Electronic voting method based on privacy protection deniability

Abstract

The invention provides a deniable electronic voting method based on privacy protection, which comprises the following steps that: firstly, a counting server CS and a voting user User share a random number, and then the voting user User selects two true and false plaintexts and encrypts the true and false plaintexts into a ciphertext. And after receiving the ciphertext, the counting server CS decrypts the true / false plaintext according to different true / false keys with different requirements, and meanwhile, the counting server CS can verify whether the voting information of the user is true or not. According to the method, the user can be protected to carry out honest voting when facing stress.

Description

Technical Field

[0001] The present invention belongs to the technical field of electronic voting, and in particular relates to an electronic voting method based on privacy protection deniability. Background Art

[0002] Data encryption is a key means to ensure data confidentiality. Traditional encryption methods provide semantic security. Even if a malicious adversary obtains ciphertext in an open channel, the adversary cannot obtain the plaintext information underlying the ciphertext. However, in some special cases, such as the presence of a more powerful adversary (called a coercer), they have the ability to contact the sender and receiver and force them to hand over all private information: plaintext, random numbers and private keys used for encryption, and other related metadata. In the traditional cryptographic architecture, if the ciphertext, plaintext, and metadata such as random values ​​(or private keys) are known by the coercer at the same time, the coercer can run encryption, decryption and other algorithms to verify whether the person is lying. In order to ensure the confidentiality of data in the above scenario, Canetti et al. proposed a deniable encryption scheme in 1997, which allows the sender and (or) the receiver to derive multiple meaningful plaintexts from the generated ciphertext and these plaintexts have the characteristic of being indistinguishable from each other. Therefore, even if there is a coercive adversary who forces the communicating parties to expose all their metadata, the coercive adversary cannot obtain the real plaintext message (the coercer obtains a false message), so the confidentiality of the communication data can be effectively protected.

[0003] The one-time pad scheme based on the pre-negotiated shared key has the property of deniability: the sender uses the pre-negotiated real key k to encrypt the real data m to obtain the ciphertext When the sender or receiver faces coercion from the coercer, they use the pre-agreed false key to decrypt the ciphertext c and obtain the false plaintext Unfortunately, it is difficult to achieve pre-negotiation of common keys among all users in a cross-user scenario. If the plaintext claimed by the sender is different from the plaintext claimed by the receiver, then the coercer will believe that the plaintext information he obtained is false. This kind of situation can be described as follows: (1) The parties have no chance to negotiate the false message in advance. (2) One party betrays the other after being bribed. Existing deniable encryption schemes still cannot effectively solve the difficulty of "difficult to achieve consistent denial".

[0004] Technical solution of prior art 1

[0005] Canett i et al. proposed a pre-designed shared key deniable encryption idea: the encrypted message m t Given n (n>0) alternative messages to be encrypted Use n+1 different keys k i Encrypt them separately, and construct a ciphertext that is the concatenation of all encrypted messages. When coerced, use the i-th key to open the i-th message and claim that the message is the real message, such as Figure 1 shown.

[0006] Disadvantages of the prior art 1

[0007] 1. Since multiple ciphertexts are used to form a new ciphertext, the size of the ciphertext increases linearly with the number of messages to be encrypted. 2. When the number of false messages is large enough, the probability that both parties open the i-th ciphertext at the same time is It is difficult to achieve deniability of both sides’ positions.

[0008] Application number 202410918600.X, invention name: Anti-coercion electronic voting method based on publicly verifiable secret sharing, consisting of system initialization, voting, generating shares, re-voting, filtering false shares, verifying ballots and counting steps. The invention adopts effective anti-coercion voting. When voters are coerced, they can re-vote without the coercer noticing, solving the security problem of coerced voting. By adopting publicly verifiable secret sharing, the trust of three parties is dispersed to multiple participants, reducing the reliance on a single trusted entity during the re-voting process, solving the problem of excessive trust requirements for third parties, and realizing efficient verification and counting. Voters can calculate the final count and verify the accuracy of the counting results. By adopting publicly verifiable secret sharing, the continuity of voting is achieved.

