of the opening information on the bulletin board; the bulletin board verifies the first zero-knowledge proof of the legitimacy of the ballot and verifies that any of the sub-commitment and the ciphertext appear in the legal ballot that has been verified before. If the verification fails, the bulletin board refuses to receive the ballot; the ticket server decrypts all the encrypted sub-ballots and the corresponding random numbers sent to it; the ticket server verifies the correctness of the sub-ballot and the corresponding random number in combination with the public commitment information. If the verification fails, a correctly decrypted second zero-knowledge proof is generated to report the malicious behavior of the voter and discard the ballot; S3, vote counting stage: the ticket server weights all legal sub-votes and corresponding random numbers and adds them up to obtain their respective partial vote counting results; all ticket servers send their respective partial vote counting results to a specific ticket server; the ticket server adds up all partial votes to obtain the overall vote counting result, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof to prove the correctness of the result; the ticket server publishes the final election result and the third zero-knowledge proof on the bulletin board; S4, Public Verification Phase: All participants verify the correctness of the election results based on the information on the bulletin board.

[0019] Specifically, the step S1 comprises the following steps: S11. Electronic voting system Voters , Ticket Server and Voting ; S12, initialize the server according to the security parameters Determine the set of common parameters of the system ,in is a prime number, It is The multiplicative cyclic group of Both The discrete logarithmic relationship between the generators of is unknown to all participants. is a function that calculates the election result based on the vote count. is the public reference string for the universal zero-knowledge proof; S13. Initialize the server to publish the numbers of all legal voters and weight ; S14. Ticket Server Randomly generate a public-private key pair And publish the public key .

[0020] Specifically, the step S2 comprises the following steps: S21, Voters Encode your vote to get , and Each sub-dimension of , so that ,in To encode the votes The algorithm for the standard orthogonal basis vectors is: ,in ; S22, Pair Voting , voters use the cryptographic commitment algorithm Commit to commit to it and obtain commitment information , let the second random number ,in is the first random number; cryptographic commitment algorithm for: , where r is a finite field A random number uniformly selected at random from ; S23, for each ticket server , voters use the public key Encrypted Sub-Votes and the first random number Get encrypted information ;in is a secure probabilistic public key encryption algorithm, || is the concatenation of two strings; S24. Relationship , voters call protocol Generating the first zero-knowledge proof To prove the legitimacy of the ballot, It is a general zero-knowledge proof protocol; Below is It is a general zero-knowledge proof. is the relationship to be proved, where x is a public statement, w is a private input, and r is the condition that the relationship needs to satisfy. The prover verifies that he knows the relationship r. , and in the whole process, no information about w will be leaked; Below Explanation: The relationship that needs to be proved is ,in is the set of all positive integers not greater than n, interactive The protocol steps are: the prover from a finite field Select a random number And calculate and Then Sent to the verification party; the verification party Randomly select x from the equation and send it to the prover; the prover calculates and Sent to the verifier; if the equation and If all are established, the verification is passed; the protocol can be transformed into a non-interactive zero-knowledge proof protocol through the Fiat-Shamir transformation S25. Voters cast their ballots Post on a bulletin board; S26. Bulletin board verification of the first zero-knowledge proof The correctness of the subcommitment and the ciphertext are verified to be present in the previously verified legal ballot. If the verification fails, the ballot is rejected. ; S27. For ballots that have passed verification , each ticket server Encrypted information Decrypt it to get ; S28, Ticket Server verify Is it true? If not, then the relationship Generate the second zero-knowledge proof To prove the correctness of the decryption, Post on the bulletin board to report a voter Malicious behavior, including and It is a secure probabilistic public key encryption algorithm.

[0021] Specifically, step S3 includes the following steps: S31. For all ballots that have passed the legality verification , each ticket server Multiply the sub-votes and random numbers sent to him by the corresponding weights and add them up to get the partial counting results. and ; S32. All ticket servers send their partial counting results to a specific ticket server. After receiving all partial counting results, the ticket server adds up the sub-ballot counting results and the random number counting results to obtain the final counting result. and ; S33, the ticket server calculates the final election result based on the vote counting result and the result function , then the relationship Generate the third zero-knowledge proof To prove the correctness of the results.

[0022] Specifically, step S4 specifically includes: all participants can verify the third zero-knowledge proof based on the information on the bulletin board correctness.

