Block chain-based traceable self-counting Condiket voting method

Abstract

The invention discloses a block chain-based traceable Condorpet voting method. The method comprises an initialization process, a voter registration process, a sorted vote creation and encryption process, a vote legality proof generation process, a vote submission and on-chain verification process and a homomorphic aggregation and time lock vote counting process. According to the invention, a set of decentralization Condiket voting framework based on the block chain is constructed, vote submission, vote structure verification and automatic vote counting can be realized under the condition of no trusted third party, and the credibility and transparency of the voting system are remarkably improved.

Description

Technical Field

[0001] This invention relates to the fields of electronic voting and information security technology, and in particular to a blockchain-based traceable self-counting Condorcet voting method. Background Technology

[0002] With the development of internet technology, distributed systems, and digital governance, electronic voting has gradually become an important method for decision-making by various organizations, communities, and online platforms. Electronic voting systems not only require a convenient voting process but also must ensure the privacy, accuracy, verifiability, and resistance to manipulation of votes. Among numerous voting rules, Condorcet ranking voting is considered a relatively fair and stable decision-making method due to its ability to reflect overall voter preferences and its strong social choice characteristics. However, existing electronic implementations of Condorcet voting still face several challenges.

[0003] Traditional electronic voting systems generally rely on centralized vote-counting servers or trusted third-party institutions to manage ballots, tally results, or perform voter authentication. This centralized model introduces significant trust risks: on the one hand, centralized servers may be attacked, crash, or maliciously manipulated; on the other hand, the credibility of third-party institutions cannot be fully guaranteed, and any deliberate tampering, internal leaks, or forced manipulation will directly impact the security and fairness of the voting system. Therefore, achieving both accuracy and privacy protection in voting systems without a trusted third party has become an important direction in electronic voting research.

[0004] Meanwhile, electronic voting systems must meet stringent privacy protection requirements. Voter preferences are highly sensitive information. In Condorcet ranking voting, voters need to submit a ranking of their preferences for all candidates, which contains far more information than a simple yes / no vote or a score-based vote. If ballots are leaked or linked to specific identities by analysts, it will seriously infringe on voter privacy and may even lead to threats, coercion, or group pressure. Therefore, effectively concealing the voter ranking structure while ensuring the legitimacy of the vote is a key technical challenge in the Condorcet voting digitization process.

[0005] In the absence of a trusted vote counter, self-counting has become a hot research topic. Self-counting mechanisms require all ballots to be published to a public ledger or shared storage area using specific encryption methods, allowing anyone to independently verify and calculate the final result after meeting certain conditions. While self-counting mechanisms do not rely on third-party institutions, they also face new challenges: how to ensure that the ciphertext submitted by voters conforms to the Condorcet sorting format; how to verify the legitimacy of ballots without revealing the plaintext; how to prevent malicious voters from using illegitimate ciphertext to disrupt the vote counting process; and how to ensure that ballots can be correctly decrypted or opened during the vote reveal phase and that vote counting can be completed smoothly.

[0006] Furthermore, electronic voting systems must address the double voting problem. In traditional centralized voting, servers can prevent duplicate voting by the same identity by maintaining voting records; however, in decentralized systems, identity authentication and duplicate detection become more complex. Especially when protecting voter anonymity, a balance must be struck: voters' true identities must not be exposed, yet each voter must be guaranteed to vote only once. In existing technologies, ring signatures offer a relatively anonymous voting method, but they struggle to effectively track double voting; while traceable ring signatures maintain anonymity and can detect duplicate submissions, but still require integration with voting rules and the design of constraint mechanisms suitable for condorcet ordering structures.

[0007] On the other hand, traditional electronic voting systems primarily rely on interactive zero-knowledge proofs for verifying vote content. However, the interactive protocol requires multiple rounds of communication, making it unsuitable for large-scale network environments. To reduce communication overhead and enhance system deployability, non-interactive zero-knowledge proofs (NIZK) have become a key technology for verifying the legitimacy of ballots. However, the Condorcet sorted ballot structure is complex, and conventional NIZK alone is insufficient to efficiently verify the correctness of the sorting format. Consequently, it could be exploited by malicious voters to construct ballots with illegitimate formats and disrupt the vote counting process.

[0008] With the development of blockchain technology, blockchain-based electronic voting systems are gradually becoming a research trend. Blockchain possesses characteristics such as immutability, public verifiability, and decentralized maintenance, providing a secure and reliable ledger for voting systems, preventing ballot tampering, and enhancing the transparency and traceability of the voting process. However, most existing blockchain voting methods focus on simple voting, such as affirmative / negative votes or score-based voting. They lack comprehensive technical solutions for both privacy protection and self-counting of votes with complex ranking rules. Furthermore, the public nature of blockchain increases the risk of ballot privacy leaks; therefore, combining it with encryption technology allows ballots to be stored publicly while preventing the disclosure of personal preferences.