[0009] Although the application scenario of the anti-coercion electronic voting method based on publicly verifiable secret sharing is based on electronic voting anti-coercion, it adopts the technical route of publicly verified secret sharing, includes the ballot information in the polynomial f(x), and uses the function to generate shares and voting indexes for each share leader. When the coercer coerces, f(x)' containing false ballots is reconstructed and false shares and index updates are generated for the share leader, and the voting information is sent to the share leader again. The share leader then filters the false shares by the voting index to obtain the real share list, and then calculates the sum of the shares to obtain the total share. After verifying the ballot, the total share leader aggregates the secret sharing vector group, and then uses the Lagrange interpolation method to reconstruct the counting results. In fact, it does not consider the situation where the coerced object can contact the sender and the receiver at the same time. Summary of the invention

[0010] The purpose of the present invention is to solve the defects of the above-mentioned prior art and provide an electronic voting method based on privacy protection and deniability. When facing the coercion of malicious adversaries, the voting users and the counting server can achieve consistent deniability, which is used to solve the deniability of both parties. The deniability algorithm adopted by the voting system enables the voting users and the counting server to deny the coercer, and realizes the function that the voting users cannot deceive the counting server. It realizes verifiable deniability, and realizes the function that the voting users cannot deceive the counting server. It realizes the denial of multiple files by legitimate users at one time, saving communication and computing overhead.

[0011] Deniable encryption technology is often used in scenarios such as electronic auctions, cloud storage, and secure multi-party computing. The present invention is a privacy-protection deniable electronic voting method, and its actual scenario problem is described as follows: Now the voting user and the counting server are both coerced by the Coercer to hand over the voting user's voting information. How to make the voting user vote honestly under coercion, and the counting server coerce but not disclose the voting user's real voting information. Through the deniable encryption technology, an electronic voting system is designed, which can not only protect the confidentiality of the voting user, but also realize the denial of the real voting information when facing the coercer. In addition, in order to save communication and computing overhead, batch deniability for voting users is also designed. This deniable electronic voting system uses a pre-designed deniable encryption algorithm to provide an effective solution for protecting the security and privacy of voting users in complex environments, especially in the face of coercion, showing its unique advantages and practicality.

[0012] The present invention adopts the following technical solution:

[0013] A privacy-preserving deniability-based electronic voting method comprising:

[0014] Step 1. The counting server CS generates a sharing function and shares the random number with the voting user User;

[0015] The counting server CS constructs a public polynomial function f(x) and assigns a random number x to each voting user User. The specific algorithm is as follows: Select a finite field F p , where p is a large prime number, and n+1 coefficients are randomly generated on a finite field: a0, a1, …, a n , so that the polynomial f(x) = a n x n +a n-1 x n-1 +…+a1x+a0, where a0,a1,…,a n All∈F p , the counting server CS assigns a random number x to each voting user, x∈Fp , and transmit it secretly to the voting users;

[0016] Step 2. Generate and send the ciphertext of the voting user User;

[0017] The voting user User generates the user's public key and private key pair through a function generation algorithm, and after receiving the random number x, uses the random number x to encrypt the voting message and transmits it to the counting server CS. The specific steps are as follows:

[0018] S201. Generate the user's public and private key pair, KeyGen(λ): Input the system parameter λ, the key generation algorithm selects a random number α, α∈F p , and then generate a public and private key pair pk and sk, where:

[0019] pk,sk)=(sk=α,pk=g α

[0020] Enc(m t , r t , m f , r f ): Enc is the public key encryption algorithm, m t and m f is the input plaintext, where m t is the real plaintext, m f is a false plaintext, r t and r f is a random number, where r t ∈F p ,r f ∈F p , r t is the real key, r f is a fake key,

[0021] S202. Encrypt voting message, the steps are as follows:

[0022] (1) Select a false plaintext m f So that the real plaintext m t and the false plaintext m f have the same length, namely m t |=|m f |, and assuming that the plaintext m f It is a meaningful message;

[0023] (2) After receiving the random number x, the voting user User makes the polynomial f(x) = r t , so that the ciphertext And choose a random number r f , so that the ciphertext And use the public key PK of the counting server CS CSEncrypted ciphertext M and fake key r f , so that the public key ciphertext

[0024] (3) The voting user uses his private key α to calculate the second ciphertext where g α =pk;

[0025] (4) The user sends the voting message C = (C1, C2) to the counting server CS;

[0026] Step 3. Decryption and verification of the vote counting server CS;

[0027] After receiving the voting message C, the counting server CS decrypts and verifies the voting message C and checks whether the user has deceived himself. Dec(C, r): Dec is a public key decryption algorithm, inputting the voting message C and the decryption key r t , decrypted to get the true plaintext m t , the decryption process is as follows:

