Electronic voting method and apparatus, and storage medium and electronic device

Abstract

Provided in the present disclosure are an electronic voting method and apparatus, and a storage medium and an electronic device. The method comprises: on the basis of masked voting results published by voting parties and received initial tag values, counting masked voting results on the basis of a pre-built vote counting tree, and determining a masked counting result, and first results and intermediate tag values which are outputted by operation nodes; on the basis of a homomorphic commitment function and the intermediate tag values, generating tag commitment values, and publishing the tag commitment values, such that the voting parties publicly verify the masked counting result; and when the verification of the masked counting result is successful, decrypting the masked counting result on the basis of mask bit shares published by the voting parties, determining a final voting result, and publishing the final voting result. By means of verifying a masked counting result, the accuracy of the process of counting voting results is ensured, and when the verification of the masked counting result is successful, the masked counting result is decrypted by using mask bit shares, thereby ensuring the accuracy of a final voting result.

Description

Electronic voting method, device, storage medium and electronic equipment Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an electronic voting method, device, storage medium, and electronic device. Background Art

[0002] With the continuous development of technology, the application of electronic voting is becoming increasingly widespread. Currently, during the voting process, voters can determine the selected option based on the voting options as the voting result, and send it to the vote counter. The vote counter then determines the final voting result based on the voting results of each voter. For example, in an election, the voting options can be "agree" or "disagree". Therefore, the voting result determined by the voter based on the voting options can be either "agree" or "disagree". The final voting result determined by the vote counter based on the voting results of each voter can be the number of "agrees" and the number of "disagrees".

[0003] Furthermore, to protect voters' privacy and ensure they truly cast their ballots, the privacy of each voter's voting results must be guaranteed. This means that no one other than the voter, nor the vote counter, can access their voting results. Furthermore, the final voting results must be consistent with the wishes of each voter, ensuring the accuracy of the final voting results determined by the vote counter. Therefore, how to conduct electronic voting is a crucial issue.

[0004] Based on this, the present disclosure provides a method for electronic voting.

[0005] Summary of the Invention

[0006] The present disclosure provides an electronic voting method, device, storage medium, and electronic device.

[0007] This disclosure adopts the following technical solutions:

[0008] The present disclosure provides an electronic voting method, which is applied to a vote counting party and includes:

[0009] Determining the masked voting results published by each voting party, and receiving the initial label values ​​corresponding to the masked voting results sent by each voting party, wherein the masked voting results are processed by the voting party according to the masked bit shares generated by the voting party based on the secure multi-party computation preprocessing function;

[0010] According to each masked voting result and each initial label value, based on a pre-built counting tree, the masked voting results are counted, the masked statistical result output by the counting tree is determined, and the first result and intermediate label value output by each operation node in the plurality of operation nodes included in the counting tree are determined;

[0011] Generate a label commitment value based on the homomorphic commitment function and the intermediate label values, and publish the label commitment value and the first results, so that the voting parties can publicly verify the masked statistical results based on the label commitment value and the first results published by the vote counting party;

[0012] When the mask statistical result is verified, determining the mask bit share corresponding to the mask statistical result published by each voting party;

[0013] The masked statistical results are decrypted according to the bit shares of each mask, and the final voting results are determined and announced.

[0014] Optionally, the operation node includes a plurality of AND operation units;

[0015] Publishing the tag commitment value and each first result, specifically including:

[0016] For each AND operation unit, determine the mask voting result of the input to the AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit based on the secure multi-party computation preprocessing function;

[0017] Determining a verifiable check bit for the AND operation unit based on the determined verifiable mask bit shares of the input and output and the mask voting result;

[0018] Determining a message authentication code of the AND operation unit based on the verifiable check bit, and determining a verification code commitment value of the message authentication code based on the homomorphic commitment function;

[0019] The sum of the verification code commitment values ​​is determined to be a verification code aggregate commitment value, and the verification code aggregate commitment value, the label commitment value, and the first results are published.

[0020] Optionally, decrypting the masked statistical result according to each mask bit share to determine the final voting result specifically includes:

[0021] Determining the mask commitment value corresponding to the mask bit share announced by each voting party;

[0022] Publicly verifying each masked bit share according to each masked commitment value;

[0023] When the verification of each mask bit share is passed, the mask statistical result is decrypted according to each mask bit share to determine the final voting result.

[0024] Optionally, the masked commitment value includes an original commitment value and other commitment values;

[0025] Determining the mask commitment value corresponding to the mask bit share announced by each voting party specifically includes:

[0026] For each voting party, determine the original committed value and other committed values ​​corresponding to the masked bit share announced by the voting party, where the original committed value is the committed value determined by the voting party based on the masked bit share corresponding to the voting party, and the other committed values ​​are the committed values ​​determined by the voting party based on the masked bit shares announced by other voting parties;

[0027] Public verification of each mask bit share based on each mask commitment value includes:

[0028] determining a sum of the original commitment values ​​as a first value, and determining a sum of the other commitment values ​​as a second value;

[0029] When the first value is consistent with the second value, it is determined that the verification of each mask bit share is passed.

