A public tally hidden weighted distributed accountable electronic voting method

Abstract

The application discloses a kind of public vote tallying hidden with weight distribution type accountable electronic voting method, voter will own vote split into a certain number of shares after password commitment, then open commitment and the share of vote is encrypted and sent to corresponding distributed ticket server, ticket server verifies the correctness of vote share and the vote share of each voter is weighted and aggregated, after the end of voting stage, all ticket servers will send the aggregated value of the vote share collected to a certain specific ticket server, entrust it to obtain complete vote counting result and publish final voting result in verifiable way finally aggregated.The application ensures that malicious ticket server cannot obtain the vote information of individual voter and the vote counting result is not known by the participants other than selected ticket server, protects the privacy of voter and candidate, also ensures the verifiability of voting result, and can be accountable for the malicious behavior of participants.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic voting, and particularly relates to a public vote counting hidden weighted distributed accountable electronic voting method. BACKGROUND

[0002] Compared with traditional paper voting, electronic voting plays an increasingly important role in many consensus scenarios in the contemporary information society due to its high voting efficiency, low organization cost and strong scalability. In electronic voting, there is usually an authoritative election agency responsible for managing the entire voting process, each legal voter casts a vote representing his personal will to the election agency, and the election agency outputs the final election result according to certain rules after receiving all the votes of the legal voters. For example, in the process of electing a board of directors, all shareholders cast votes according to the number of shares they hold, and the board of directors calculates the members of the next board of directors according to the number of votes each director candidate gets.

[0003] However, in the actual deployment of the electronic voting system, only a single election agency is usually used to manage the entire voting process, which makes the system vulnerable to single point failure. Once the election agency has malicious behavior or is attacked by an enemy, the voter's vote information will be leaked, which will greatly damage the voter's privacy. In order to alleviate this problem, a group of independent ticket servers can be introduced, so that each ticket server is only responsible for collecting part of the vote information. However, if the vote is not processed additionally, it is still possible to directly leak part of the voter's vote information, which is still unacceptable in the electronic voting system. In order to better protect the voting privacy of the voters, two ways are usually used to process the votes: obfuscation shuffling and homomorphic aggregation. Obfuscation shuffling means that each ticket server randomly permutes all encrypted votes, disrupting the correspondence between each vote and the voter's identity. After multiple rounds of obfuscation shuffling, the output vote cannot be one-to-one corresponding to the voter's identity information, and then the decryption of the ciphertext vote is performed to obtain the vote counting result and output the voting result. Homomorphic aggregation means that the voter splits the vote into certain shares and sends them to different ticket servers. In this way, each ticket server can only get a share of the vote, and cannot restore the entire vote information. After receiving all the shares of the votes of the voters, the ticket servers aggregate all the shares of the votes together, and then all the ticket servers restore the complete vote counting result together, ensuring that the vote information of a single voter is not leaked. In the obfuscation shuffling method, although the enemy cannot know the one-to-one correspondence between the vote and the voter, the enemy can know the specific content of each vote, while in the homomorphic aggregation method, the enemy can at most know the complete vote counting result. Therefore, the homomorphic aggregation method can better protect the privacy of the voters.

[0004] In addition to the voting privacy of voters, the vote privacy of candidates is also a problem worth paying attention to. In reality, directly publishing the vote information of each candidate may face the following problems: publishing the vote information of the losing candidate may put him in an embarrassing situation, directly publishing the specific vote information of the previous round in the multi-round vote may affect the voting of the next round of voters, and publishing the specific vote information of the winning candidate may affect the authority of the candidate with lower ranking. In order to alleviate this problem, the vote hiding attribute is usually introduced, which allows the election agency to publish the final vote result in a verifiable manner without publishing the vote result and other information unrelated to the vote result. Vote hiding is divided into complete vote hiding, partial vote hiding and public vote hiding. Complete vote hiding means that all participants including the vote counting agency can only know the final vote result and not the intermediate vote information, which usually needs to introduce general verifiable multi-party secure calculation, which brings heavy calculation overhead; partial vote hiding means that some specific vote results are selected to be hidden to solve some specific security problems, while other results are published, which is usually only effective for a specific security problem and cannot resist other attacks not considered; Public vote hiding means that only a specific selected election agency knows the intermediate vote result, while other participants can only know the final vote result, which usually only needs to introduce relatively lightweight general zero-knowledge proof.

