Block chain-based traceable Condorpet voting system

Abstract

The invention discloses a blockchain-based traceable self-counting Condorpet voting system. The system comprises a voting organization party, a blockchain network module, an intelligent contract cluster, a plurality of voter terminal modules and a homomorphic time lock calculation module. According to the invention, a set of decentralization Condiket voting framework based on the block chain is constructed, vote submission, vote structure verification and automatic vote counting can be realized under the condition of no trusted third party, and the credibility and transparency of the voting system are remarkably improved.

Description

Technical Field

[0001] This invention relates to the fields of electronic voting and information security technology, and in particular to a blockchain-based traceable self-counting Condorcet voting system. Background Technology

[0002] With the development of internet technology, distributed systems, and digital governance, electronic voting has gradually become an important method for decision-making by various organizations, communities, and online platforms. Electronic voting systems not only require a convenient voting process but also must ensure the privacy, accuracy, verifiability, and resistance to manipulation of votes. Among numerous voting rules, Condorcet ranking voting is considered a relatively fair and stable decision-making method due to its ability to reflect overall voter preferences and its strong social choice characteristics. However, existing electronic implementations of Condorcet voting still face several challenges.

[0003] Traditional electronic voting systems generally rely on centralized vote-counting servers or trusted third-party institutions to manage ballots, tally results, or perform voter authentication. This centralized model introduces significant trust risks: on the one hand, centralized servers may be attacked, crash, or maliciously manipulated; on the other hand, the credibility of third-party institutions cannot be fully guaranteed, and any deliberate tampering, internal leaks, or forced manipulation will directly impact the security and fairness of the voting system. Therefore, achieving both accuracy and privacy protection in voting systems without a trusted third party has become an important direction in electronic voting research.

[0004] Meanwhile, electronic voting systems must meet stringent privacy protection requirements. Voter preferences are highly sensitive information. In Condorcet ranking voting, voters need to submit a ranking of their preferences for all candidates, which contains far more information than a simple yes / no vote or a score-based vote. If ballots are leaked or linked to specific identities by analysts, it will seriously infringe on voter privacy and may even lead to threats, coercion, or group pressure. Therefore, effectively concealing the voter ranking structure while ensuring the legitimacy of the vote is a key technical challenge in the Condorcet voting digitization process.

[0005] In the absence of a trusted vote counter, self-counting has become a hot research topic. Self-counting mechanisms require all ballots to be published to a public ledger or shared storage area using specific encryption methods, allowing anyone to independently verify and calculate the final result after meeting certain conditions. While self-counting mechanisms do not rely on third-party institutions, they also face new challenges: how to ensure that the ciphertext submitted by voters conforms to the Condorcet sorting format; how to verify the legitimacy of ballots without revealing the plaintext; how to prevent malicious voters from using illegitimate ciphertext to disrupt the vote counting process; and how to ensure that ballots can be correctly decrypted or opened during the vote reveal phase and that vote counting can be completed smoothly.

[0006] Furthermore, electronic voting systems must address the double voting problem. In traditional centralized voting, servers can prevent duplicate voting by the same identity by maintaining voting records; however, in decentralized systems, identity authentication and duplicate detection become more complex. Especially when protecting voter anonymity, a balance must be struck: voters' true identities must not be exposed, yet each voter must be guaranteed to vote only once. In existing technologies, ring signatures offer a relatively anonymous voting method, but they struggle to effectively track double voting; while traceable ring signatures maintain anonymity and can detect duplicate submissions, but still require integration with voting rules and the design of constraint mechanisms suitable for condorcet ordering structures.

[0007] On the other hand, traditional electronic voting systems primarily rely on interactive zero-knowledge proofs for verifying vote content. However, the interactive protocol requires multiple rounds of communication, making it unsuitable for large-scale network environments. To reduce communication overhead and enhance system deployability, non-interactive zero-knowledge proofs (NIZK) have become a key technology for verifying the legitimacy of ballots. However, the Condorcet sorted ballot structure is complex, and conventional NIZK alone is insufficient to efficiently verify the correctness of the sorting format. Consequently, it could be exploited by malicious voters to construct ballots with illegitimate formats and disrupt the vote counting process.

[0008] With the development of blockchain technology, blockchain-based electronic voting systems are gradually becoming a research trend. Blockchain possesses characteristics such as immutability, public verifiability, and decentralized maintenance, providing a secure and reliable ledger for voting systems, preventing ballot tampering, and enhancing the transparency and traceability of the voting process. However, most existing blockchain voting methods focus on simple voting, such as affirmative / negative votes or score-based voting. They lack comprehensive technical solutions for both privacy protection and self-counting of votes with complex ranking rules. Furthermore, the public nature of blockchain increases the risk of ballot privacy leaks; therefore, combining it with encryption technology allows ballots to be stored publicly while preventing the disclosure of personal preferences.