[0030] The present disclosure also provides an electronic voting method, which is applied to a voting party and includes:

[0031] Determine the voting results based on the voting options, and generate mask bit shares using a secure multi-party computation pre-processing function based on the topology of the vote counting tree pre-built by the vote counting party;

[0032] The voting results are processed according to the mask bit share to determine the masked voting results and publish them, and an initial label value corresponding to the masked voting results is generated and sent to the vote counting party, so that the vote counting party performs statistics on each masked voting result based on the vote counting tree according to the masked voting results published by each voting party and the received initial label value, determines the masked statistical result output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result;

[0033] Determining the label commitment value and each first result announced by the vote counting party;

[0034] Determine, based on each of the first results, the label value output by each computation node in the vote counting tree, determine, based on the homomorphic commitment function, a verification commitment value for each label value, and publish the verification commitment value;

[0035] Publicly verifying the mask statistical result according to the label commitment value and the verification commitment value;

[0036] When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit share announced by each voting party, determines and announces the final voting result.

[0037] Optionally, publicly verifying the mask statistics result according to the label commitment value and the verification commitment value specifically includes:

[0038] Determine the verification commitment values ​​announced by other voting parties as other verification commitment values;

[0039] aggregating the other verification commitment values ​​and the verification commitment value;

[0040] The mask statistics result is publicly verified according to the aggregated commitment value and the label commitment value.

[0041] Optionally, the operation node includes a plurality of AND operation units;

[0042] Publicly verify the mask statistics result based on the aggregated committed value and the label committed value, specifically including:

[0043] When the aggregated commitment value is consistent with the label commitment value, determining the masked voting results announced by the other voting parties;

[0044] For each AND operation unit, determine, based on each mask voting result and each first result, the mask voting result input to the AND operation unit, as well as the share of verifiable mask bits input to the AND operation unit and the share of verifiable mask bits output by the AND operation unit;

[0045] Determining a verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result;

[0046] Determining a message authentication code of the AND operation unit based on the verifiable check bit, and determining a verification code commitment value of the message authentication code based on the homomorphic commitment function;

[0047] Determine the sum of the verification code commitment values ​​as a verification aggregate commitment value, and publish the verification aggregate commitment value;

[0048] Determine the verification code aggregation commitment value announced by the vote counting party, and publicly verify the mask statistical result based on the verification code aggregation commitment value and the verification aggregation commitment value.

[0049] Optionally, determining a mask bit share corresponding to the mask statistical result and announcing it specifically includes:

[0050] Determining a mask bit share corresponding to the mask statistical result;

[0051] Based on the homomorphic commitment function, a masked commitment value corresponding to the masked bit share is determined and announced, so that the vote counting party publicly verifies each masked bit share according to the masked commitment value corresponding to the masked bit share announced by each voting party.

[0052] Optionally, the masked commitment value includes an original commitment value and other commitment values;

[0053] Determine, based on the homomorphic commitment function, a masked commitment value corresponding to the masked bit share and publish it, specifically including:

[0054] Determining, based on the homomorphic commitment function, a commitment value corresponding to the masked bit share as an original commitment value;

[0055] Determine the mask bit shares corresponding to the mask statistical results published by other voting parties, and determine other commitment values ​​based on the homomorphic commitment function according to the mask bit shares published by the other voting parties, and publish the mask bit shares, the original commitment value, and the other commitment values.

[0056] The present disclosure provides an electronic voting device, which is applied to a vote counting party and includes:

[0057] A first determination module is configured to determine the masked voting results announced by each voting party, and receive initial label values ​​corresponding to the masked voting results sent by each voting party, wherein the masked voting results are processed by the voting party according to the masked bit shares generated by the voting party based on a secure multi-party computation preprocessing function;

[0058] A vote counting module is configured to count the masked voting results and the initial label values ​​based on a pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and intermediate label value output by each computing node among the multiple computing nodes included in the vote counting tree;

[0059] a publishing module, configured to generate a label commitment value based on the homomorphic commitment function and the intermediate label values, and publish the label commitment value and the first results, so that the voting parties can publicly verify the masked statistical results based on the label commitment value and the first results published by the vote counting party;

[0060] A second determining module is configured to determine, when the mask statistical result is verified, the mask bit shares corresponding to the mask statistical result published by each voting party;

[0061] The decryption module is used to decrypt the mask statistical results according to the bit shares of each mask, and determine and publish the final voting results.

[0062] The present disclosure also provides an electronic voting device, which is applied to a voting party and includes:

[0063] A generation module is used to determine the voting results based on the voting options and generate mask bit shares using a secure multi-party computing pre-processing function based on the topology of the vote counting tree pre-built by the vote counting party;

[0064] A sending module is used to process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate a label value corresponding to the masked voting results, and send the label value to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result;

[0065] a determination module, configured to determine the label commitment value and each first result announced by the vote counting party;

[0066] a commitment module, configured to determine, based on the first results, the tag values ​​output by each computing unit in the vote counting tree, determine, based on the homomorphic commitment function, a verification commitment value for each tag value, and publish the verification commitment value;

[0067] A verification module, configured to publicly verify the mask statistical result based on the label commitment value and the verification commitment value;

[0068] The mask module is used to determine and announce the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party can decrypt the mask statistical result according to the mask bit share announced by each voting party, determine and announce the final voting result.

[0069] The present disclosure provides a computer-readable storage medium storing a computer program, which implements the above-mentioned electronic voting method when executed by a processor.