[0005] After introducing multiple ticket servers, the electronic voting system faces the problems of difficult verification of vote results and difficult accountability of malicious behavior, because it cannot be guaranteed that all ticket servers are honest and trustworthy. Result verification is a basic security attribute of electronic voting system. An electronic voting system with unverifiable results is not authoritative. Accountability is also an important security attribute of electronic voting system, which not only ensures the verifiability of electronic voting method, but also traces the malicious behavior of participants and discovers malicious participants in time. Usually, in order to ensure the verifiability and accountability of electronic voting system, cryptographic primitives such as cryptographic commitment, zero-knowledge proof and secure multi-party computation are often introduced to ensure the correctness of each step in the electronic voting system.

[0006] In addition, weighted voting is a promising attribute in electronic voting, especially in scenarios such as proof-of-stake blockchain consensus, hierarchical management and corporate elections, where the status and weight of each participant are not equal. However, in previous weighted voting methods, voters with multiple weights often need to cast multiple single-weight votes through virtualization, or need to generate a general zero-knowledge proof to prove that the votes they cast are consistent with the weights, which brings a lot of additional calculation overhead to the voters. SUMMARY

[0007] The present application aims at overcoming the deficiencies of the prior art, and provides a public vote counting hidden weighted distributed accountable electronic voting method.

[0008] The present application aims at overcoming the deficiencies of the prior art, and provides a public vote counting hidden weighted distributed accountable electronic voting method.

[0009] The present application discloses a public vote counting hidden weighted distributed accountable electronic voting method, and specifically comprises the following steps:

[0010] S1, system initialization stage: the initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the number and weight of all legal voters on the bulletin board; the ticket server publishes its public key on the bulletin board;

[0011] S2, voting stage: the voter selects a legal vote and splits it into several sub-votes; the voter makes a cryptographic commitment with homomorphic property for each sub-vote; the voter encrypts the information for opening the sub-commitment with the public key of the corresponding ticket server, wherein the information for opening the sub-commitment includes the sub-vote and the random number used for generating the sub-commitment, and the voter makes a first zero-knowledge proof for the legality of the vote; the voter publishes the number, the first zero-knowledge proof for the legality of the vote, the commitment of the sub-vote and the ciphertext of the opening information on the bulletin board; the bulletin board verifies the first zero-knowledge proof for the legality of the vote and verifies that any one of the sub-commitment and the ciphertext is in the legal vote that has passed the verification before, and if the verification fails, the bulletin board rejects the vote; the ticket server decrypts to obtain all the encrypted sub-votes and the corresponding random numbers sent to it; the ticket server verifies the correctness of the sub-vote and the corresponding random number in combination with the public commitment information, and if the verification fails, a second zero-knowledge proof for correct decryption is generated to report the malicious behavior of the voter and discard the vote;

[0012] S3, vote counting stage: the ticket server accumulates the weighted legal sub-votes and the corresponding random numbers to obtain the respective partial vote counting results; all the ticket servers send the respective partial vote counting results to a specific ticket server; the specific ticket server accumulates all the partial vote counting results to obtain the overall vote counting result, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof for proving the correctness of the result; the specific ticket server publishes the final election result and the third zero-knowledge proof on the bulletin board;

[0013] S4, public verification stage: all the participants verify the correctness of the election result according to the information on the bulletin board.

[0014] Further, the step S1 specifically comprises the following steps:

[0015] S11. Electronic voting system voters 、 Ticket Server and Seed vote ;

[0016] S12, initialize the server according to the security parameters Determine the common parameter set of the system ,in is a prime number, It is the The multiplicative cyclic group of Both The discrete logarithmic relationship between the generators of is unknown to all participants. is a function that calculates the election result based on the vote count. is the public reference string for the universal zero-knowledge proof;

[0017] S13. Initialize the server to announce the numbers of all legal voters and weights ;

[0018] S14. Ticket Server Randomly generate a public-private key pair And publish the public key .

[0019] Preferably, step S2 specifically includes the following steps:

[0020] S21, voters Encode your vote to get , and Each sub-dimension is split into , making ,in To encode the ballot Algorithm for dimensional orthonormal basis vectors;

[0021] S22, Pair Votes , voters commit to it through the cryptographic commitment algorithm Commit to obtain commitment information , let the second random number ,in is the first random number;

[0022] S23, for each ticket server , voters use public key Encrypted Sub-Votes and the first random number Get encrypted information ;in is a secure probabilistic public key encryption algorithm, and || is a string concatenation operation;

[0023] S24, verifying the relationship , the voter calls the protocol to generate the first zero-knowledge proof to prove the legitimacy of the vote, wherein is a general zero-knowledge proof protocol; [s] is a set of all positive integers not greater than s;