[0009] To ensure a fair vote counting process, time-release encryption (TRE) mechanisms typically rely on time control techniques, such as time-lock puzzles (TLPs), to ensure that ballots cannot be decrypted by anyone before the voting stage. However, traditional time-lock puzzles require significant computation, making it difficult to simultaneously meet the requirements of security and efficiency. In recent years, scholars have proposed homomorphic time-lock puzzles (HTLPs), which introduce linear homomorphism while maintaining the time-lock property. This property allows for off-chain aggregation of multiple time-lock puzzles, making the decryption complexity independent of the number of votes, thus naturally meeting the need for efficient encrypted aggregation in self-counting systems. However, applying HTLPs to condorcet ordering voting still requires solving several technical problems, such as structured ciphertext, format verification, and homomorphism preservation. Summary of the Invention

[0010] To address the aforementioned issues, this invention proposes a blockchain-based traceable, self-counting Condorcet voting system. This system includes an election organizer, a blockchain network module, a smart contract cluster, several voter terminal modules, a homomorphic time lock calculation module, and a duplicate voting tracking module.

[0011] The election organizer is responsible for initiating election events, setting up a candidate list, generating system public parameters, and deploying blockchain smart contracts.

[0012] The blockchain network module is used to store system public parameters, voter registration lists, verified encrypted ballot data, and aggregated homomorphic ciphertext, providing distributed ledger services;

[0013] The smart contract cluster includes a registration management contract, a vote verification contract, and a vote counting contract, which respectively execute voter registration management, vote verification, and homomorphic aggregation vote counting functions.

[0014] The voter terminal module is used to generate voter public-private key pairs, construct Condorcet pairwise comparison matrices, perform homomorphic time-locked puzzle encryption and non-interactive zero-knowledge proof generation, and construct traceable ring signatures;

[0015] The homomorphic time lock calculation module is used to perform time lock delay decryption of the aggregated ciphertext after the voting deadline, restore the global pairwise comparison matrix, and calculate the Condorcet winner.

[0016] Furthermore, the blockchain network module includes several consensus nodes, and the stored system public parameters include bilinear group pairs. Generator Generator The strong RSA modulus N, the time parameter t, the tracking key pair (EPK, ESK), the candidate set C, and the event identifier event, where, For bilinear group pairs, It is a bilinear mapping. , .

[0017] Furthermore, among the contracts in the smart contract cluster, the registration management contract is used to maintain the voter registration list; the vote verification contract is responsible for verifying non-interactive zero-knowledge proofs and traceable ring signatures; and the vote counting contract is used to execute homomorphic aggregation and vote counting-related logic.

[0018] Furthermore, the voter terminal module includes:

[0019] Key generation unit: Generates voter public / private key pairs (x k ,y k );

[0020] Ballot construction unit: based on voters Preference to generate n×n pairwise comparison matrices If the candidate In this voter ranking, better but ;on the contrary i and j are candidate numbers, n is the number of candidates, and k is the voter number;

[0021] Encryption Unit: The matrix elements are encrypted using a homomorphic time-lock puzzle to generate an encrypted comparison matrix. ;

[0022] Signature Unit: Constructs a traceable ring signature based on the voter registration list to anonymously sign the encrypted ballot and proof of its legitimacy.

[0023] Furthermore, the homomorphic time lock calculation module includes: a non-interactive zero-knowledge proof generation unit, a homomorphic aggregation unit, and a time lock puzzle unit;

[0024] The non-interactive zero-knowledge proof generation unit is used to construct a set of non-interactive zero-knowledge proofs containing diagonal validity proofs, Boolean validity proofs, antisymmetry constraint proofs, and row and permutation constraint proofs;

[0025] The homomorphic aggregation unit is used to perform product operations on the corresponding elements of all valid encrypted matrices through the vote counting contract, thereby achieving a homomorphic mapping of plaintext summation;

[0026] The time-lock puzzle unit is used to generate HTLP instances that satisfy additive homomorphism.

[0027] Furthermore, in the set of non-interactive zero-knowledge proofs, the functions of each proof are as follows:

[0028] Proof of Diagonal Validity: Prove that for any candidate numbered i, the elements of the main diagonal of the pairwise comparison matrix satisfy... ;

[0029] Boolean validity proof: Prove that each comparison value It can only take the values ​​0 or 1, without revealing the specific value;

[0030] Prove the antisymmetry constraint: Prove that any candidate pair (i,j) must satisfy

[0031] Proof of row sum and permutation constraints: Prove that the row sums are compared in pairs. A candidate set must be formed. A permutation of , i.e., all rows and are distinct.

[0032] Furthermore, the encryption unit uses a homomorphic time-lock puzzle to encrypt matrix elements and generate an encrypted comparison matrix. For each candidate The unit performs the following steps:

[0033] Step 1: Random Number Selection

[0034] Voter Random Selection This is used to randomize the ciphertext;

[0035] Step 2: Constructing HTLP puzzle components

[0036] remember for The generators are used to calculate the intermediate variable T. For any ,structure:

[0037]

[0038]

[0039] The first part of the ciphertext, the carrier of "randomness," is used to protect the ballot from brute-force attacks; it contains the encryption key. The second part of the ciphertext encapsulates the homomorphic ciphertext portion of the data, which carries the homomorphically encrypted plaintext information and encrypts the ballot with the encryption key;

[0040] when season , At this time there is ;

[0041] It is a multiplicative group modulo N The subgroup consisting of elements whose Jacobi symbol is 1. yes Generators;

[0042] Step 3: Combining the puzzle structure

[0043] for The encryption result of the element is represented in binary form: Voters perform the above construction on all elements in the matrix to form a complete encrypted comparison matrix: .