[0028] S301. The counting server CS uses its own private key to decrypt Get the ciphertext M and fake key r f , according to the random number x assigned, we get the polynomial f(x)=r t , calculate the true plaintext

[0029] S302. If the vote counting server CS needs a fake plaintext to deceive the coercer, calculate the fake plaintext Get the false plaintext m pre-selected by the voting user f ;

[0030] The vote counting server CS decrypts the real plaintext m t Later, calculate the private key ciphertext If the equation holds, the verification is passed and the votes are counted. The verification formula is: g x·α =C2; otherwise, the verification fails and no votes are counted, and the decryption key is not f(x).

[0031] S303. Since the counting server CS knows that the algorithm used by the voting user User is a deniable algorithm, that is, the counting server CS needs to verify whether the voting user User has cheated itself, the verification of the voting user by the counting server CS includes:

[0032] When the voting user User is coerced, because the voting user User uses the public key encryption of the counting server CS, the voting user User cannot decrypt it. When faced with coercion, he hands over the encrypted content ciphertext M and the fake key r f , while the voting user User calculates an x f Sent to the coercer, the calculation process of the voting user User is as follows: The voting user uses the verification ciphertext Generate equal verification ciphertext The following conditions must be met:

[0033]

[0034] Make

[0035] m t +x·α=m f +x f α

[0036]

[0037] The coercer uses a fake key r f Decrypt the ciphertext M to get the false plaintext m f , and can verify the private key ciphertext are equal.

[0038] When the counting server CS is coerced, the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer. cs , then the coercer uses SK CS Decrypt the public key ciphertext C1 to obtain the ciphertext M and the fake key r f Finally, the coercer uses Calculate the false plaintext m f .

[0039] When both the voting user and the counting server are coerced and need to deny, the voting user hands over the encrypted ciphertext M and the fake key r f and calculate the pseudo-random number x f Send it to the coercer (this step is the same as when the voting user User is coerced); the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer cs (This step is the same as when the vote counting server CS is coerced).

[0040] Furthermore, the voting user User denies a batch of multiple ciphertexts at one time. The specific algorithm steps are as follows: Given n voting messages in i=1,2,…,n,i indicates the ciphertext number), the voting user User who has the private key selects a random plaintext m n+1, calculate an X by aggregation, so that ( For aggregation The n+1th new ciphertext generated), Represents a new ciphertext;

[0041] The steps for calculating X are as follows:

[0042]

[0043] Calculated:

[0044]

[0045] Voting users aggregate X and select fake plaintext information m n+1 and M i , Give it to the coercer. The coercer can calculate the ballot information after obtaining it. Get fake ballots and then count them are equal, the verification is correct.

[0046] When the voting user User and the counting server CS are coerced and need to deny multiple votes, the voting user User will send X, the false ballot information m n+1 and M i , Hand it over to the coercer (this step and the voting user User deny a batch of multiple ciphertexts at one time); the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer cs (This step is the same as when the vote counting server CS is coerced).

[0047] Since X, m n+1 , M i , Contains all the denial information, so the voting user can use X, m n+1 , M i , Achieve deniability of all voting information at one time.

[0048] Beneficial effects of the present invention:

[0049] (1) The present invention supports the identity authentication of voting users by the counting server CS, thereby preventing malicious users from maliciously tampering with voting information.

[0050] (2) Protect the confidentiality of user data and resist malicious coercion by malicious coercers.

[0051] (3) The use of batch deniability technology solves the problem of deniable communication and waste of computing resources in the one-to-one mode.

[0052] (4) Achieved deniability of consistent positions between CS and User. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 Encrypt model diagram for background technology;

[0054] Figure 2 This is a model diagram of the method of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention is described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] The present invention proposes an electronic voting method based on privacy protection deniability. The method uses deniable encryption to achieve privacy protection of voting information of voting users. The contributions of the method are as follows:

[0057] (1) Protect user privacy: When a voting user is coerced by a malicious adversary, he or she can reasonably deny his or her voting information. When the counting server is coerced, it can also reasonably deny and protect the privacy of the voting user.

[0058] (2) The vote counting server is verifiable: Since the present invention adopts deniable encryption calculation, the vote counting server is introduced to verify the voting users, which reasonably avoids the voting users from deceiving the vote counting server.