[0009] To ensure a fair vote counting process, time-release encryption (TRE) mechanisms typically rely on time control techniques, such as time-lock puzzles (TLPs), to ensure that ballots cannot be decrypted by anyone before the voting stage. However, traditional time-lock puzzles require significant computation, making it difficult to simultaneously meet the requirements of security and efficiency. In recent years, scholars have proposed homomorphic time-lock puzzles (HTLPs), which introduce linear homomorphism while maintaining the time-lock property. This property allows for off-chain aggregation of multiple time-lock puzzles, making the decryption complexity independent of the number of votes, thus naturally meeting the need for efficient encrypted aggregation in self-counting systems. However, applying HTLPs to condorcet ordering voting still requires solving several technical problems, such as structured ciphertext, format verification, and homomorphism preservation. Summary of the Invention

[0010] To address the aforementioned issues, this invention proposes a blockchain-based traceable self-counting Condorcet voting method. The method comprises multiple processes, including an initialization process, a voter registration process, a sorted ballot creation and encryption process, a ballot validity proof generation process, a ballot submission and on-chain verification process, and a homomorphic aggregation and time-locked vote counting process.

[0011] Initialization process: In this invention, the election organizer first generates the bilinear group parameters, pairing mapping function, strong RSA modulus, and time lock parameters required by the system, ensuring that all calculations are performed in a unified security parameter environment; the election organizer also generates its own tracking key pair (EPK, ESK) for subsequent tracking of double voting, and sets up a candidate list; the system public parameter pp is written to the blockchain, so that all voters can obtain the same public parameter set from the blockchain, ensuring the consistency and verifiability of subsequent encryption, signing, and proof operations.

[0012] Voter registration process: Each voter generates an independent public-private key pair and uses a non-interactive zero-knowledge proof (NIZK) to prove to the election organizer that their public key is legitimate and usable; the verified public key will be recorded in the voter registration list RL on the blockchain and published to the outside world through a smart contract; subsequent ring signature operations of voters all use the public key in RL as a ring member, thereby ensuring that all voters share the same set of anonymity.

[0013] The ordering and encryption process for ballots: Voters construct an n×n pairwise comparison matrix, encoding their preferences as Boolean values, based on their order of preference for candidates. This matrix serves as the ballot, where n is the number of candidates. To conceal the ballots, voters select random numbers for each pair of candidates (i,j) and encrypt the elements of the pairwise comparison matrix using a Homomorphic Time Lock Puzzle (HTLP), ensuring that no ballot can be decrypted before the voting ends. This invention guarantees the delay in vote counting through a time lock mechanism, while utilizing the additive homomorphism of HTLP to provide an aggregatable ciphertext structure for subsequent vote counting. i and j represent candidate numbers.

[0014] Ballot validity proof generation process: To ensure that the encrypted matrix submitted by voters is indeed derived from a valid Condorcet order and does not contain illegal values ​​or contradictory structures, this invention designs a set of non-interactive zero-knowledge proofs, respectively addressing diagonal validity, Boolean validity, antisymmetry constraints, and row and permutation constraints.

[0015] Ballot submission and on-chain verification process: Voters use the voter registration list (RL) registered on the blockchain to construct a traceable ring signature to anonymously sign the encrypted ballot and its proof. The traceable ring signature ensures that the voter's identity cannot be located under normal circumstances. However, when duplicate voting occurs, the signature structure labeled with the event identifier (event) can be parsed to obtain the corresponding voter's public key after the smart contract detects the duplicate signature, thus achieving traceability only for malicious behavior. After receiving the ballot, the smart contract verifies both the zero-knowledge proof and the ring signature. Valid ballots will be written on the chain, and invalid ballots will be rejected.

[0016] Homomorphic aggregation and time-locked vote counting process: After the voting deadline, the smart contract performs homomorphic multiplication on each element of all verified encrypted pairwise comparison matrices to achieve ciphertext aggregation without decryption; subsequently, any voter can perform a specified number of consecutive square operations according to the time-lock parameter to publicly delay the decryption of the aggregated ciphertext and obtain the global pairwise comparison matrix; the winning vote relationship between each candidate can be directly calculated from this matrix, thus completing open and transparent self-counting without the need for a trusted third party.

[0017] Preferably, it also includes a duplicate voting tracking process: when the system detects two valid ring signatures from the same event domain, the public key of the corresponding voter can be recovered through the traceable ring signature parsing mechanism to identify malicious duplicate voting behavior; this tracking mechanism is only activated when duplicate voting occurs, without affecting the anonymity of the normal voting process, thus achieving a balance between privacy protection and monitorability.