[0044] Furthermore, the homomorphic time lock calculation module includes a ciphertext receiving unit, a distributed decryption unit, a Condorcet winner calculation unit, and a result submission unit;

[0045] Ciphertext receiving unit: Reads from the blockchain the aggregate ciphertext consisting of all legal voters' encrypted ballots, the strong RSA modulus N, and the time parameter t;

[0046] Distributed decryption unit: The computational task is broken down into multiple subtasks, distributed to multiple participating nodes, and the plaintext is recovered. , This indicates that all voters support " Is it superior to In this comparative relationship, The total number of winning votes, where m is the total number of voters;

[0047] Winner Calculation Unit: When all After being decrypted, a global pairwise comparison matrix is ​​formed: ,matrix elements in This indicates that among all voters, The number of votes; according to the Condorcet rule, if there is a candidate with the number w satisfy: ,but The overall Condorcet winner;

[0048] Result Submission Unit: Writes the global pairwise comparison matrix T and the Condorcet winner to the blockchain and generates a result verification credential.

[0049] Furthermore, it also includes a duplicate voting tracking module, which is used to detect duplicate signatures within the same event domain and recover the public key of the duplicate voter through a traceable ring signature parsing mechanism; the smart contract cluster also includes a tracking contract, which is used to trigger tracking calculations when duplicate voting is detected.

[0050] Furthermore, the functional units of the duplicate voting tracking module include:

[0051] Signature storage unit: Stores the traceable ring signatures and corresponding hash values ​​of all valid votes within the same event domain;

[0052] Duplicate detection unit: Identifies duplicate signatures under the same event identifier by comparing the signature hash value with the signature tag;

[0053] Public key recovery unit: When a duplicate signature and tracking key pair are input, the corresponding algorithm is invoked to recover the public key of the voter who voted repeatedly;

[0054] Evidence generation unit: Generates traceable evidence containing duplicate signatures, submission timestamps, and recovery public keys, and writes the evidence into the blockchain for auditing and traceability.

[0055] The beneficial effects of this invention are:

[0056] 1.1. This invention constructs a decentralized Condorcet voting framework based on blockchain, which can realize ballot submission, ballot structure verification and automatic vote counting without a trusted third party, significantly improving the credibility and transparency of the voting system.

[0057] 2.2. This invention uses a homomorphic time-lock puzzle to encrypt the pairwise comparison matrix, which not only ensures that the selection preference cannot be disclosed in advance during the voting period, but also enables all legitimate ciphertexts to be aggregated on-chain, supporting efficient self-counting of votes.

[0058] 3.3. The non-interactive zero-knowledge proof system proposed in this invention can comprehensively verify the structural legality of sorted ballots, preventing illegally constructed ciphertext from undermining the correctness of vote counting.

[0059] 4.4. The traceable ring signature mechanism designed in this invention can accurately track duplicate voting behavior while ensuring voter anonymity, thereby enhancing the system's resistance to attacks.

[0060] 5. The automatic verification and storage mechanism based on blockchain smart contracts can automate the entire voting process, reduce human intervention, and further improve system reliability.

[0061] 6. The delayed decryption vote counting process designed in this invention allows all voters to independently complete the vote counting and verify its correctness, achieving complete openness and verifiability of the results. Detailed Implementation

[0062] The present invention and its working method will be described in detail below with reference to specific embodiments.

[0063] This invention is an electronic voting system operating on a blockchain-based infrastructure, comprising the following entities and modules:

[0064] (1) (1) Election organizer: responsible for initiating election events, setting up candidate lists, generating system public parameters, deploying blockchain smart contracts, and undertaking tracking and accountability functions when double voting occurs.

[0065] (2) Several voter terminal modules: The voter terminal modules (to make the description more precise, they will be referred to as voters in some of the following descriptions) form a voter set, denoted as m represents the number of voters, and k is the voter ID. The value of k is greater than or equal to 0 and less than or equal to m.

[0066] Each voter has a unique public-private key pair (x) in the system. k ,y k This is used to construct anonymous but traceable ring signatures and generate voter public-private key pairs for participation in the creation and encryption of sorted ballots; to construct Condorcet pairwise comparison matrices; to perform homomorphic time-locked puzzle encryption and non-interactive zero-knowledge proof generation; and to construct traceable ring signatures. Candidate set: denoted as... , where n is the number of candidates. All Condorcet sorting and pairwise comparison matrices are constructed based on this set.

[0067] (3) Blockchain network: Composed of several consensus nodes, running in the form of a consortium blockchain or a permissioned blockchain. Each node collaboratively maintains an immutable distributed ledger to record system public parameters, registration lists, encrypted votes, vote counting results, and related proofs. Byzantine fault-tolerant consensus algorithms such as PBFT can be used to ensure data consistency and reliability.