[0070] The present disclosure provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned electronic voting method when executing the program.

[0071] At least one of the above technical solutions adopted in the present disclosure can achieve the following beneficial effects:

[0072] The electronic voting method provided by the present disclosure determines the masked voting results announced by each voting party, and receives the initial label value corresponding to the masked voting results sent by each voting party. Afterwards, based on each masked voting result and each initial label value, based on the pre-built counting tree, each masked voting result is counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each operation node in the multiple operation nodes included in the counting tree are determined. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result based on the label commitment value and each first result announced by the counting party. Afterwards, when the masked statistical result is verified, the mask bit share corresponding to the masked statistical result announced by each voting party is determined, and the masked statistical result is decrypted according to each masked bit share, and the final voting result is determined and announced.

[0073] It can be seen from the above method that when the present invention conducts electronic voting, it determines the masked voting results announced by each voting party, and receives the initial label value corresponding to the masked voting results sent by each voting party. The masked voting result is the result after the voting party processes the voting result according to the masked bit share, so that the privacy contained in the voting result of each voting party can be protected. Afterwards, based on each masked voting result and each initial label value, based on the pre-built counting tree, each masked voting result is counted, and the masked statistical result output by the counting tree is determined, as well as the first result and the intermediate label value output by each operation node in the multiple operation nodes included in the counting tree. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party can publicly verify the masked statistical result based on the label commitment value and each first result announced by the counting party. Afterward, when the masked statistical results are verified, the masked bit shares corresponding to the masked statistical results published by each voting party are determined, and the masked statistical results are decrypted based on the respective masked bit shares. The final voting results are determined and announced. This allows the voting parties to verify the accuracy of the masked statistical results, thereby ensuring the accuracy of the vote counting process by the vote counter. When the masked statistical results are verified, the masked statistical results are decrypted using the respective masked bit shares to ensure the accuracy of the final voting results. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0075] FIG1 is a flow chart of an electronic voting method provided in an embodiment of the present disclosure.

[0076] FIG2 is a schematic diagram of a vote counting tree provided in an embodiment of the present disclosure.

[0077] FIG3 is a flow chart of another electronic voting method provided by an embodiment of the present disclosure.

[0078] FIG4 is a schematic diagram of the structure of an electronic voting device provided in an embodiment of the present disclosure.

[0079] FIG5 is a schematic diagram of the structure of another electronic voting device provided in an embodiment of the present disclosure.

[0080] FIG6 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0081] To make the objectives, technical solutions, and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present disclosure.

[0082] The technical solutions provided by various embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0083] The present disclosure provides an electronic voting method, which is applied to a vote counter. As shown in FIG1 , FIG1 is a flow chart of an electronic voting method provided by an embodiment of the present disclosure, including the following steps S100 to S108 .

[0084] S100: Determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results of the voting parties processing the voting results according to the masked bit shares, and the masked bit shares are generated by the voting parties based on the secure multi-party computing preprocessing function.

[0085] In a voting scenario, a voter determines the selected option as the voting result based on the voting options and notifies the vote counter of the voting result. The vote counter then determines and announces the final voting result based on the voting results of each voter, allowing each voter to obtain the final voting result. The voting scenario can be a scenario where a candidate is voted on or a scenario where an item is voted on, and this disclosure is not specifically limited to this. Different voting scenarios may require different voters, vote counters, voting options, and voting results. In an election scenario, a voter can be a voter or a voting device used by a voter, and a vote counter can be a vote counter used to count the votes or a vote counter's device. The voting options can be either "agree" or "disagree" with the candidate's election. A voter can select one of the two options as the voting result and notify the vote counter. The vote counter then determines and announces the final voting result based on the voting results of each voter. The final voting result can be either "agree" or "disagree," or it can be the number of "agrees" and "disagrees." The final voting result can then be used to determine whether the candidate is elected.

[0086] In a scenario evaluation, the voting parties can be department or team members or their voting devices, while the vote counters can be any member outside the department or team or the device used to count votes. Voting options include approval and rejection of the proposed solution. A proposed solution is a business plan proposed by department or team members, such as a product management plan. Voters can choose one of two options as their voting result and notify the vote counter. The vote counter then determines and announces the final voting result based on the votes of each voter. The final result can be either approval or rejection, or a number of approvals and rejections. The final voting result then determines whether the proposed solution passes. If the proposed solution passes, the business can proceed according to the proposed solution. If the proposed solution fails, the team or department members will be required to propose a new solution.

[0087] However, in the voting scenario, it is necessary to ensure the privacy of the voters and the accuracy of the final voting results determined by the vote counting party. Based on this, in electronic voting, the device used to count the votes (i.e., the voting results of each voting party), i.e., the vote counting party, can determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the vote counting party can be a system, a server, or an electronic device such as a desktop computer or a laptop computer. For ease of description, the electronic voting method provided by the present disclosure is described below with the vote counting party as the execution subject. The voting party can be the voting device used by the voter, and the voting device can be a terminal, a server, a system, etc., which is not specifically limited in the present disclosure. The masked voting result is the result after the voting party processes the voting result according to the masked bit share, and the masked bit share is generated by the voting party based on the secure multi-party computation (MPC) preprocessing function. The initial label value corresponding to the masked voting result is a bit string randomly generated by the voting party based on the masked voting result. The secure multi-party computing preprocessing function is a function in the existing secure multi-party computing library. The secure multi-party computing preprocessing function can generate the global keys of each voting party and the vote counting party based on the vote counting tree, the mask bit shares of the data input to each operation node in the vote counting tree, the mask bit shares of the data output by each operation node in the vote counting tree, the message verification code of each mask bit share that needs to be verified, and the key corresponding to each message verification code.