[0018] The beneficial effects of this invention are:

[0019] 1. This invention constructs a decentralized Condorcet voting framework based on blockchain, which can realize ballot submission, ballot structure verification and automatic vote counting without a trusted third party, significantly improving the credibility and transparency of the voting system.

[0020] 2. This invention uses a homomorphic time-lock puzzle to encrypt the pairwise comparison matrix, which not only ensures that the selection preference cannot be disclosed in advance during the voting period, but also enables all legitimate ciphertexts to be aggregated on-chain, supporting efficient self-counting of votes.

[0021] 3. The non-interactive zero-knowledge proof system proposed in this invention can comprehensively verify the structural legality of sorted ballots, preventing illegally constructed ciphertext from undermining the correctness of vote counting.

[0022] 4. The traceable ring signature mechanism designed in this invention can accurately track duplicate voting behavior while ensuring voter anonymity, thereby enhancing the system's resistance to attacks.

[0023] 5. The automatic verification and storage mechanism based on blockchain smart contracts can automate the entire voting process, reduce human intervention, and further improve system reliability.

[0024] 6. The delayed decryption vote counting process designed in this invention allows all voters to independently complete the vote counting and verify its correctness, achieving complete openness and verifiability of the results. Detailed Implementation

[0025] The present invention will now be described in detail with reference to specific embodiments.

[0026] The method described in this invention operates on an electronic voting system with blockchain as its core infrastructure. This system includes the following entities and modules:

[0027] (1) Election organizer: responsible for initiating election events, setting up candidate lists, generating system public parameters, deploying blockchain smart contracts, and undertaking tracking and accountability functions when double voting occurs.

[0028] (2) Voter assembly: denoted as Each voter has a unique public-private key pair (x) in the system. k ,yk This is used to construct anonymous but traceable ring signatures and to participate in the creation and encryption of sorted ballots. m represents the number of voters, and k is the voter ID, where k is greater than or equal to 0 and less than or equal to m.

[0029] (3) Candidate set: denoted as , where n is the number of candidates. All Condorcet sorting and pairwise comparison matrices are constructed based on this set.

[0030] (4) Blockchain Network: Composed of several consensus nodes, operating in the form of a consortium blockchain or a permissioned blockchain. Each node collaboratively maintains an immutable distributed ledger to record system public parameters, registration lists, encrypted votes, vote counting results, and related proofs. Byzantine fault-tolerant consensus algorithms such as PBFT can be used to ensure data consistency and reliability.

[0031] (5) Smart Contract Module: Smart contracts deployed on the blockchain are used to automatically execute logic such as registration verification, vote verification, vote storage, and homomorphic aggregation of cryptographic matrices. Internally, it can be further divided into:

[0032] Registration Management Contract (RegC): Maintains the voter registration list (RL);

[0033] Voting Verification Contract (VoteC): Responsible for verifying NIZK proofs and traceable ring signatures;

[0034] The vote counting contract (TallyC) executes homomorphic aggregation and vote counting-related logic;

[0035] Preferably, the smart contract module also includes a trace contract (TraceC): which triggers trace computation when duplicate voting is detected.

[0036] (6) Homomorphic time lock calculation participants: can be any network node or third-party entity with computing power. After the voting ends, they perform delayed calculations according to the publicly disclosed time lock parameters, complete the public decryption of the aggregated ciphertext, and write the decryption result back to the blockchain to realize publicly verifiable self-counting.

[0037] The symbols and definitions used in the following sections of this invention will be explained.

[0038] (1) Security parameters and group parameters

[0039] Security parameters are used to control the security level of cryptographic primitives.

[0040] Bilinear group pairs and their bilinear mappings ; It is a bilinear mapping;

[0041] : Generators of their respective groups.

[0042] (2) Condorcet sorting and comparison matrix

[0043] Candidate set ; Each represents a candidate's number;

[0044] The order of individual voters is denoted as the permutation vector. ;

[0045] Pairwise comparison matrices are denoted as .

[0046] in

[0047] (3) Time lock and related parameters of homomorphic encryption

[0048] Strong RSA Module ;

[0049] Time parameter t: controls the computational difficulty of delayed decryption (requiring approximately [number] operations). (second consecutive squares)

[0050] Simultaneously using the strong RSA modulus N and its extended modulus Construct a homomorphic encryption structure.

[0051] (4) Homomorphic Temporal Lock Puzzle (HTLP) Algorithm Family

[0052] Generate common parameters pp;

[0053] Encapsulate the solution s into a puzzle z;

[0054] : The solution s is recovered through continuous calculation;

[0055] Supports homomorphic operations on puzzles; These are parameters for homomorphic timelock encryption, which can be used to quickly decrypt timelock ciphertext.