[0068] (4) Smart Contract Module: Smart contracts deployed on the blockchain are used to automatically execute logic such as registration verification, vote verification, vote storage, and homomorphic aggregation of cryptographic matrices. Internally, it can be further divided into:

[0069] Registration Management Contract (RegC): Maintains the voter registration list (RL);

[0070] Voting Verification Contract (VoteC): Responsible for verifying NIZK proofs and traceable ring signatures;

[0071] The vote counting contract (TallyC) executes homomorphic aggregation and vote counting-related logic;

[0072] Preferably, the smart contract module also includes a trace contract (TraceC): which triggers trace computation when duplicate voting is detected.

[0073] (5) Homomorphic time lock calculation module: It can be any network node or third-party entity with computing power. After the voting ends, it performs delayed calculation according to the public time lock parameters, completes the public decryption of the aggregated ciphertext, restores the global pairwise comparison matrix, calculates the Condorcet winner, and writes the decryption result back to the blockchain to realize public and verifiable self-counting.

[0074] Preferably, the system also includes a duplicate voting tracking module, which is used to detect duplicate signatures within the same event domain and recover the public key of the duplicate voter through a traceable ring signature parsing mechanism; the smart contract cluster also includes a tracking contract, which is used to trigger tracking calculations when duplicate voting is detected.

[0075] The symbols and definitions used in this invention are as follows:

[0076] (1) (1) Safety parameters and group parameters

[0077] Security parameters are used to control the security level of cryptographic primitives.

[0078] Bilinear group pairs and their bilinear mappings ; It is a bilinear mapping;

[0079] : Generators of their respective groups.

[0080] (2) Condorcet sorting and comparison matrix

[0081] Candidate set ; Each represents a candidate's number;

[0082] The order of individual voters is denoted as the permutation vector. ;

[0083] Pairwise comparison matrices are denoted as .

[0084] in

[0085] (3) Time lock and related parameters of homomorphic encryption

[0086] Strong RSA Module ;

[0087] Time parameter t: controls the computational difficulty of delayed decryption (requiring approximately [number] operations). (second consecutive squares)

[0088] Simultaneously using the strong RSA modulus N and its extended modulus Construct a homomorphic encryption structure.

[0089] (4) Homomorphic Temporal Lock Puzzle (HTLP) Algorithm Family

[0090] Generate common parameters pp;

[0091] Encapsulate the solution s into a puzzle z;

[0092] : The solution s is recovered through continuous calculation;

[0093] Supports homomorphic operations on puzzles; These are parameters for homomorphic timelock encryption, which can be used to quickly decrypt timelock ciphertext.

[0094] (5) Traceable ring signature

[0095] : Generate the system parameters and tracking key pair required for a traceable ring signature, where the public key part contains EPK and the private key part contains ESK;

[0096] : in the tag Voters then use their private keys Generate a traceable ring signature for message z ; This is the set of public keys of the voters in this election, which is a parameter of the traceable ring signature and can be used to calculate the voter's identity.

[0097] Verify the validity of the signature;

[0098] When a duplicate signature is detected within the same event domain, the signer's public key is recovered from the two signatures or a result of "associated / no solution" is given. For voters who vote repeatedly, The linked signature indicates that two signatures are identical, but it is impossible to determine which voter they belong to. The two voters who voted twice are not the same person.

[0099] (6) (6) Registration List

[0100] The set of voter public keys published on the blockchain, used to construct the ring signature. These represent the public keys of voters numbered from 0 to m-1.

[0101] The working method of this system will be explained in detail below.

[0102] I. Initialization Process

[0103] The initialization process includes: steps to build the blockchain network, steps to generate cryptographic parameters, steps to generate tracking key pairs, steps to set the candidate list and event identifiers, and steps to deploy smart contracts and write system public parameters.

[0104] The steps for building a blockchain network are as follows: The election organizer selects several physical or virtual nodes as blockchain consensus nodes, which run a blockchain platform that supports smart contracts. In this step: a unique identity and certificate are assigned to each consensus node; consensus protocol parameters are configured, such as view switching timeout and the maximum tolerable number of Byzantine nodes; the genesis block is initialized, writing the system root certificate, organizer identity information, etc., into the genesis configuration. This forms a "permissioned chain" in the blockchain network, allowing only permitted nodes to participate in accounting and contract execution, preventing malicious nodes from arbitrarily joining and disrupting the voting process.

[0105] The steps for generating cryptographic parameters are as follows: The organizer generates the cryptographic parameters required for the system to operate based on the security parameter λ; the security parameter generation algorithm is called to select group pairs that satisfy the bilinearity condition, non-degeneracy, and computational difficulty. And select generators The organizers selected two large prime numbers. Calculate the strong RSA modulus And set the time parameter t. The time parameter t controls the number of consecutive square calculations required to unlock the puzzle. This ensures that no entity can decrypt the ballot in advance during the voting phase. , These represent the two prime numbers that generate N.

[0106] The steps for generating the traceable key pair are as follows: The organizer executes the TRS.Setup algorithm to obtain the system parameters and traceable key pair required for the traceable ring signature: the public key EPK is part of the overall system traceability structure and can be made public; the private key ESK is held only by the election organizer and is used to parse the signature and recover the voter's public key in the event of duplicate voting.