[0023] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for weighted distributed and accountable electronic voting with hidden public vote counting, characterized in that: The specific steps include: S1, System initialization phase: The initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the numbers and weights of all legal voters on the bulletin board; the ticket server publishes its own public key on the bulletin board; S2, voting stage: The voter selects a legal ballot and splits it into several sub-ballots; the voter makes a cryptographic commitment with homomorphic properties for each sub-ballot; the voter encrypts the information for opening the sub-commitment with the public key of the corresponding ticket server, and the sub-commitment information includes the sub-ballot and the random number used to generate the sub-commitment. The voter performs the first zero-knowledge proof of the legitimacy of his or her ballot; the voter publishes the number, the first zero-knowledge proof of the legitimacy of the ballot, the commitment of the sub-ballot, and the ciphertext of the opening information on the bulletin board; The bulletin board verifies the legitimacy of the ballot through the first zero-knowledge proof and verifies that any of the sub-commitments and ciphertexts appear in the previously verified legal ballots. If the verification fails, the bulletin board refuses to accept the ballot. The ticket server decrypts all the encrypted sub-ballots and random numbers sent to it. The ticket server verifies the correctness of the sub-ballots and the corresponding random numbers in combination with the public commitment information. If the verification fails, a correctly decrypted second zero-knowledge proof is generated to report the voter's malicious behavior and discard the ballot. S3, counting phase: the ticket server weights all legal sub-ballots and corresponding random numbers and adds them up to obtain their respective partial counting results; All ticket servers send their partial counting results to a specific ticket server; The ticket server accumulates all partial votes to obtain the overall vote count result, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof to prove the correctness of the result; The ticket server posts the final election results and the third zero-knowledge proof on the bulletin board; S4, Public Verification Phase: All participants verify the correctness of the election results based on the information on the bulletin board.

2. According to claim 1, a method for weighted distributed and accountable electronic voting with hidden public vote counting is characterized in that: The step S1 specifically includes the following steps: S11. The electronic voting system has n voters , t ticket servers and s kinds of votes ; S12, initialize the server according to the security parameters Determine the set of common parameters of the system ,in is a prime number, It is The multiplicative cyclic group of Both The discrete logarithmic relationship between the generators of is unknown to all participants. is a function that calculates the election result based on the vote count. is the public reference string for the universal zero-knowledge proof; S13. Initialize the server to publish the numbers of all legal voters and weight ; S14. Ticket Server Randomly generate a public-private key pair And publish the public key .

3. According to claim 2, a method for weighted distributed and accountable electronic voting with hidden public vote counting is characterized in that: The step S2 specifically includes the following steps: S21, Voters Encode your vote to get , and Each sub-dimension of , so that ,in To encode the votes Algorithm for dimensional orthonormal basis vectors; S22, Pair Voting , voters use the cryptographic commitment algorithm Commit to commit to it and obtain commitment information , let the second random number ,in is the first random number; S23, for each ticket server , voters use the public key Encrypted Sub-Votes and the first random number Get encrypted information ;in is a secure probabilistic public key encryption algorithm, || is the concatenation of two strings; S24. Relationship , voters call protocol Generating the first zero-knowledge proof To prove the legitimacy of the ballot, is a universal zero-knowledge proof protocol; [s] is the set of all positive integers not greater than s; S25. Voters cast their ballots Post on a bulletin board; S26. Bulletin board verification of the first zero-knowledge proof The correctness of the subcommitment and the ciphertext are verified to be present in the previously verified legal ballot. If the verification fails, the ballot is rejected. ; S27. For ballots that have passed verification , each ticket server Encrypted information Decrypt to get ; S28, Ticket Server verify Is it true? If not, then the relationship Generate the second zero-knowledge proof To prove the correctness of the decryption, Post on the bulletin board to report a voter Malicious behavior, including and It is a secure probabilistic public key encryption algorithm.

4. According to claim 3, a method for weighted distributed and accountable electronic voting with hidden public vote counting is characterized in that: The step S3 specifically comprises the following steps: S31. For all ballots that have passed the legality verification , each ticket server Multiply the sub-votes and random numbers sent to him by the corresponding weights and add them up to get the partial counting results. and ; S32. All ticket servers send their partial counting results to a specific ticket server. After receiving all partial counting results, the ticket server adds up the sub-ballot counting results and the random number counting results to obtain the final counting result. and ; S33, the ticket server calculates the final election result based on the vote counting result and the result function , then the relationship Generate the third zero-knowledge proof To prove the correctness of the results.

5. According to claim 4, a method for weighted distributed and accountable electronic voting with hidden public vote counting is characterized in that: The step S4 specifically includes: all participants can verify the third zero-knowledge proof based on the information on the bulletin board correctness.

Images