[0056] (5) Traceable ring signature

[0057] : Generate the system parameters and tracking key pair required for a traceable ring signature, where the public key part contains EPK and the private key part contains ESK;

[0058] : in the tag Voters then use their private keys Generate a traceable ring signature for message z ; This is the set of public keys of the voters in this election, which is a parameter of the traceable ring signature and can be used to calculate the voter's identity.

[0059] Verify the validity of the signature;

[0060] When a duplicate signature is detected within the same event domain, the signer's public key is recovered from the two signatures or a result of "associated / no solution" is given. For voters who vote repeatedly, The linked signature indicates that two signatures are identical, but it is impossible to determine which voter they belong to. The two voters who voted twice are not the same person.

[0061] (6) Registration List

[0062] The set of voter public keys published on the blockchain, used to construct the ring signature. These represent the public keys of voters numbered from 0 to m-1.

[0063] The process included in the method of the present invention will be described in detail below.

[0064] Initialization process

[0065] The initialization process includes: steps to build the blockchain network, steps to generate cryptographic parameters, steps to generate tracking key pairs, steps to set the candidate list and event identifiers, and steps to deploy smart contracts and write system public parameters.

[0066] The steps for building a blockchain network are as follows: The election organizer selects several physical or virtual nodes as blockchain consensus nodes, which run a blockchain platform that supports smart contracts. In this step: a unique identity and certificate are assigned to each consensus node; consensus protocol parameters are configured, such as view switching timeout and the maximum tolerable number of Byzantine nodes; the genesis block is initialized, writing the system root certificate, organizer identity information, etc., into the genesis configuration. This forms a "permissioned chain" in the blockchain network, allowing only permitted nodes to participate in accounting and contract execution, preventing malicious nodes from arbitrarily joining and disrupting the voting process.

[0067] The steps for generating cryptographic parameters are as follows: The organizer generates the cryptographic parameters required for the system to operate based on the security parameter λ; the security parameter generation algorithm is called to select group pairs that satisfy the bilinearity condition, non-degeneracy, and computational difficulty. And select generators The organizers selected two large prime numbers. Calculate the strong RSA modulus And set the time parameter t. The time parameter t controls the number of consecutive square calculations required to unlock the puzzle. This ensures that no entity can decrypt the ballot in advance during the voting phase. , These represent the two prime numbers that generate N.

[0068] The steps for generating the traceable key pair are as follows: The organizer executes the TRS.Setup algorithm to obtain the system parameters and traceable key pair required for the traceable ring signature: the public key EPK is part of the overall system traceability structure and can be made public; the private key ESK is held only by the election organizer and is used to parse the signature and recover the voter's public key in the event of duplicate voting.

[0069] Steps for setting up the candidate list and event identifiers: The election organizer determines the candidate set based on the actual situation of this election. A unique event identifier (event) is defined for this election. The event identifier will be used as a label input in the traceable ring signature to ensure that the signatures of different election events are distinguished, while limiting duplicate voting detection to the same event domain.

[0070] The steps for deploying smart contracts and writing public system parameters are as follows: The election organizers deploy multiple smart contracts on the blockchain, including:

[0071] Registration Management Contract (RegC): Responsible for managing the voter registration list (RL);

[0072] Voting verification contract (VoteC): Responsible for receiving, verifying, and storing votes;

[0073] The vote counting contract (TallyC) is responsible for homomorphic aggregation and vote counting logic.

[0074] TraceC contract: responsible for tracking duplicate voting logic.

[0075] After the smart contract is deployed, the election organizers write public parameters, including group parameters, onto the blockchain. Generator , ; Time lock parameters (N, t); Tracking public key EPK; Candidate set C; Event identifier event.

[0076] II. Voter Registration Process

[0077] In the voter registration process, each legitimate voter generates a unique public-private key pair and publishes their public key through the voter registration list (RL) on the blockchain. This allows subsequent ring signatures to be constructed within a public, fixed ring, achieving anonymity and traceability. The process includes: voter key pair generation, non-interactive zero-knowledge proof of public key legitimacy, and on-chain registration of the public key.

[0078] 1. Steps for generating voter key pairs

[0079] Every voter Perform the following steps locally:

[0080] Step 1: Randomly select a private key from the set of large integers or the ring of integers corresponding to the group order. , where p is The order of or subgroup of , where k is the voter number;

[0081] Step 2: Calculate the public key from the private key The public key will serve as its identity identifier in ring signing and tracing.

[0082] 2. Steps for non-interactive zero-knowledge proof of public key validity

[0083] To prevent malicious voters from uploading illegal or structurally abnormal public keys, this invention requires voters to verify that "the public key is indeed..." Constructing a non-interactive zero-knowledge proof (NIZK) based on the fact of "a certain power of", this proof can adopt a Schnorr-type NIZK structure, and the process includes:

[0084] Voter Random Selection Calculate the commitment value ;

[0085] Calculate the challenge value H is the hash function;

[0086] Calculate response value , ;

[0087] The final registration contract can be verified by the following equation. If the equation holds true, then it means It is a valid group element and is indeed a power of a generator; no need to know... The specific value to be taken.