[0088] In order to ensure the privacy of the voters, that is, to ensure that the voting results of the voters are not disclosed, the voters can determine the voting results based on the voting options, and use the secure multi-party computing pre-processing function based on the topological structure of the counting tree pre-built by the counting party to generate the mask bit share. The voting results are then encrypted using the mask bit share to obtain the masked voting results and announce them. The voters can also generate an initial label value corresponding to the masked voting results and send the initial label value to the counting party. The counting party can subsequently determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party. Among them, the counting party can pre-announce the pre-built counting tree, so that the voters can determine the mask bit share based on the topological structure of the counting tree announced by the counting party. The initial label value can be a bit string randomly generated by the voting party based on the masked voting result. When the bit value of the masked voting result is 0, the voting party can randomly generate a K-bit bit string as the initial label value. When the bit value of the masked voting result is 1, the voting party can perform an exclusive-OR (XOR) operation on the bit string generated when the bit value is 0 with a pre-stored global key, and use the result of the XOR operation as the initial label value. K is a natural number that can be pre-set. The global key can be pre-generated by the voting party based on a secure multi-party computation preprocessing function.

[0089] S102: According to each masked voting result and each initial label value, based on a pre-constructed counting tree, the masked voting results are counted to determine the masked statistical result output by the counting tree, and the first result and intermediate label value output by each operation node among the multiple operation nodes included in the counting tree.

[0090] S104: Generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the masked statistical result based on the label commitment value and each first result published by the vote counting party.

[0091] The vote counter calculates the masked voting results and initial label values ​​based on a pre-built vote counting tree. This determines the masked statistical results output by the vote counting tree, as well as the first results and intermediate label values ​​output by each computation node. Subsequently, based on a homomorphic commitment function and the intermediate label values, a label commitment value is generated. This label commitment value and each first result are published, allowing each voter to publicly verify the masked statistical results based on the label commitment value and each first result published by the vote counter.

[0092] Among them, publishing the label commitment value and each first result is to publish the label commitment value and each first result to each voting party and a third party. The third party is a person or device other than the voting party and the vote counting party. For example, in an election scenario, the third party can be a person or device other than the candidate, the voter or the voting device, and the vote counter or the vote counting device. Since the label commitment value and each first result are open to all people or devices, in addition to the above-mentioned voting devices being able to verify the masked statistical results, a third party can also verify the masked statistical results, and this disclosure does not make specific limitations. The public verification in the following process also means that in addition to the voting party and the vote counting party being able to verify, a third party can also verify.

[0093] The vote counting tree is pre-constructed by the vote counting party based on the number of voting parties. The vote counting tree includes several operation nodes and leaf nodes. The leaf nodes in the vote counting tree represent the voting results corresponding to each voting party, and each leaf node represents the voting result of one voting party. All nodes in the vote counting tree except the leaf nodes are operation nodes, and the operation nodes are used to perform XOR operations, AND operations, etc. on the data input into the operation node. The result output by the root operation node in the vote counting tree is the final voting result after the voting results of each voting party are counted. In one embodiment, for the upstream node (i.e., the operation node) of the leaf node in the vote counting tree, the voting results of two voting parties are input into the upstream node, and for the upstream node of the upstream node, there can be four voting directions inputting data into the upstream node of the upstream node.

[0094] For example, as shown in FIG2 , FIG2 is a schematic diagram of a vote counting tree provided by an embodiment of the present disclosure. Assume that there are n voting parties performing electronic voting, namely voting party D1 to voting party D n , the input corresponding to each voting party is V1~V n , V1~V n As the leaf node of the vote counting tree. Since the vote counting process can be expressed as V1+V2+V3+V4+...+V n , can also be expressed as (V1+V2)+(V3+V4)+...+(V n-1 +V n )=[(V1+V2)+(V3+V4)]+...+(V n-1 +V n)], so at the bottom layer of the vote counting tree, every two leaf nodes can be used as the input of their upstream nodes, such as V1 and V2 of the leaf nodes as the input of the two upstream nodes, and the upstream nodes are operation nodes. In the process from the upstream nodes of the leaf nodes of the vote counting tree to the top layer, the outputs of every two operation nodes are used as the input of their upstream nodes. The nodes with "+" in the box in Figure 2 represent the operation nodes in the vote counting tree, and the operation bits of the operation nodes are increased layer by layer. The operation bit of the upstream operation node of the two leaf nodes is 1 bit, and the operation bit of the upstream operation node of the upstream operation node is 2 bits. The operation bits of the operation nodes are increased layer by layer until the root operation node. The result output by the root operation node is V1+V2+V3+V4+...+V n , the operation bits of the root operation node are log nbit.