[0059] (3) Batch deniability: Voting users can deniable multiple files at once, saving communication and computing overhead.

[0060] Definitions of Abbreviations and Key Terms

[0061]

[0062]

[0063] Voting user (User): A user who participates in voting, uses r sent by CS to construct ciphertext (c1, c2) so that c2 can be decrypted into different messages, and sends the ciphertext carrying voting information to CS. When coerced by the coercer, the user will provide the false message to the Coercer.

[0064] Cloud Counting Server: As a cloud counting server, it provides the User with a shared random number x, receives and decrypts the User's voting ciphertext information, verifies whether the User's plaintext message is false, and provides the false plaintext message to the Coercer when faced with coercer coercion.

[0065] Coercer: As a coercer of the voting system, coercing User and / or CS to hand over the decrypted key and related plaintext information, and verify through related messages.

[0066] like Figure 2 As shown, an electronic voting method based on privacy protection deniability of the present invention comprises:

[0067] When a user denies a ciphertext at a time:

[0068] Protect voting users User from coercion and allow them to vote honestly. First, the counting server CS shares a random number with the voting user User, and then the voting user User selects two true and false plaintexts and encrypts the true and false plaintexts into a ciphertext. After receiving the ciphertext, the counting server CS decrypts the true / false plaintext according to the different true / false keys required. At the same time, the counting server CS can verify whether the voting information of the voting user User is true.

[0069] Among them, it is mainly divided into three stages. The first stage is mainly for the counting server CS to generate a shared function and share a random number with the voting user User; the second stage is the generation and sending of the ciphertext of the voting user User; the third stage is mainly the decryption and verification of the counting server CS.

[0070] Phase 1: The counting server CS constructs a public polynomial function f(x) and assigns a random number x to each voting user. The specific algorithm is constructed as follows:

[0071] Choose a finite field F p (where p is a large prime number), randomly generate n+1 coefficients a0, a1, …, a in a finite field n , construct a polynomial such that f(x) = a n x n +a n-1 x n-1 +…+a1x+a0(a0,a1,…,a n ∈F p ). CS assigns a random number x to each voting user, x∈F p , and transmit the random number x secretly to the voting user.

[0072] Phase 2: The user generates a public key and private key pair through a function generation algorithm, and after receiving the random number x, uses the random number x to encrypt the voting message and transmits it to CS. The specific steps are as follows:

[0073] 1. Generate the user's public key and private key pair, KeyGen(λ): Input system parameter λ, the key generation algorithm selects a random number α, α∈F p , and then generate a public-private key pair (pk, sk), where:

[0074] (pk,sk)=(sk=α,pk=gα)

[0075] 2.Enc(m t , r t , m f , r f ): Enc is the public key encryption algorithm, m t and m f is the input plaintext, where m t is the real plaintext, m f is a false plaintext, r t and r f is a random number, where r t ∈F p ,r f ∈F p , r t is the real key, r f It is a fake key, as follows:

[0076] (1) Select a fake plaintext m f So that the real plaintext m t and the false plaintext m f have the same length (i.e., |m t |=|m f |) and assuming that the plaintext m f It is meaningful news.

[0077] (2) After receiving the random number x, the user uses the public polynomial to calculate f(x) = r t , calculate the ciphertext And choose a random number r f So that the ciphertext And use the public key PK of the counting server CS CS Encrypted ciphertext M and fake key r f . Make: public key ciphertext It uses the public key PK of the counting server CS CS Encrypted ciphertext M and fake key r f .

[0078] (3) The user uses his private key α to calculate the ciphertext Among them (g α =pk). C2 is the ciphertext encrypted with the user's private key and is used for verification and batch denial.

[0079] (4) The user sends the voting message C = (C1, C2) to the counting server CS.

[0080] The third stage: After receiving the voting message C, the counting server CS decrypts and verifies the voting message C and checks whether the user has deceived itself.

[0081] Dec(C,r): Dec is a public key decryption algorithm, inputting the voting message C and the decryption key r t , decrypted to get the true plaintext m t , the specific process is as follows:

[0082] 1. The counting server CS uses its own private key SK CS Decryption Get M and r f , according to the random number x assigned, we get the polynomial f(x)=r t , calculate the true plaintext

[0083] 2. If the counting server CS needs a fake plaintext to deceive the coercer, calculate the fake plaintext Get the false plaintext m pre-selected by the voting user f .