[0088] 3. Public Key Chain Registration Steps

[0089] Voters send transactions containing their public keys to the RegC contract. With proof RegC executes the above verification algorithm: if the verification passes, then... Add the voter to the voter registration list (RL); if verification fails, registration is rejected. Ultimately, the on-chain voter registration list (RL) will have the following structure: Each element corresponds to a verified voter.

[0090] III. Sorting Ballot Creation and Encryption Process

[0091] After registration, each voter can rank candidates according to their true preferences during the voting period. This ranking is then encoded into a Condorcet pairwise comparison matrix. Each comparison value is then encrypted using a homomorphic time-locked puzzle structure to generate an encrypted ballot. This process includes constructing the Condorcet pairwise comparison matrix and generating the homomorphic time-locked puzzle ciphertext.

[0092] 1. Steps for constructing the Condorcet pairwise comparison matrix

[0093] voter First, determine your preference order for candidates, which can be represented by a permutation vector. ,in Let represent the candidate number at the i-th preferred position. Based on this permutation, construct... Pairwise comparison matrix Defined as: if the candidate Superior to this voter's preference ranking ,Right now ,but ;on the contrary ,in Indicates candidate In voters Position index in the sorting.

[0094] The Condorcet pairwise comparison matrix must satisfy the following structural constraints, which will be used in subsequent NIZK tests for validity verification:

[0095] The main diagonal is 0: because candidates are not compared to themselves, therefore... ;

[0096] Antisymmetric constraint: for any Only one can win. For any pair of candidates, voters must establish a strict preference relationship to ensure the uniqueness of preference directions in the matrix;

[0097] Row sum permutation constraint: Define the sum of the i-th row as... Candidates The number of candidates who "beat" other candidates in this voter's preference ranking. The Condorcet ranking structure requires... As a multiset, it should exactly constitute a set. A permutation of , i.e., all rows and are distinct, corresponds to a linear order of candidates from least preferred to most preferred.

[0098] 2. Steps for generating ciphertext in a homomorphic time-locked puzzle.

[0099] To ensure that ballots are not decrypted before the voting period, and to allow for homomorphic aggregation of all ballots during the final vote count, this invention employs an HTLP structure to encrypt each comparison value in the matrix. For each candidate pair... ,voter Perform the following steps:

[0100] Step 2.1: Random Number Selection

[0101] Voters randomly select random numbers This is used to randomize the ciphertext. The existence of random numbers ensures that the encryption results of different voters for the same comparison value are also independent of each other.

[0102] Step 2.2: Construction of HTLP puzzle components

[0103] remember for generator, For any ,structure:

[0104]

[0105]

[0106] , This is the result of a homomorphic encryption algorithm. The first part of the ciphertext, a carrier of "randomness" used to protect the ballot from brute-force attacks, contains the encryption key. The second part of the ciphertext encapsulates the homomorphic ciphertext portion of the data, which carries the homomorphically encrypted plaintext information and encrypts the ballot with the encryption key.

[0107] when season , At this time there is

[0108] It is a multiplicative group modulo N The subgroup consisting of elements whose Jacobi symbol is 1. yes The generator.

[0109] Step 2.3: Combining the puzzle structure

[0110] for The encryption result of the elements is represented in binary form in this invention: ,voter Perform the above construction on all elements in the matrix to form the complete encryption comparison matrix: This matrix will serve as the primary ciphertext carrier for the ballots.

[0111] Ballot validity verification generation process

[0112] To prevent malicious voters from constructing ciphertext matrices that do not satisfy the Condorcet ordering constraint, this invention employs a non-interactive zero-knowledge proof system consisting of four parts to verify the structural validity of the encrypted matrix. The four parts correspond to proofs of diagonal validity, Boolean validity, antisymmetry constraint, and row and permutation constraints, respectively.

[0113] Proof of diagonal validity: For any candidate with index 𝑖, the elements of the main diagonal of the pairwise comparison matrix satisfy 𝑖. ;

[0114] The goal of Boolean validity proof is to prove to the verifier that each compared value... It can only take the values ​​0 or 1, without revealing the specific value;

[0115] The proof of antisymmetry constraint requires each pair of candidates satisfy: That is, among the preferences of voter k, one of the two must be preferred and uniquely preferred;

[0116] The proof of row and permutation constraints is one of the core aspects of the Condorcet sorting structure, and it requires:

[0117] ,in ;

[0118] because Encrypted using an HTLP structure, voters can perform homomorphic addition on each line in the ciphertext field to obtain the ciphertext of the line sum: Then, construct the NIZK proof: There exists a permutation such that all The plaintexts are in the set {0,1,…,n−1} and are distinct from each other.