[0107] Steps for setting up the candidate list and event identifiers: The election organizer determines the candidate set based on the actual situation of this election. A unique event identifier (event) is defined for this election. The event identifier will be used as a label input in the traceable ring signature to ensure that the signatures of different election events are distinguished, while limiting duplicate voting detection to the same event domain.

[0108] The steps for deploying smart contracts and writing public system parameters are as follows: The election organizers deploy multiple smart contracts on the blockchain, including:

[0109] Registration Management Contract (RegC): Responsible for managing the voter registration list (RL);

[0110] Voting verification contract (VoteC): Responsible for receiving, verifying, and storing votes;

[0111] The vote counting contract (TallyC) is responsible for homomorphic aggregation and vote counting logic.

[0112] TraceC contract: responsible for tracking duplicate voting logic.

[0113] After the smart contract is deployed, the election organizers write public parameters, including group parameters, onto the blockchain. Generator , ; Time lock parameters (N, t); Tracking public key EPK; Candidate set C; Event identifier event.

[0114] II. Voter Registration Process

[0115] In the voter registration process, each legitimate voter generates a unique public-private key pair and publishes their public key through the voter registration list (RL) on the blockchain. This allows subsequent ring signatures to be constructed within a public, fixed ring, achieving anonymity and traceability. The process includes: voter key pair generation, non-interactive zero-knowledge proof of public key legitimacy, and on-chain registration of the public key.

[0116] 1. Steps for generating voter key pairs

[0117] Every voter Perform the following steps locally:

[0118] Step 1: Randomly select a private key from the set of large integers or the ring of integers corresponding to the group order. , where p is The order of or subgroup of , where k is the voter number;

[0119] Step 2: Calculate the public key from the private key The public key will serve as its identity identifier in ring signing and tracing.

[0120] 2.2. Steps for non-interactive zero-knowledge proof of public key validity

[0121] To prevent malicious voters from uploading illegal or structurally abnormal public keys, this invention requires voters to verify that "the public key is indeed..." Constructing a non-interactive zero-knowledge proof (NIZK) based on the fact of "a certain power of", this proof can adopt a Schnorr-type NIZK structure, and the process includes:

[0122] Voter Random Selection Calculate the commitment value ;

[0123] Calculate the challenge value H is the hash function;

[0124] Calculate response value , ;

[0125] The final registration contract can be verified by the following equation. If the equation holds true, then it means It is a valid group element and is indeed a power of a generator; no need to know... The specific value to be taken.

[0126] 3. Public Key Chain Registration Steps

[0127] Voters send transactions containing their public keys to the RegC contract. With proof RegC executes the above verification algorithm: if the verification passes, then... Add the voter to the voter registration list (RL); if verification fails, registration is rejected. Ultimately, the on-chain voter registration list (RL) will have the following structure: Each element corresponds to a verified voter.

[0128] III. Sorting Ballot Creation and Encryption Process

[0129] After registration, each voter can rank candidates according to their true preferences during the voting period. This ranking is then encoded into a Condorcet pairwise comparison matrix. Each comparison value is then encrypted using a homomorphic time-locked puzzle structure to generate an encrypted ballot. This process includes constructing the Condorcet pairwise comparison matrix and generating the homomorphic time-locked puzzle ciphertext.

[0130] 1. Steps for constructing the Condorcet pairwise comparison matrix

[0131] voter First, determine your preference order for candidates, which can be represented by a permutation vector. ,in Let represent the candidate number at the i-th preferred position. Based on this permutation, construct... Pairwise comparison matrix Defined as: if the candidate Superior to this voter's preference ranking ,Right now ,but ;on the contrary ,in Indicates candidate In voters Position index in the sorting.

[0132] The Condorcet pairwise comparison matrix must satisfy the following structural constraints, which will be used in subsequent NIZK tests for validity verification:

[0133] The main diagonal is 0: because candidates are not compared to themselves, therefore... ;

[0134] Antisymmetric constraint: for any Only one can win. For any pair of candidates, voters must establish a strict preference relationship to ensure the uniqueness of preference directions in the matrix;

[0135] Row sum permutation constraint: Define the sum of the rows in the i-th row as... Candidates The number of candidates who "beat" other candidates in this voter's preference ranking. The Condorcet ranking structure requires... As a multiset, it should exactly constitute a set. A permutation of , i.e., all rows and are distinct, corresponds to a linear order of candidates from least preferred to most preferred.

[0136] 2.2. Steps for generating ciphertext in a homomorphic time-locked puzzle

[0137] To ensure that ballots are not decrypted before the voting period, and to allow for homomorphic aggregation of all ballots during the final vote count, this invention employs an HTLP structure to encrypt each comparison value in the matrix. For each candidate pair... ,voter Perform the following steps:

[0138] Step 2.1: Random Number Selection

[0139] Voters randomly select random numbers This is used to randomize the ciphertext. The existence of random numbers ensures that the encryption results of different voters for the same comparison value are also independent of each other.