[0084] Then, since the counting server CS knows that the algorithm used by the voting user is a deniable algorithm, that is, the counting server CS needs to verify whether the voter has cheated himself, the following is the verification of the voting user by the counting server CS:

[0085] The vote counting server CS decrypts the real plaintext m t Later, calculate the ciphertext If the equation holds, the verification is successful; otherwise, the verification fails and the decryption key is not f(x)=r t . (The verification formula is

[0086] The above three stages are the deniable encryption / decryption process of the "voting information" by the voting user and the counting server.

[0087] Here, a verification process is given on how to ensure the confidentiality of "voting information" when legitimate voting users (Users) and vote counter servers (CS) are coerced by malicious coercers (Coercer).

[0088] 1. Voting users are coerced: When a user is coerced, because the user uses the public key encryption of the counting server CS, the voting user cannot decrypt it. When faced with coercion, the encrypted content ciphertext M and the fake key r are handed over. f , and the voting user calculates an x f Sent to the coercer. The calculation process for voting users is as follows:

[0089] Voting users use verification ciphertext Calculate and verify ciphertext The following conditions must be met:

[0090]

[0091] Make

[0092] m t +x·α=m f +x f α

[0093]

[0094] The coercer uses a fake key r f Decrypt the ciphertext M to get the true plaintext m t , and verify the private key ciphertext Are they equal?

[0095] 2. When the vote counting server CS is coerced:

[0096] When the counting server CS is coerced, the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer. cs . Then the coercer uses SK CS Decrypt the public key ciphertext C1 to obtain the ciphertext M and the fake key r f Finally, the coercer uses Calculate the false plaintext m f .

[0097] The above two types of denial situations are one-to-one denial. Such single denial often requires more computing cost and communication overhead. In actual voting scenarios, the voting user User is often required to perform denial on multiple files. Therefore, the present invention also supports batch denial of multiple ciphertexts by the voting user User at one time. We have designed a batch denial technology, and the specific algorithm steps are as follows:

[0098] Given n voting messages in The voting user who has the private key (since the private key is the private key of the voting user, here our batch deniability only considers the voting user) selects a random plaintext mn+1 , calculate an X by aggregation, so that

[0099] The steps for calculating X are as follows:

[0100]

[0101] The calculation can be obtained:

[0102]

[0103] Since X, m n+1 , M i , r i f Contains all the denial information, so the voting user can use X, m n+1 , M i , Achieve deniability of all voting information at one time.

[0104] Example

[0105] The electronic voting method based on privacy protection deniability of this embodiment consists of the following steps.

[0106] (1) Random number distribution

[0107] The counting server CS constructs a public polynomial function f(x). The specific algorithm is as follows: Select a finite field F p (where p = 101 is a prime number) Randomly generate three coefficients a0 = 7, a1 = 5, a2 = 3 on the field, and construct a polynomial such that f(x) = 3x 2 +5x+7.

[0108] CS assigns a random number x = 12 ∈ F to each voting user p , and transmitted secretly to the voting users.

[0109] (2) Voting

[0110] Voting user User generates the user's public key and private key pair, KeyGen(λ): Input system parameter λ, the key generation algorithm selects a random number α=17, α∈F p , then generate a public-private key pair (pk, sk) = (sk = α, pk = g α ), where pk = g α =2 17 (Assume generator g = 2):

[0111] (pk,sk0=(sk=17,pk=2 17 )

[0112] Enc(m t , r t , m f , r f ): Enc is the public key encryption algorithm, m t and m f is the input vote, where m t It's a real vote, m f For fake ballots, t and r f is a random number where r t ∈F p ,r f ∈F p , r t is the real key, r f It is a fake key, as follows:

[0113] 1) Select a fake ballot m f =38, real votes m t =21 and fake ballot m f 2) After receiving the random number 12, the voting user uses the public polynomial to calculate f(12) = r t =3×

[0114] 12 2 +5×12+7=499mod 101=95, calculate the ciphertext

[0115] And calculate r f =108 so that the ciphertext

[0116] And use the public key PK of the counting server CS CS Encrypted ciphertext M and fake key r f Make public key ciphertext

[0117] 3) The voting user uses his private key α to calculate the second ciphertext

[0118] Among them (g α =pk).