[0095] The above-mentioned homomorphic commitment function is used to process the label value, and the label value can be processed by adding a random factor to the label value. When the label commitment value is generated based on the homomorphic commitment function and the intermediate label values, the vote counting party can determine the commitment value corresponding to each intermediate label value based on the homomorphic commitment function, and use the sum of each commitment value as the label commitment value. Of course, the vote counting party can also first determine the sum of each intermediate label value, and then determine the commitment value of the sum of each intermediate label value as the label commitment value based on the homomorphic commitment function. The label commitment value is used by the voting party to verify whether the label values ​​output by all computing nodes or computing units in the process of the vote counting party counting the voting results are correct. By verifying whether the label value is accurate, it is determined whether the mask statistical results obtained by the vote counting party based on the computing nodes or computing units are accurate.

[0096] Specifically, the vote counting party, based on each masked voting result and each initial label value, sequentially determines the masked voting result and label value of each computational node in the pre-constructed vote counting tree. Based on the masked voting result of the input computational node, the vote counting party determines the masked voting result output by the computational node as the first result, and based on the label value of the input computational node, the vote counting party determines the label value output by the computational node as the intermediate label value. The masked voting result output by the computational node is then used as the masked voting result of the computational node that is the input to the next computational node, and the label value output by the computational node is then used as the label value of the computational node that is the input to the next computational node, until the masked voting result and label value of the last computational node are determined. The masked voting result output by the last computational node is then used as the masked statistical result of the output of the vote counting tree. The vote counting party then generates a label commitment value based on the homomorphic commitment function and each intermediate label value, and publishes the label commitment value and each first result, allowing each voting party to publicly verify the masked statistical result based on the label commitment value and each first result published by the vote counting party.

[0097] Among them, the next operation node of the operation node is an operation node that uses the masked voting result and label value output by the operation node as input. When determining the masked voting result and label value input to the operation node, if the operation node is an upstream operation node of a leaf node in the vote counting tree, the masked voting result and label value input to the operation node is one of the masked voting results announced by each voting party and the initial label values ​​received. If the operation node is not an upstream operation node of a leaf node in the vote counting tree, the masked voting result and label value input to the operation node is the masked voting result and label value output by the previous operation node of the operation node.

[0098] In the present disclosure, an operation node may include an XOR operation unit, and an operation node may include one or more XOR operation units. Therefore, when each operation node includes several XOR operation units, in the above step S102, the vote counting party may determine the masked voting result and label value input to the XOR operation unit for each operation node in the vote counting tree and for each XOR operation unit in the operation node in turn based on each masked voting result and each initial label value, perform an XOR operation on the determined masked voting result, and determine the masked voting result output by the XOR operation unit as the first result. And perform an XOR operation on the determined label value, and determine the label value output by the XOR operation unit as the intermediate label value. Afterwards, the masked voting result output by the XOR operation unit is used as the masked voting result of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the masked voting result and label value output by the last XOR operation unit are determined, and the masked voting result output by the last XOR operation unit is used as the masked voting result output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node. Afterwards, the masked voting result output by the operation node is used as the masked voting result of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the masked voting result and label value output by the last operation node are determined, and the masked voting result output by the last operation node is used as the masked statistical result output by the vote counting tree.

[0099] If the XOR operation unit is the first operation unit in the operation node, the masked voting result and label value input to the XOR operation unit are the masked voting result and label value input to the operation node. If the XOR operation unit is not the first operation unit in the operation node, the masked voting result and label value input to the XOR operation unit are the masked voting result and label value output by the previous XOR operation unit.

[0100] In the present disclosure, an operation node may include an AND operation unit, and an operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, in the above step 102, the vote counting party may determine the masked voting result input to the AND operation unit for each operation node in the vote counting tree, and for each AND operation unit in the operation node in turn, based on each masked voting result and each initial label value, and determine the unit ciphertext corresponding to the AND operation unit based on the determined masked voting result. Afterwards, determine the label value input to the AND operation unit, and determine the masked voting result and label value output by the AND operation unit based on the determined label value and unit ciphertext, and use the determined masked voting result as the first result, and use the determined label value as the intermediate label value. Then, the masked voting result output by the AND operation unit is used as the masked voting result of the next AND operation unit input to the AND operation unit, and the label value output by the AND operation unit is used as the label value of the next AND operation unit input to the AND operation unit, until the masked voting result and label value output by the last AND operation unit are determined, and the masked voting result output by the last AND operation unit is used as the masked voting result output by the operation node, and the label value output by the last AND operation unit is used as the label value output by the operation node. Afterwards, the masked voting result output by the operation node is used as the masked voting result of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the masked voting result and label value output by the last operation node are determined, and the masked voting result output by the last operation node is used as the masked statistical result output by the vote counting tree.

[0101] If the AND operation unit is the first operation unit in the operation node, the masked voting result and label value input to the AND operation unit are the masked voting result and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the masked voting result and label value input to the AND operation unit are the masked voting result and label value output by the previous AND operation unit.