[0024] S25, the voter posts his vote on the bulletin board;

[0025] S26, the bulletin board verifies the correctness of the first zero-knowledge proof and verifies that any one of the sub-commitment and the ciphertext is present in the previously verified legitimate vote, if the verification fails, the vote is rejected ;

[0026] S27, for the verified vote , each ticket server decrypts the encrypted information to obtain ;

[0027] S28, the ticket server verifies whether it is true, if it is not true, it will report the malicious behavior of the voter generate the second zero-knowledge proof to prove the correctness of the decryption, and then publish on the bulletin board to report the malicious behavior of the voter , wherein and is a secure probabilistic public key encryption algorithm.

[0028] Preferably, the step S3 specifically comprises the following steps:

[0029] S31, for all votes that pass the legitimacy verification , each ticket server will multiply the sub-vote and the random number sent to it by the corresponding weight to obtain the partial voting result and ;

[0030] S32, all ticket servers will send their respective partial voting results to a specific ticket server, which will add up the sub-vote voting result and the random number voting result after receiving all the partial voting results and ;

[0031] S33, the ticket server calculates the final election result according to the vote counting result and the result function , and proves the correctness of the result to the relationship generates a third zero-knowledge proof to prove the correctness of the result.

[0032] Preferably, the step S4 specifically comprises: all participants can verify the correctness of the third zero-knowledge proof according to the information on the bulletin board.

[0033] The beneficial effects of the present application are:

[0034] 1) The present application introduces a set of distributed ticket servers, which greatly reduces the calculation overhead of the weighted voting of voters by outsourcing part of the calculation of voters to the ticket servers and proving the legality of the weight of the votes with the assistance of the ticket servers.

[0035] 2) The present application introduces accountability, which not only ensures the verifiability of the electronic voting method, but also traces the malicious behavior of the participants, and timely discovers the malicious participants. In order to ensure the verifiability and accountability of the electronic voting system, cryptographic primitives such as cryptographic commitment, zero-knowledge proof and secure multi-party computation are introduced to ensure the correctness of each step in the electronic voting system.

[0036] 3) The present application introduces the attribute of vote counting hiding, which allows the election agency to publish only the final voting result in a verifiable manner, without publishing the vote counting result and other information irrelevant to the voting result; public vote counting hiding means that only a specific election agency knows the intermediate vote counting result, and other participants can only know the final voting result, which only needs to introduce a relatively lightweight general zero-knowledge proof. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a step flow diagram of a public vote counting hiding weighted distributed accountable electronic voting method according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] The technical solutions of the present application will be described clearly and completely below in conjunction with embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0039] The application discloses a public vote hiding weighted distributed accountable electronic voting method, and aims at solving how to realize weighted electronic voting under the condition of guaranteeing the voting privacy of voters, the vote privacy of candidates, the verifiable voting result and the accountability of malicious behaviors, and aims at any voting rule. Figure 1

[0040] S1, the system initialization stage: the initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the number and weight of all legal voters on the bulletin board; the ticket server publishes its public key on the bulletin board;

[0041] S2, the voting stage: the voter selects a legal vote and splits it into several sub-votes; the voter performs a cryptographic commitment with homomorphic properties on each sub-vote; the voter encrypts the information of opening the sub-commitment with the public key of the corresponding ticket server, wherein the information of opening the sub-commitment includes the sub-vote and the random number used for generating the sub-commitment, and the voter performs the first zero-knowledge proof on the legality of the vote; the voter publishes the number, the first zero-knowledge proof of the legality of the vote, the commitment of the sub-vote and the ciphertext of the opening information on the bulletin board; the bulletin board verifies the first zero-knowledge proof of the legality of the vote and verifies that any one of the commitment and the ciphertext is in the legal vote that has passed the verification before, and if the verification fails, the bulletin board rejects the vote; the ticket server decrypts all the encrypted sub-votes and the corresponding random numbers sent to it; the ticket server verifies the correctness of the sub-vote and the corresponding random number in combination with the public commitment information, and if the verification fails, generates a second zero-knowledge proof of correct decryption to report the malicious behavior of the voter and discard the vote;

[0042] ​S3, the counting stage: the ticket servers add up all the legal sub-votes and corresponding random numbers after weighting, and obtain their respective partial counting results; all the ticket servers send their respective partial counting results to a specific ticket server; the specific ticket server adds up all the partial counting results to obtain the overall counting result, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof for proving the correctness of the result; the specific ticket server publishes the final election result and the third zero-knowledge proof on the bulletin board;

[0043] S4, the public verification stage: all the participants verify the correctness of the election result according to the information on the bulletin board.