[0119] The final voters will combine the Boolean validity proof, the antisymmetry constraint proof, and the row and permutation constraint proof into a complete ballot validity proof:

[0120]

[0121] This is proof of legitimacy. This proof is related to the encryption matrix. Both are submitted to the blockchain, where the VoteC contract executes unified verification logic. Successful verification indicates that the voter generated a Condorcet-ordered ballot with a completely valid structure and without revealing any details of their preferences. It is a Boolean validity proof. It is a proof of antisymmetry constraint. This is a proof of row and permutation constraints.

[0122] Ballot submission and on-chain verification process

[0123] Voters anonymously sign the entire "encrypted ballot + proof of legitimacy" using a traceable ring signature and submit the signature to the blockchain. The smart contract verifies the correctness of the signature and proof against the voter registration list (RL) and performs duplicate voting checks. This process includes constructing the traceable ring signature, submitting the ballot on-chain, and verifying the ballot on-chain.

[0124] 1. Steps for constructing a traceable ring signature

[0125] voter Retrieve the latest registration list from the blockchain. , where m is the number of voters; let the ring public key set be The message to be signed is defined as follows: and construct labels Then the voters invoke the TRS.Sig algorithm: Output signature The signature has the following characteristics:

[0126] Externally, it can only be seen that the signature was generated by a member of a certain ring, but it is impossible to determine which one;

[0127] The signature is bound to the event identifier, meaning it is only considered comparable within the same election event.

[0128] If the same private key generates two different signatures for the same event, the corresponding public key can be recovered later using TRS.Trace.

[0129] 2. Steps for submitting ballots on the chain

[0130] Voters send transactions to the VoteC contract, with the transaction payload containing: a cryptographic ballot matrix. Proof of legality ; Ring signature After receiving a transaction, the smart contract temporarily stores it in a queue to be verified.

[0131] 3. On-chain verification of votes

[0132] The VoteC contract performs the following verification process for each submitted vote:

[0133] Verifying non-interactive zero-knowledge proofs: The smart contract calls a pre-defined verification function to verify... Verify each one; if any sub-proof fails to verify, the vote is deemed invalid, discarded, and logged for future auditing.

[0134] Verify the traceable ring signature: The smart contract calls the TRS.Ver algorithm to construct a tag using the current registration list. ,verify: If the return value is 0, the vote is considered invalid and discarded; the TRS.Ver algorithm is an existing technology.

[0135] Detecting duplicate signatures and marking: Smart contracts can maintain a signature identifier table for each event identifier, storing the tracking vector or mark value involved in the signature in association with the event identifier; when a new signature enters the system, the contract checks whether there is a suspicious association with the history. If a suspicious duplicate is detected, the signature pair is marked as "to be tracked".

[0136] Steps for storing valid votes: If all the above verifications pass, the smart contract will... The relevant metadata records are stored on the chain for use in subsequent homomorphic aggregation and vote counting processes;

[0137] Homomorphic aggregation and time-locked vote counting process

[0138] After the voting deadline, the system enters the vote counting phase. This invention uses a combination of homomorphic encryption and time-lock puzzles to achieve aggregated vote counting without decrypting individual votes, and publicly unlocks all comparison results after the vote counting is completed.

[0139] The steps of element-wise homomorphic aggregation are as follows: Assume the VoteC contract has stored a cryptographic comparison matrix from all legitimate voters. The first ciphertext part of each matrix element is denoted as The second ciphertext part is denoted as The vote-counting contract TallyC performs the following homomorphic aggregation operation on each pair of candidates (i,j): According to the additive homomorphism, the above expression corresponds to the summation of plaintext: ,Right now This indicates that all voters support " Is it superior to In this comparative relationship, Total number of votes for winning;

[0140] The time-lock decryption process involves the following steps: To prevent premature viewing of the aggregation results during the voting period, the comparison value is encapsulated in an HTLP structure. Once the vote counting phase begins, any voter can participate in the puzzle-solving process: Voters read the corresponding time-lock parameters (N, t) and the aggregation puzzle from the blockchain. The corresponding HTLP instance For each According to HTLP.Solve The algorithm execution is approximately The quadratic operation completes the time lock calculation and recovers the aggregated comparison value. Due to the unidirectional and deterministic nature of the time-lock function, this invention ensures that no participant can easily circumvent it before the end of the voting period. The vote count is obtained in advance through multiple calculations, ensuring fairness in the vote counting process. HTLP.Solve is an existing algorithm.