[0102] The above-mentioned unit ciphertext is determined by each voting party based on the vote counting tree and sent to the vote counting party. Therefore, in the above-mentioned step S100, the vote counting party can send the pre-constructed vote counting tree to each voting party, and then determine the masked voting results announced by each voting party, and receive the unit ciphertext of each AND operation unit in the vote counting tree sent by each voting party and the initial label value corresponding to the masked voting result. Among them, each voting party can generate a corresponding unit ciphertext for each AND operation unit in the vote counting tree, and when generating the unit ciphertext, it is necessary to determine the bit value of the masked voting result input to the AND operation unit, which can be 0 or 1. Since there are two masked voting results input to the AND operation unit, there are 4 combinations of the bit values ​​of the masked voting results input to the AND operation unit, namely 00, 01, 10 and 11. Each combination corresponds to a unit ciphertext, so each unit ciphertext corresponding to the operation unit can be generated based on multiple combinations, and the unit ciphertext corresponding to each combination can be generated by each voting party, that is, there are several unit ciphertexts corresponding to the operation unit.

[0103] Based on this, when determining the unit ciphertext corresponding to the operation unit based on the determined masked voting result, the vote counting party can determine the bit value combination corresponding to the masked voting result based on the determined masked voting result. Based on the determined combination, the vote counting party can determine the unit ciphertext corresponding to the operation unit from the unit ciphertexts for the operation unit sent by each voting party, that is, the number of unit ciphertexts corresponding to the operation unit. For example, voting parties D1 and D2 each send four unit ciphertexts for operation unit A to the vote counting party. These four unit ciphertexts are determined based on four combinations (i.e., 00, 01, 10, and 11). Therefore, the vote counting party can receive a total of eight unit ciphertexts for operation unit A. Assuming that the bit values ​​corresponding to the determined masked voting result are 0 and 1, respectively, the bit value combination is 01. The vote counting party can determine the unit ciphertext corresponding to combination 01 from the eight unit ciphertexts for operation unit A sent by voting parties D1 and D2. Therefore, the vote counting party can determine two unit ciphertexts corresponding to operation unit A.

[0104] When determining the masked voting result and label value output by the AND operation unit based on the determined label value and unit ciphertext, the vote counter can determine, for each unit ciphertext, the masked voting result and label value output by the AND operation unit corresponding to that unit ciphertext based on the determined label value and the unit ciphertext. The determined masked voting results are then used as the masked voting results output by the AND operation unit, and the determined label values ​​are used as the label values ​​output by the AND operation unit.

[0105] In the present disclosure, the operation node may also include several AND operation units and several XOR operation units. Therefore, in the above step S102, the vote counting party may determine the type of the operation unit for each operation node in the vote counting tree and for each operation unit in the operation node in turn according to each masked voting result and each initial label value. When the operation unit is an XOR operation unit, the masked voting result and label value output by the XOR operation unit are determined according to the above process, and the determined masked voting result is used as the first result, and the determined label value is used as the intermediate label value, which will not be repeated here. Afterwards, the determined masked voting result and label value are used as the masked voting result and label value of the next operation unit input to the XOR operation unit. When the operation unit is an AND operation unit, the masked voting result and label value output by the AND operation unit are determined according to the above process, and the determined masked voting result is used as the first result, and the determined label value is used as the intermediate label value, which will not be repeated here. Afterwards, the determined mask voting result and label value are used as the mask voting result and label value of the next operation unit of the input operation unit. The subsequent process is similar to the above process of determining the mask statistical result and label commitment value, and will not be repeated here.

[0106] Furthermore, since the masked voting results output by the XOR operation unit can be obtained by XORing the masked voting results input to the XOR operation unit, and the masked voting results of each voting party are public, that is, any party can know the masked voting results of each voting party. Therefore, when publicly verifying the masked statistical results, the counting party can only use the determined masked voting results output by each AND operation unit as the first result, and use the label values ​​output by each AND operation unit as the intermediate label values. Afterwards, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are published.

[0107] S106: When the mask statistical result is verified, determine the mask bit share corresponding to the mask statistical result published by each voting party.

[0108] S108: Decrypt the masked statistical results according to the bit shares of each mask, and determine and publish the final voting results.

[0109] When the masked statistical results are verified, the vote counter determines the masked bit shares corresponding to the masked statistical results published by each voting party. The masked statistical results are decrypted based on each masked bit share, and the final voting results are determined and announced. Each voting party sends the masked bit share corresponding to the masked statistical results to the vote counter. This masked bit share is used to decrypt the masked statistical results finally output by the vote counting tree.

[0110] Specifically, each voting party publicly verifies the masked statistical results based on the label commitment value and each first result announced by the vote counting party in the above step S104. When the masked statistical results are verified, each voting party will announce the masked bit share corresponding to the masked statistical results. The vote counting party can determine the masked bit share announced by each voting party, and decrypt the masked statistical results according to each masked bit share, determine the final voting results, and announce the final voting results. Among them, each masked bit share is a key generated by the voting party for the masked statistical results output by the vote counting tree, and the vote counting party can decrypt the masked statistical results output by the vote counting tree according to each masked bit share.

[0111] Furthermore, to ensure the accuracy of the masked bit shares announced by each voting party, the voting party can determine and publish the masked commitment value corresponding to the masked bit share based on a homomorphic commitment function. The vote counter determines the masked commitment value corresponding to each masked bit share announced by each voting party and publicly verifies each masked bit share based on the masked commitment value. When each masked bit share passes verification, the masked statistics are decrypted based on the masked bit share to determine the final voting result, which is then announced.