[0140] Step 2.2: Construction of HTLP puzzle components

[0141] remember for generator, For any ,structure:

[0142]

[0143]

[0144] , This is the result of a homomorphic encryption algorithm. The first part of the ciphertext, a carrier of "randomness" used to protect the ballot from brute-force attacks, contains the encryption key. The second part of the ciphertext encapsulates the homomorphic ciphertext portion of the data, which carries the homomorphically encrypted plaintext information and encrypts the ballot with the encryption key.

[0145] when season , At this time there is

[0146] It is a multiplicative group modulo N The subgroup consisting of elements whose Jacobi symbol is 1. yes The generator.

[0147] Step 2.3: Combining the puzzle structure

[0148] for The encryption result of the elements is represented in binary form in this invention: ,voter Perform the above construction on all elements in the matrix to form the complete encryption comparison matrix: This matrix will serve as the primary ciphertext carrier for the ballots.

[0149] IV. Process for Generating Proof of Ballot Validity

[0150] To prevent malicious voters from constructing ciphertext matrices that do not satisfy the Condorcet ordering constraint, this invention employs a non-interactive zero-knowledge proof system consisting of four parts to verify the structural validity of the encrypted matrix. The four parts correspond to proofs of diagonal validity, Boolean validity, antisymmetry constraint, and row and permutation constraints, respectively.

[0151] Proof of diagonal validity: For any candidate with index 𝑖, the elements of the main diagonal of the pairwise comparison matrix satisfy 𝑖. ;

[0152] The goal of Boolean validity proof is to prove to the verifier that each compared value... It can only take the values ​​0 or 1, without revealing the specific value;

[0153] The proof of antisymmetry constraint requires each pair of candidates satisfy: That is, among the preferences of voter k, one of the two must be preferred and uniquely preferred;

[0154] The proof of row and permutation constraints is one of the core aspects of the Condorcet sorting structure, and it requires:

[0155] ,in ;

[0156] because Encrypted using an HTLP structure, voters can perform homomorphic addition on each line in the ciphertext field to obtain the ciphertext of the line sum: Then, construct the NIZK proof: There exists a permutation such that all The plaintexts are in the set {0,1,…,n−1} and are distinct from each other.

[0157] The final voters will combine the Boolean validity proof, the antisymmetry constraint proof, and the row and permutation constraint proof into a complete ballot validity proof:

[0158]

[0159] This is proof of legitimacy. This proof is related to the encryption matrix. Both are submitted to the blockchain, where the VoteC contract executes unified verification logic. Successful verification indicates that the voter generated a Condorcet-ordered ballot with a completely valid structure and without revealing any details of their preferences. It is a Boolean validity proof. It is a proof of antisymmetry constraint. This is a proof of row and permutation constraints.

[0160] V. Ballot Submission and On-Chain Verification Process

[0161] Voters anonymously sign the entire "encrypted ballot + proof of legitimacy" using a traceable ring signature and submit the signature to the blockchain. The smart contract verifies the correctness of the signature and proof against the voter registration list (RL) and performs duplicate voting checks. This process includes constructing the traceable ring signature, submitting the ballot on-chain, and verifying the ballot on-chain.

[0162] 1. Steps for constructing a traceable ring signature

[0163] voter Retrieve the latest registration list from the blockchain. , where m is the number of voters; let the ring public key set be The message to be signed is defined as follows: and construct labels Then the voters invoke the TRS.Sig algorithm: Output signature The signature has the following characteristics:

[0164] Externally, it can only be seen that the signature was generated by a member of a certain ring, but it is impossible to determine which one;

[0165] The signature is bound to the event identifier, meaning it is only considered comparable within the same election event.

[0166] If the same private key generates two different signatures for the same event, the corresponding public key can be recovered later using TRS.Trace.

[0167] 2.2. Steps for submitting ballots on the chain

[0168] Voters send transactions to the VoteC contract, with the transaction payload containing: a cryptographic ballot matrix. Proof of legality ; Ring signature After receiving a transaction, the smart contract temporarily stores it in a queue to be verified.

[0169] 3. Steps for verifying votes on the blockchain

[0170] The VoteC contract performs the following verification process for each submitted vote:

[0171] Verifying non-interactive zero-knowledge proofs: The smart contract calls a pre-defined verification function to verify... Verify each one; if any sub-proof fails to verify, the vote is deemed invalid, discarded, and logged for future auditing.

[0172] Verify the traceable ring signature: The smart contract calls the TRS.Ver algorithm to construct a tag using the current registration list. ,verify: If the return value is 0, the vote is considered invalid and discarded; the TRS.Ver algorithm is an existing technology.

[0173] Detecting duplicate signatures and marking: Smart contracts can maintain a signature identifier table for each event identifier, storing the tracking vector or mark value involved in the signature in association with the event identifier; when a new signature enters the system, the contract checks whether there is a suspicious association with the history. If a suspicious duplicate is detected, the signature pair is marked as "to be tracked".