[0141] Condorcet Winner Decision Steps: When all After being decrypted, a global pairwise comparison matrix is ​​formed: ,matrix elements in This indicates that among all voters, The number of votes; according to the Condorcet rule, if there exists a candidate with the number w. satisfy: ,but The overall Condorcet winner is determined by this matrix. The TallyC contract or off-chain program can perform the above comparisons based on this matrix and write the final winner and related statistics back to the blockchain for public verification by everyone. For all voters to " Is it superior to In this comparative relationship The total number of votes for winning, For all voters to " Is it superior to In this comparative relationship The total number of votes for the winner.

[0142] Preferably, a duplicate voting tracking process is also included.

[0143] Duplicate voting tracking process

[0144] To prevent individual voters from taking advantage of the system's anonymity to vote twice, this invention utilizes a traceable ring signature to achieve a tracking mechanism that "deanonyms only when duplicate voting occurs."

[0145] The steps for duplicate signature detection are as follows: During the vote submission phase, the VoteC contract records certain identifiable components of the signature when verifying the ring signature. When two or more signatures matching the "from the same private key" pattern are found under the same event, the contract marks these signature pairs as objects to be traced and triggers the tracing logic of the TraceC contract.

[0146] The tracing and parsing steps are as follows: The TraceC contract calls the TRS.Trace interface to analyze two signatures that appear to originate from the same voter. , Perform calculations on its messages:

[0147]

[0148] When multiple signatures exist, they are compared one by one using the formula described above. Internally, the algorithm uses the tracking key ESK and the tracking vector in the signature structure to parse evidence of duplicate signatures on the same private key, thereby recovering the corresponding public key. The TRS.Trace interface is existing technology.

[0149] Steps to track results: When recovery is successful Then, the system can map the public key to the actual voter identity based on the voter registration list RL (the election organizer maintains this mapping relationship off-chain).

[0150] Subsequently, the election organizers can handle this duplicate voting behavior according to the pre-published rules. It is important to emphasize that in a normal vote with only one valid signature, TRS.Trace is never called, and ESK does not participate in any calculations; therefore, voter anonymity is not compromised under normal circumstances.

Claims

1. A blockchain-based traceable self-counting Condorcet voting method, characterized in that, This includes the initialization process, voter registration process, sorted ballot creation and encryption process, ballot validity proof generation process, ballot submission and on-chain verification process, and homomorphic aggregation and time-locked vote counting process. Initialization process: The election organizer generates public system parameters, sets the candidate list and event identifier, deploys smart contracts, and writes the public system parameters into the blockchain; Voter registration process: Voters generate a public-private key pair, prove the legitimacy of their public key to the election organizers through non-interactive zero-knowledge proofs, and write the verified public key into the voter registration list RL in the blockchain; Sorted ballot creation and encryption process: Voters construct an n×n pairwise comparison matrix based on candidate preferences. The matrix elements are encrypted using a homomorphic time-lock puzzle to generate an encryption comparison matrix; n is the number of candidates. The process for generating ballot validity proofs is as follows: Construct a set of non-interactive zero-knowledge proofs that includes diagonal validity proofs, Boolean validity proofs, antisymmetry constraint proofs, and row and permutation constraint proofs, and generate ballot validity proofs for the selected names; Ballot submission and on-chain verification process: Voters construct a traceable ring signature based on the voter registration list (RL), submit the encryption matrix, proof of legitimacy, and signature to the blockchain, and the smart contract verifies the proof and signature's legitimacy and stores the valid ballot; Homomorphic aggregation and time-locked vote counting process: After the voting deadline, the smart contract performs homomorphic aggregation on each element of all valid encrypted matrices. Voters obtain the global pairwise comparison matrix by performing delayed decryption through the time-lock parameter, and calculate the Condorcet vote winner.

2. The method as described in claim 1, characterized in that, The system's common parameters include bilinear group pairs. Generator Generator The strong RSA modulus N, the time parameter t, the tracking key pair (EPK, ESK), the candidate set C, and the event identifier event, where, For bilinear group pairs, It is a bilinear mapping. , .

3. The method as described in claim 2, characterized in that, Smart contracts include a registration management contract, a vote verification contract, and a vote counting contract. The registration management contract is used to maintain the voter registration list (RL). The vote verification contract is responsible for verifying non-interactive zero-knowledge proofs and traceable ring signatures. The vote counting contract is used to execute homomorphic aggregation and vote counting-related logic.

4. The method according to claim 3, characterized in that, The sorted ballot creation and encryption process includes the steps of constructing the Condorcet pairwise comparison matrix, interpreting the structural constraints of the pairwise comparison matrix, and generating the homomorphic time-locked puzzle ciphertext. The steps to construct the Condorcet pairwise comparison matrix: Voters First, determine your preference order for candidates and label it with a permutation vector. Based on this permutation vector, construct... Pairwise comparison matrix If the candidate Superior to this voter's preference ranking ,but ;on the contrary ; Let i and j be the matrix elements, and k be the candidate numbers.