[0044] Specifically, the step S1 specifically includes the following steps:

[0045] S11, the electronic voting system has voters , ticket servers and votes ;

[0046] S12, the initialization server determines the public parameter set of the system according to the security parameter , wherein is a prime number, is a multiplicative cyclic group with order , are generators of , and the discrete logarithm relationship between any two of them is unknown to all participants, is a function for calculating the election result according to the counting result, is a public reference string of the general zero-knowledge proof;

[0047] S13, the initialization server publishes the number and weight of all legal voters ;

[0048] S14, the ticket server randomly generates a public-private key pair and publishes the public key .

[0049] Specifically, the step S2 specifically includes the following steps:

[0050] S21, the voter encodes his own vote with to obtain , and splits each sub-dimension of into , so that ​​wherein to encode the votes into algorithm of the standard orthogonal basis vector; in particular wherein ;

[0051] S22, on the sub-vote , the voter commits it by the password commitment algorithm Commit to get the commitment information , let the second random number wherein is the first random number; the password commitment algorithm is: wherein r is a random number uniformly randomly selected from the finite field ;

[0052] S23, on each ticket server , the voter encrypts the sub-vote and the first random number to get the encrypted information ; wherein is a secure probabilistic public key encryption algorithm, and || is the concatenation of two strings;

[0053] S24, on the relationship , the voter calls protocol to generate the first zero-knowledge proof to prove the legality of the vote, wherein is a general zero-knowledge proof protocol;

[0054] The following is a general zero-knowledge proof protocol for explanation: is the relationship that needs to be proved, wherein x is the public statement, w is the private input, and r is the condition that the relationship needs to meet, so that the prover proves to the verifier that he knows that satisfies the relationship r, and in the whole process, no information about w is leaked;

[0055] The following explains : the relationship that needs to be proved is wherein is the set of all positive integers not greater than n, and the interactive protocol steps are: the prover selects a random number from the finite field and calculates and then ​Sent to the verification party; the verification party Randomly select x from the equation and send it to the prover; the prover calculates and Sent to the verifier; if the equation and If both are established, the verification is passed; the protocol can be transformed into a non-interactive zero-knowledge proof protocol through the Fiat-Shamir transformation

[0056] S25. Voters cast their ballots Post on a bulletin board;

[0057] S26. Bulletin Board Verification of the First Zero-Knowledge Proof The correctness of the subcommitment and the ciphertext are verified to be present in the previously verified legal ballot. If the verification fails, the ballot is rejected. ;

[0058] S27. For ballots that have passed verification , each ticket server Encrypted information Decrypt and get ;

[0059] S28, Ticket Server verify Is it established? If not, then the relationship Generate the second zero-knowledge proof To prove the correctness of the decryption, Post on the bulletin board to report a voter Malicious behavior, including and It is a secure probabilistic public key encryption algorithm.

[0060] Specifically, step S3 includes the following steps:

[0061] S31. For all ballots that have passed the legality verification , each ticket server Multiply the sub-votes and random numbers sent to him by the corresponding weights and add them up to get the partial vote count results. and ;

[0062] S32. All ticket servers send their partial vote counting results to a specific ticket server. After receiving all partial vote counting results, the ticket server adds up the sub-ballot counting results and the random number counting results to obtain the final vote counting result. and ;

[0063] S33、 the ticket server calculates the final election result according to the vote counting result and the result function , and proves the correctness of the result. generates a third zero-knowledge proof to prove the correctness of the result.

[0064] Specifically, the step S4 specifically comprises: all the participants can verify the correctness of the third zero-knowledge proof according to the information on the bulletin board.

[0065] The above only describes the preferred embodiments of the present application, and it should be understood that the present application is not limited to the forms disclosed herein, and should not be considered as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concepts described herein by the above teachings or related art or knowledge. Any modification and change made by those skilled in the art without departing from the spirit and scope of the present application shall be within the protection scope of the claims of the present application.