[0174] Steps for storing valid votes: If all the above verifications pass, the smart contract will... The relevant metadata records are stored on the chain for use in subsequent homomorphic aggregation and vote counting processes;

[0175] VI. Homomorphic Aggregation and Time Locking Voting Process

[0176] After the voting deadline, the system enters the vote counting phase. This invention uses a combination of homomorphic encryption and time-lock puzzles to achieve aggregated vote counting without decrypting individual votes, and publicly unlocks all comparison results after the vote counting is completed.

[0177] The steps of element-wise homomorphic aggregation are as follows: Assume the VoteC contract has stored a cryptographic comparison matrix from all legitimate voters. The first ciphertext part of each matrix element is denoted as The second ciphertext part is denoted as The vote-counting contract TallyC performs the following homomorphic aggregation operation on each pair of candidates (i,j): According to the additive homomorphism, the above expression corresponds to the summation of plaintext: ,Right now This indicates that all voters support " Is it superior to In this comparative relationship, Total number of votes for winning;

[0178] The time-lock decryption process involves the following steps: To prevent premature viewing of the aggregation results during the voting period, the comparison value is encapsulated in an HTLP structure. Once the vote counting phase begins, any voter can participate in the puzzle-solving process: Voters read the corresponding time-lock parameters (N, t) and the aggregation puzzle from the blockchain. The corresponding HTLP instance For each According to HTLP.Solve The algorithm execution is approximately The quadratic operation completes the time lock calculation and recovers the aggregated comparison value. Due to the unidirectional and deterministic nature of the time-lock function, this invention ensures that no participant can easily circumvent it before the end of the voting period. The vote count is obtained in advance through multiple calculations, ensuring fairness in the vote counting process. HTLP.Solve is an existing algorithm.

[0179] Condorcet Winner Decision Steps: When all After being decrypted, a global pairwise comparison matrix is ​​formed: ,matrix elements in This indicates that among all voters, The number of votes; according to the Condorcet rule, if there is a candidate with the number w satisfy: ,but The overall Condorcet winner is determined by this matrix. The TallyC contract or off-chain program can perform the above comparisons based on this matrix and write the final winner and related statistics back to the blockchain for public verification by everyone. For all voters to " Is it superior to In this comparative relationship The total number of votes for winning, For all voters to " Is it superior to In this comparative relationship The total number of votes for the winner.

[0180] Preferably, a duplicate voting tracking process is also included.

[0181] VII. Duplicate Voting Tracking Process

[0182] To prevent individual voters from taking advantage of the system's anonymity to vote twice, this invention utilizes a traceable ring signature to achieve a tracking mechanism that "deanonyms only when duplicate voting occurs."

[0183] The steps for duplicate signature detection are as follows: During the vote submission phase, the VoteC contract records certain identifiable components of the signature when verifying the ring signature. When two or more signatures matching the "from the same private key" pattern are found under the same event, the contract marks these signature pairs as objects to be traced and triggers the tracing logic of the TraceC contract.

[0184] The tracing and parsing steps are as follows: The TraceC contract calls the TRS.Trace interface to analyze two signatures that appear to originate from the same voter. , Perform calculations on its messages:

[0185]

[0186] When multiple signatures exist, they are compared one by one using the formula described above. Internally, the algorithm uses the tracking key ESK and the tracking vector in the signature structure to parse evidence of duplicate signatures on the same private key, thereby recovering the corresponding public key. The TRS.Trace interface is existing technology.

[0187] Steps to track results: When recovery is successful Then, the system can map the public key to the actual voter identity based on the voter registration list RL (the election organizer maintains this mapping relationship off-chain).

[0188] Subsequently, the election organizers can handle this duplicate voting incident according to the pre-published rules. It is important to emphasize that in a normal vote with only one valid signature, TRS.Trace is never invoked, and ESK does not participate in any calculations; therefore, voter anonymity is not compromised under normal circumstances.

Claims

1. A blockchain-based, traceable, self-counting Condorcet voting system, characterized in that, This includes the election organizer, blockchain network module, smart contract cluster, several voter terminal modules, and homomorphic time lock calculation module; The election organizer is responsible for initiating election events, setting up a candidate list, generating system public parameters, and deploying blockchain smart contracts. The blockchain network module is used to store system public parameters, voter registration lists, verified encrypted ballot data, and aggregated homomorphic ciphertext, providing distributed ledger services; The smart contract cluster includes a registration management contract, a vote verification contract, and a vote counting contract, which respectively execute voter registration management, vote verification, and homomorphic aggregation vote counting functions. The voter terminal module is used to generate voter public-private key pairs, construct Condorcet pairwise comparison matrices, perform homomorphic time-locked puzzle encryption and non-interactive zero-knowledge proof generation, and construct traceable ring signatures; The homomorphic time lock calculation module is used to perform time lock delay decryption of the aggregated ciphertext after the voting deadline, restore the global pairwise comparison matrix, and calculate the Condorcet winner.

2. The system as described in claim 1, characterized in that, The blockchain network module includes several consensus nodes, and the stored system public parameters include bilinear group pairs. Generator Generator The strong RSA modulus N, the time parameter t, the tracking key pair (EPK, ESK), the candidate set C, and the event identifier event, where, For bilinear group pairs, It is a bilinear mapping. , .