[0112] The masked commitment value announced by each voting party includes the original commitment value and other commitment values. Therefore, when determining the masked commitment value corresponding to the masked bit share announced by each voting party, the vote counter may determine, for each voting party, the original commitment value and other commitment values ​​corresponding to the masked bit share announced by the voting party, where the original commitment value is the commitment value determined by the voting party based on the masked bit share corresponding to the voting party, and the other commitment values ​​are the commitment values ​​determined by the voting party based on the masked bit shares announced by other voting parties. Other voting parties are voting parties other than the voting party.

[0113] Based on this, when publicly verifying each masked bit share based on each masked commitment value, the vote counter can determine the sum of each original commitment value as a first value, and determine the sum of each other commitment value as a second value. When the first value and the second value are consistent, the verification of each masked bit share is determined to have passed. When the first value and the second value are inconsistent, the verification of each masked bit share is determined to have failed, and the vote counter will announce the verification failure.

[0114] When decrypting the masked statistical results according to the bit shares of each mask and determining the final voting result, the following formula (1) can be used for calculation:

[0115] Among them, z w represents the final voting result, z′ w Indicates the mask statistics result, represents the exclusive OR operation, Indicates voting party D i The share of each mask bit sent, where n represents the number of voters.

[0116] It can be seen from the above method that when the present disclosure conducts electronic voting, the vote counting party can determine the masked voting results announced by each voting party and receive the initial label value corresponding to the masked voting results sent by each voting party. The masked voting result is the result after the voting party processes the voting result according to the masked bit share, so that the privacy contained in the voting result of each voting party can be protected. Afterwards, based on each masked voting result and each initial label value, based on the pre-built vote counting tree, each masked voting result is counted, and the masked statistical result output by the vote counting tree is determined, as well as the first result and intermediate label value output by each operation node in the multiple operation nodes included in the vote counting tree. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result based on the label commitment value and each first result announced by the vote counting party, thereby ensuring the accuracy of the process of the vote counting party counting the voting results, that is, ensuring the accuracy of the masked statistical result determined by the vote counting party. The vote counter only knows the masked statistical results and not the specific voting results of each voter, thus protecting the privacy of the voters. This also speeds up the calculation of voting results and reduces time costs. Furthermore, when publicly verifying the masked statistical results, third parties, in addition to the individual voters, can also verify them, further ensuring the accuracy of the masked statistical results. Subsequently, when the masked statistical results pass verification, the corresponding masked bit shares published by each voting party are determined, and the masked statistical results are decrypted based on each masked bit share. The final voting results are determined and announced. This allows the vote counter to decrypt the masked statistical results using each masked bit share when the masked statistical results pass verification, ensuring the accuracy of the final voting results.

[0117] Furthermore, to ensure the accuracy of the masked bit shares announced by each voting party, the vote counter can verify each masked bit share based on the masked commitment value corresponding to each masked bit share announced by each voting party. If each masked bit share passes verification, the vote counter uses the masked bit share to decrypt the masked statistical results, determine, and announce the final voting results. This prevents voting parties from announcing incorrect masked bit shares, ensuring the accuracy of the final voting results.

[0118] In the present disclosure, in addition to determining whether the mask statistics are accurate by verifying whether the label value is accurate, it is also possible to further determine whether the mask statistics are accurate by verifying the mask voting results output by the operation node or operation unit. Therefore, when the label commitment and each first result are announced in the above step S104, the vote counting party can also determine the mask voting result input to the AND operation unit for each AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit based on the secure multi-party computing preprocessing function. Based on the determined verifiable mask bit share of the input and output, and the mask voting result, the verifiable check bit of the AND operation unit is determined. Based on the verifiable check bit, the message authentication code of the AND operation unit is determined, and based on the homomorphic commitment function, the authentication code commitment value of the message authentication code is determined. Afterwards, the sum of the authentication code commitment values ​​is determined to be the authentication code aggregate commitment value, and the authentication code aggregate commitment value, each first result and the label commitment value are announced. The verifiable masked bit shares include the masked bit shares, the message authentication code corresponding to the masked bit shares, and the key for the message authentication code corresponding to the masked bit shares of other voters, where other voters are voters other than the voting party itself. The aggregated commitment value of the authentication code is used by each voting party to publicly verify the accuracy of the masked voting results output by the computing node or computing unit.

[0119] When determining the verifiable check bit of the AND operation unit based on the determined verifiable mask bit share of the input and output and the mask voting result, the following formulas (2) to (3) can be used for calculation:

[0120] in, as well as d represents the three parameters in the triplet corresponding to the operation unit determined by the vote counter T based on the secure multi-party computation preprocessing function. The three parameters can be 0 or any three values. γ and e γ It can be any preset value or directly set to 0. represents the verifiable check bit of the AND operation unit determined by the vote counter T, z′ α and z′ β Indicates the voting results of the two masks input to the AND operation unit, as well as represents the two verifiable mask bit shares of the input to the AND operation unit determined by the vote counter T, It represents the share of verifiable mask bits output by the AND operation unit determined by the vote counter T.