[0119] 4) The user sends the voting message C = (C1, C2) to the counting server CS

[0120] (3) Counting votes

[0121] After receiving the voting message C, the counting server CS decrypts and verifies the voting message C. After the verification is passed, the counting is performed as follows:

[0122] ① The counting server CS uses its own private key SK CS Decryption We get 74 and 108. Based on the random number x=12, we get the polynomial f(12)=95, and we get the true votes.

[0123] 2 To ensure the authenticity of the ballot, the counting server needs to verify the ballot. The counting server calculates the ciphertext (Verify the equation: ), if the equation holds true, the verification is passed and the vote counting is performed; otherwise, if it does not hold true, the vote counting server does not perform the vote counting.

[0124] The above process is the voting and counting process

[0125] Now consider what happens when you are faced with a coercer.

[0126] Category 1: When a voter is coerced

[0127] When the user is coerced, he surrenders the encrypted ciphertext M and the fake key r f , and the voting user calculates an x f =11 is sent to the coercer. The calculation process of the voting user is as follows:

[0128] Voting users use ciphertext Calculate ciphertext The following conditions must be met:

[0129]

[0130] Make

[0131] m t +x·α=m f +x f α

[0132] Bring in

[0133] The coercer uses a fake key r f Decrypt ciphertext M to get vote m f , and verify the private key ciphertext Are they equal?

[0134] The above is a case where a voting user denies a ballot at one time. The following is a case where multiple ballots need to be denied.

[0135] Given 3 vote messages The corresponding m t 、m f ,x,r t 、rf The voting users User who have private keys are (31, 28, 6, 44, 47), (53, 52, 7, 88, 89), (8, 4, 5, 6, 10), and choose a new fake ballot m 4 =7, calculate an X by aggregation, so that The steps for calculating X are as follows:

[0136]

[0137] Calculated:

[0138]

[0139] Voting users will aggregate X and select fake ballot information m n+1 and M i , Give it to the coercer. The coercer can calculate the ballot information after obtaining it. Get fake ballots and then count them Verify that the results are equal.

[0140] Category 2: When the vote counting server is coerced

[0141] When the counting server is coerced, the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer. cs , then the coercer uses SK CS Decrypting the public key ciphertext C1 yields the ciphertext 74 and the fake key 108. The coercer can use 38 fake votes were counted.

[0142] Category 3: When both the voting user and the counting server are coerced

[0143] When a voting user and a counting server are coerced and need to deny a vote, the voting user hands over the encrypted ciphertext M and the fake key r. f and calculate the pseudo-random number x f Send it to the coercer (this step is the same as the first type of denying only one vote); the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer cs (This step is the same as the second category).

[0144] When the voting user and the counting server are coerced to deny multiple votes, the voting user will send X, the false ballot information m 4 and M i , Hand it over to the coercer (this step is the same as the first type of denying multiple votes); the counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer cs (This step is the same as the second category).