5. The method according to claim 4, characterized in that, The matrix elements are encrypted using a homomorphic time-locked puzzle to generate an encrypted comparison matrix. Specifically, for each candidate... ,voter Perform the following steps: Step 1: Random number selection voter Randomly select random numbers This is used to randomize the ciphertext. The existence of random numbers ensures that the encryption results of different voters for the same comparison value are also independent of each other. Step 2: HTLP Puzzle Component Construction remember for generator, For any ,structure: This is the first part of the ciphertext, which contains the encryption key; The second part of the ciphertext encapsulates the homomorphic ciphertext part, which carries the homomorphically encrypted plaintext information; when season , At this time there is ; It is a multiplicative group modulo N The subgroup of elements whose Jacobi symbol is 1; Step 3: Combine the puzzle structure for The encryption result of the element is represented in binary form: ,voter Perform the above construction on all elements in the matrix to form the complete encryption comparison matrix: .

6. The method according to claim 5, characterized in that, The specific proofs in the set of non-interactive zero-knowledge proofs are as follows: Proof of diagonal validity: For any candidate with index 𝑖, the elements of the main diagonal of the pairwise comparison matrix satisfy 𝑖. ; Boolean validity proof: For any ≠ ... , where 1 indicates that candidate numbered 𝑖 is preferred over candidate numbered 𝑗 in voter preference, and 0 indicates that they are not preferred; Proof of antisymmetry constraint: Any candidate pair (i,j) must satisfy ; Proof of row sum permutation constraint: Compare the row sums of each row of the matrix in pairs. A candidate set must be formed. A permutation of , i.e., all rows and are distinct.

7. The method according to claim 6, characterized in that, The ballot submission and on-chain verification process includes the following steps: The steps to construct a traceable ring signature are as follows: Construct a traceable ring signature using all public keys in the voter registration list RL on the blockchain; The steps for submitting a ballot on the blockchain: Voters send a transaction to the vote verification contract; The steps for verifying ballots on the blockchain are as follows: The smart contract performs non-interactive zero-knowledge proof and traceable ring signature verification on the ballots, and detects signature duplication and event markers; The steps for storing legitimate votes will be handled by the smart contract. The relevant metadata records are stored on the blockchain.

8. The method according to claim 7, characterized in that, The homomorphic aggregation and time-locked voting process includes the steps of element-wise homomorphic aggregation, time-locked delayed decryption, and Condorcet winner decision. The steps of element-wise homomorphic aggregation are as follows: Assume the voting verification contract has stored an encrypted comparison matrix from all legitimate voters. The first ciphertext part of each matrix element is denoted as The second ciphertext part is denoted as The vote-counting contract performs the following homomorphic aggregation operation on each pair of candidates (i,j): According to the additive homomorphism, the above expression corresponds to the summation of plaintext: ,Right now This indicates that all voters support " Is it superior to In this comparative relationship The total number of votes for winning, where m is the total number of voters; The steps for decrypting a time-locked time-delay problem are as follows: Voters read the corresponding time-lock parameters (N, t) and the aggregation puzzle from the chain. The corresponding HTLP instance For each Complete the time lock calculation and recover the aggregated comparison value. ; Condorcet Winner Decision Steps: When all After being decrypted, a global pairwise comparison matrix is ​​formed: ,matrix elements in This indicates that among all voters, The number of votes; according to the Condorcet rule, if there is a candidate with the number w satisfy: ,but For the overall Condorcet winner, For all voters to " Is it superior to In this comparative relationship The total number of votes for winning, For all voters to " Is it superior to In this comparative relationship The total number of votes for the winner.

9. The method according to any one of claims 1 to 8, characterized in that, The smart contract also includes a tracking contract, which triggers tracking computation when duplicate voting is detected; The method also includes a duplicate voting tracking process: when duplicate signatures are detected in the same event domain, the public key of the duplicate voter is recovered through a traceable ring signature parsing mechanism to achieve duplicate voting tracking.

10. The method as described in claim 9, characterized in that, The duplicate voting tracking process includes steps for duplicate signature detection, tracking and parsing, and tracking results. The steps for duplicate signature detection are as follows: When the voting verification contract discovers two or more signatures from the same private key under the same event identifier, it marks these signature pairs as objects to be tracked and triggers the tracking logic of the tracking contract. The steps of the tracing and parsing process are as follows: The tracing contract calls the TRS.Trace interface, uses a signature tracing algorithm to process two signatures and their messages that are suspected to be from the same voter, and recovers the public key of the voter who voted twice. The steps to track the results are as follows: Map the public key of the duplicate voter to the actual voter identity based on the voter registration list (RL).

Images