Claims

1. A method for distributed and accountable electronic voting with public vote counting concealed, characterized in that: The specific steps include: S1, System Initialization Phase: The initialization server publishes the system public parameters on the bulletin board; the initialization server publishes the numbers and weights of all legal voters on the bulletin board; the ticket server publishes its own public key on the bulletin board; S2, Voting Stage: The voter selects a valid ballot and splits it into several sub-ballots. The voter makes a homomorphic cryptographic commitment to each sub-ballot. The voter encrypts the information that opens the sub-commitment using the public key of the corresponding ticket server. The sub-commitment information includes the sub-ballot and the random number used to generate the sub-commitment. The voter performs a first zero-knowledge proof of the legitimacy of their ballot. The voter posts the ballot number, the first zero-knowledge proof of the legitimacy, the sub-ballot commitment, and the ciphertext of the opening information on the bulletin board. The bulletin board verifies the legitimacy of the ballot using a first zero-knowledge proof and verifies that any of the sub-commitments and ciphertext appear in a previously verified legal ballot. If verification fails, the bulletin board rejects the ballot. The ticket server decrypts all encrypted sub-ballots and random numbers sent to it. The ticket server verifies the correctness of the sub-ballots and corresponding random numbers based on the public commitment information. If verification fails, a second correctly decrypted zero-knowledge proof is generated to report malicious behavior by the voter and discard the ballot. S3, vote counting phase: The ticket server weights all legal sub-ballots and their corresponding random numbers and adds them up to obtain their respective partial vote counting results; All ticket servers send their partial counting results to a specific ticket server; The ticket server accumulates all partial votes to obtain the overall vote count, calculates the voting result according to the specified result calculation function, and generates a third zero-knowledge proof proving the correctness of the result; The ticket server publishes the final election results and the third zero-knowledge proof on the bulletin board; S4. Public verification stage: All participants verify the correctness of the election results based on the information on the bulletin board.

2. The method of electronic voting with rights and distributed accountability with hidden public vote counting according to claim 1 is characterized in that: The step S1 specifically includes the following steps: S11. The electronic voting system has n voters. , t ticket servers and s types of ballots ; S12, initialize the server according to the security parameters Determine the common parameter set of the system ,in is a prime number, It is the The multiplicative cyclic group of Both The discrete logarithmic relationship between the generators of is unknown to all participants. is a function that calculates the election result based on the vote count. is the public reference string for the universal zero-knowledge proof; S13. Initialize the server to announce the numbers of all legal voters and weights ; S14. Ticket Server Randomly generate a public-private key pair And publish the public key .

3. The method of electronic voting with rights and distributed accountability with hidden public vote counting according to claim 2 is characterized in that: The step S2 specifically includes the following steps: S21, voters Encode your vote to get , and Each sub-dimension is split into , making ,in To encode the ballot Algorithm for dimensional orthonormal basis vectors; S22, Pair Voting , voters commit to it through the cryptographic commitment algorithm Commit to obtain commitment information , let the second random number ,in is the first random number; S23, for each ticket server , voters use public key Encrypted sub-votes and the first random number Get encrypted information ;in is a secure probabilistic public key encryption algorithm, || is the concatenation of two strings; S24. Relationship , voters call protocol Generate the first zero-knowledge proof To prove the legitimacy of the ballot, It is a universal zero-knowledge proof protocol; [s] is the set of all positive integers not greater than s; S25. Voters cast their ballots Post on a bulletin board; S26. Bulletin Board Verification of the First Zero-Knowledge Proof The correctness of the subcommitment and the ciphertext are verified to be present in the previously verified legal ballot. If the verification fails, the ballot is rejected. ; S27. For ballots that have passed verification , each ticket server Encrypted information Decrypt and get ; S28, Ticket Server verify Is it established? If not, then the relationship Generate the second zero-knowledge proof To prove the correctness of the decryption, Post on the bulletin board to report a voter Malicious behavior, including and It is a secure probabilistic public key encryption algorithm.

4. The method of claim 3 for a weighted, distributed, and accountable electronic voting method with hidden public vote counting, characterized in that: The step S3 specifically includes the following steps: S31. For all ballots that have passed the legality verification , each ticket server Multiply the sub-votes and random numbers sent to him by the corresponding weights and add them up to get the partial vote count results. and ; S32. All ticket servers send their partial vote counting results to a specific ticket server. After receiving all partial vote counting results, the ticket server adds up the sub-ballot counting results and the random number counting results to obtain the final counting result. and ; S33. The ticket server calculates the final election result based on the vote counting results and the result function. , then the relationship Generate the third zero-knowledge proof To prove the correctness of the results.

5. The method of electronic voting with rights and distributed accountability with hidden public vote counting according to claim 4 is characterized in that: The step S4 specifically includes: all participants can verify the third zero-knowledge proof based on the information on the bulletin board correctness.

Images