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An electronic voting method based on privacy protection deniability, characterized in that: include: Step 1. The counting server CS generates a sharing function and shares the random number with the voting user User; The counting server CS constructs a public polynomial function f(x) and assigns a random number x to each voting user User. The specific algorithm is as follows: Select a finite field F p , where p is a large prime number, and n+1 coefficients are randomly generated on a finite field: a0, a1, …, a n , so that the polynomial f(x) = a n x n +a n-1 x n-1 +…+a1x+a0, where a0,a1,…,a n All∈F p , the counting server CS assigns a random number x to each voting user User, x∈F p , and secretly transmit it to the voting user User; Step 2. Generate and send the ciphertext of the voting user User; The voting user User generates the user's public key and private key pair through a function generation algorithm, and after receiving the random number x, uses the random number x to encrypt the voting message and transmits it to the counting server CS. The specific steps are as follows: S201. Generate the user's public and private key pair, KeyGen(λ): Input the system parameter λ, the key generation algorithm selects a random number α, α∈F p , and then generate a public and private key pair pk and sk, where: (pk,sk)=(sk=α,pk=g α ) Enc(m t , r t , m f , r f ): Enc is the public key encryption algorithm, m t and m f is the input plaintext, where m t is the real plaintext, m f is a false plaintext, r t and r f is a random number, where r t ∈F p ,r f ∈F p , r t is the real key, r f is a fake key; S202. Encrypt voting message, the steps are as follows: (1) Select a fake plaintext m f So that the real plaintext m t and the false plaintext m f have the same length, namely m t |=|m f |, and assuming that the plaintext m f It is a meaningful message; (2) After receiving the random number x, the voting user User makes the polynomial f(x) = r t , so that the ciphertext M = m t ⊕r t , and choose a random number r f , so that the ciphertext M = m t ⊕r t =m f ⊕r f , and use the public key PK of the counting server CS CS Encrypted ciphertext M and fake key r f , so that the public key ciphertext (3) The voting user User uses his private key α to calculate the second ciphertext where g α =pk; (4) The voting user User sends the voting message C = (C1, C2) to the counting server CS; Step 3. Decryption and verification of the vote counting server CS; After receiving the voting message C, the counting server CS decrypts and verifies the voting message C and checks whether the user has deceived himself. Dec(C, r): Dec is a public key decryption algorithm, inputting the voting message C and the decryption key r t , decrypted to get the true plaintext m t , the decryption process is as follows: S301. The counting server CS uses its own private key SK CS Decryption Get the ciphertext M and fake key r f , according to the random number x assigned, we get the polynomial f(x)=r t , calculate the true plaintext m t =M⊕r t ; S302. If the vote counting server CS needs a fake plaintext to deceive the coercer, calculate the fake plaintext m f =M⊕r f , get the false plaintext m pre-selected by the voting user User f ; The vote counting server CS decrypts the real plaintext m t Later, calculate the private key ciphertext If the equation holds true, the verification is passed and the votes are counted. The verification formula is: Otherwise, the verification fails and the votes are not counted, and the decryption key is not f(x); S303. Since the vote counting server CS knows that the algorithm adopted by the voting user User is a deniable algorithm, that is, the vote counting server CS needs to verify whether the voting user User has deceived itself, the vote counting server CS verifies the voting user User.

2. The method according to claim 1, characterized in that When the voting user User is coerced, S303 also includes: when the voting user User is coerced, because the voting user User uses the public key encryption of the vote counting server CS, the voting user User cannot decrypt it, and when facing coercion, the encrypted content ciphertext M and the fake key r are handed over. f , while the voting user User calculates an x f Sent to the coercer, the calculation process of the voting user User is as follows: The voting user User uses the verification ciphertext Calculate the equal verification ciphertext The following conditions must be met: Make m t +x·α=m f +x f ·a The coercer uses a fake key r f Decrypt the ciphertext M to get the false plaintext m f , and verify the private key ciphertext are equal.

3. The method according to claim 1 or 2, characterized in that: S303 also includes: when the vote counting server CS is coerced, the vote counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer. cs , then the coercer uses SK cs Decrypt the public key ciphertext C1 to obtain the ciphertext M and the fake key r f Finally, the coercer uses m f =M⊕r f Calculate the false plaintext m f .

4. The method according to claim 3, characterized in that S303 also includes: when the voting user User and the vote counting server CS are coerced, the voting user User hands over the encrypted ciphertext M and the fake secret key r f and the calculated pseudorandom number r f and calculate the pseudo-random number x f The calculation process is the same as that of the voting user User being coerced. The counting server CS hands over the decryption key SK of the public key ciphertext C1 to the coercer. cs ,The calculation process is the same as when the vote counting server CS is coerced.

5. The method according to claim 1, characterized in that: Also includes: The voting user User denies a batch of multiple ciphertexts at one time. The specific algorithm steps are as follows: Given n voting messages in The voting user User who has the private key chooses a fake plaintext m n+1 , calculate an X by aggregation, so that The steps for calculating X are as follows: Calculated: The voting user aggregates X and chooses the fake plaintext m n+1 and M i , Give it to the coercer, who will get the ballot information and calculate it Fake plaintext, then calculate Equal, verified correct.

6. The method according to claim 5, characterized in that Also includes: When the voting user User and the counting server CS are coerced, they need to deny multiple ciphertexts. The voting user User will send X, the fake ballot information m n+1 and M i , The calculation process is the same as that of the voting user User denying multiple ciphertexts at one time. The counting server CS hands over the public key ciphertext C1 decryption key SK to the coercer. cs , the coercer uses SK cs Decrypt the public key ciphertext C1 to obtain the ciphertext M and the fake key r f Finally, the coercer uses m f =M⊕r f Calculate the false plaintext m f .

Images