3. The system as described in claim 2, characterized in that, Among the contracts in the smart contract cluster, the registration management contract is used to maintain the voter registration list; the vote verification contract is responsible for verifying non-interactive zero-knowledge proofs and traceable ring signatures; and the vote counting contract is used to execute homomorphic aggregation and vote counting-related logic.

4. The system according to claim 3, characterized in that, The voter terminal module includes: Key generation unit: Generates voter public / private key pairs (x k ,y k ); Ballot construction unit: based on voters Preference to generate n×n pairwise comparison matrices If the candidate In this voter ranking, better but ;on the contrary i and j are candidate numbers, n is the number of candidates, and k is the voter number; Encryption Unit: The matrix elements are encrypted using a homomorphic time-lock puzzle to generate an encrypted comparison matrix. ; Signature Unit: Constructs a traceable ring signature based on the voter registration list to anonymously sign the encrypted ballot and proof of its legitimacy.

5. The system according to claim 4, characterized in that, The homomorphic time lock calculation module includes: a non-interactive zero-knowledge proof generation unit, a homomorphic aggregation unit, and a time lock puzzle unit; The non-interactive zero-knowledge proof generation unit is used to construct a set of non-interactive zero-knowledge proofs containing diagonal validity proofs, Boolean validity proofs, antisymmetry constraint proofs, and row and permutation constraint proofs; The homomorphic aggregation unit is used to perform product operations on the corresponding elements of all valid encrypted matrices through the vote counting contract, thereby achieving a homomorphic mapping of plaintext summation; The time-lock puzzle unit is used to generate HTLP instances that satisfy additive homomorphism.

6. The system according to claim 5, characterized in that, In the set of non-interactive zero-knowledge proofs, the functions of each proof are as follows: Proof of Diagonal Validity: Prove that for any candidate numbered i, the elements of the main diagonal of the pairwise comparison matrix satisfy... ; Boolean validity proof: Prove that each comparison value It can only take the values ​​0 or 1, without revealing the specific value; Prove the antisymmetry constraint: Prove that any candidate pair (i,j) must satisfy ; Proof of row sum and permutation constraints: Prove that the row sums are compared in pairs. A candidate set must be formed. A permutation of , i.e., all rows and are distinct.

7. The system according to claim 6, characterized in that, The encryption unit uses a homomorphic time-lock puzzle to encrypt matrix elements and generate an encrypted comparison matrix. For each candidate The unit performs the following steps: Step 1: Random Number Selection Voter Random Selection This is used to randomize the ciphertext; Step 2: Constructing HTLP puzzle components remember for The generators are used to calculate the intermediate variable T. For any ,structure: This is the first part of the ciphertext, which contains the encryption key; The second part of the ciphertext encapsulates the homomorphic ciphertext portion of the data, which carries the homomorphically encrypted plaintext information and encrypts the ballot with the encryption key; when season , At this time there is ; It is a multiplicative group modulo N The subgroup of elements whose Jacobi symbol is 1; Step 3: Combining the puzzle structure for The encryption result of the element is represented in binary form: Voters perform the above construction on all elements in the matrix to form a complete encrypted comparison matrix: .

8. The system according to claim 7, characterized in that, The homomorphic time lock calculation module includes a ciphertext receiving unit, a distributed decryption unit, a Condorcet winner calculation unit, and a result submission unit. Ciphertext receiving unit: Reads from the blockchain the aggregate ciphertext consisting of all legal voters' encrypted ballots, the strong RSA modulus N, and the time parameter t; Distributed decryption unit: The computational task is broken down into multiple subtasks, distributed to multiple participating nodes, and the plaintext is recovered. , This indicates that all voters support " Is it superior to In this comparative relationship, The total number of winning votes, where m is the total number of voters; Winner Calculation Unit: When all After being decrypted, a global pairwise comparison matrix is ​​formed: ,matrix elements in This indicates that among all voters, The number of votes; according to the Condorcet rule, if there is a candidate with the number w satisfy: ,but The overall Condorcet winner; Result Submission Unit: Writes the global pairwise comparison matrix T and the Condorcet winner to the blockchain and generates a result verification credential.

9. The system as described in claim 1, characterized in that, It also includes a duplicate voting tracking module, which is used to detect duplicate signatures within the same event domain and recover the public key of the duplicate voter through a traceable ring signature parsing mechanism; the smart contract cluster also includes a tracking contract, which is used to trigger tracking calculations when duplicate voting is detected.

10. The system as described in claim 9, characterized in that, The functional units of the duplicate voting tracking module include: Signature storage unit: Stores the traceable ring signatures and corresponding hash values ​​of all valid votes within the same event domain; Duplicate detection unit: Identifies duplicate signatures under the same event identifier by comparing the signature hash value with the signature tag; Public key recovery unit: When a duplicate signature and tracking key pair are input, the corresponding algorithm is invoked to recover the public key of the voter who voted repeatedly; Evidence generation unit: Generates traceable evidence containing duplicate signatures, submission timestamps, and recovery public keys, and writes the evidence into the blockchain for auditing and traceability.

Images