[0121] Since the verifiable check bits are obtained through the above calculation, the verifiable check bits include the message verification code corresponding to the check bits. The vote counter can directly determine the message verification code of the operation unit from the verifiable check bits corresponding to the operation unit, that is, the message verification code corresponding to the check bits. Subsequently, based on the homomorphic commitment function, the verification code commitment value of the message verification code is determined. After that, the sum of the verification code commitment values ​​is determined to be the verification code aggregate commitment value, which can be expressed as in, It represents the message verification code of the operation unit w determined by the vote counter T, W represents the set of operation units, and Com(x) represents the homomorphic commitment function.

[0122] In step S102, when determining the masked voting result and label value output by the AND operation unit based on the determined label value and unit ciphertext, the vote counter can determine, for each unit ciphertext, the masked voting result to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code output by the AND operation unit (i.e., the message verification code corresponding to the masked voting result to be verified output by the AND operation unit) based on the determined label value and the unit ciphertext. A key for the message verification code output by the AND operation unit, generated based on the secure multi-party computation preprocessing function, is then determined. Based on the key and the masked voting result to be verified output by the AND operation unit, calculations are performed to determine a first calculation result. Thereafter, a determination is made as to whether each first calculation result is consistent with the message verification code corresponding to each masked voting result to be verified (i.e., the message verification code output by each AND operation unit). If so, each masked voting result to be verified is used as the masked voting result output by the AND operation unit. If not, the voting party corresponding to the masked voting result to be verified that failed verification is determined, and a verification failure message is sent to the determined voting party.

[0123] When determining the mask voting result to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code output by the AND operation unit based on the determined label value and the unit ciphertext, the following formula (4) can be used for calculation:

[0124] in, Indicates voting party D i The unit ciphertext corresponding to the operation unit sent to the vote counter, t = z' α , z′ α Indicates the mask voting result input to the AND operation unit, s = z' β , z′ β Indicates the mask voting result input to the AND operation unit, Indicates the label value input to the AND operation unit. Indicates the label value input to the AND operation unit. Indicates the mask voting result to be verified output by the AND operation unit, Indicates the masked voting results to be verified The corresponding message verification code, that is, the message verification code output by the AND operation unit, Indicates the intermediate label value output by the AND operation unit. Indicates voting party D i Other identified voting parties D j The message verification code of the masked voting result to be verified is determined by the counting party based on the determined label value and the unit ciphertext. Indicates voting party D i Other voting parties D stored j The key of the message authentication code of the masked voting result to be verified output by the AND operation unit is determined, Indicates other voting parties D j The mask voting result to be verified output by the determined AND operation unit, Δ i Indicates voting party D i The global key of Represents the label value output by the AND operation unit. H(x) represents the hash function, γ represents the output of the AND operation unit, and s and t represent the two inputs of the AND operation unit respectively.

[0125] In the present disclosure, other voting parties can determine the initial label value of the masked voting result based on the masked voting result announced by the voting party and send it to the vote counting party. This initial label value is a K-bit bit string randomly generated by the other voting parties based on the masked voting result. Therefore, each masked voting result announced by each voting party corresponds to an initial label value generated by multiple voting parties. Therefore, in the above step S100, the vote counting party can receive the initial label values ​​corresponding to each masked voting result sent by each voting party.

[0126] Based on this, in the above step S102, the vote counting party can count each masked voting result based on the pre-constructed vote counting tree according to each masked voting result and each initial label value corresponding to each masked voting result, and determine the masked statistical result output by the vote counting tree. The specific process is similar to the above process in which each masked voting result corresponds to an initial label value, except that each masked voting result corresponds to multiple initial label values, and the label value output by each XOR operation unit and each AND operation unit is a set containing multiple label values. The specific process will not be repeated here.

[0127] In the present disclosure, when the vote counter announces the label commitment value and each first result, it can send the label commitment value and each first result to the bulletin board so that each voting party and third party can know the label commitment value and each first result. Of course, when the vote counter announces other content, such as the verification code aggregate commitment value, it can also send the content to be announced to the bulletin board, and this disclosure does not make any specific restrictions.

[0128] The present disclosure further provides an electronic voting method, which is applied to a voter. FIG3 is a flow chart of another electronic voting method provided by an embodiment of the present disclosure, and the method includes the following steps S200 to S210.

[0129] S200: Determine the voting result according to the voting options, and generate the mask bit share by using the secure multi-party computing pre-processing function according to the topology of the counting tree pre-built by the counting party.

[0130] S202: Process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate an initial label value corresponding to the masked voting results, and send the initial label value to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received initial label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and generates a label commitment value based on the homomorphic commitment function and each intermediate label value, and publishes the label commitment value and each first result.

[0131] In order to protect the privacy contained in the voting results, the voting party can first determine the voting results based on the voting options, and use the secure multi-party computing pre-processing function to generate a mask bit share based on the topological structure of the counting tree pre-constructed by the counting party. Then, based on the mask bit share, the voting results are processed to determine the masked voting results and announce them, and the initial label value corresponding to the masked voting results is generated, and the initial label value is sent to the counting party. Among them, the counting tree is constructed by the counting party according to the number of each voting party. The voting results are determined by the voting party based on the voting options. Different voting scenarios and different voting options will result in different voting results. Of course, the voting parties are also different. The specific voting parties and voting results in different voting scenarios can be what kind of data as described in the above step S100, which will not be repeated here. The secure multi-party computing pre-processing function is a function in the existing secure multi-party computing library. The initial label value corresponding to the masked voting result can be a label value randomly generated by the voting party based on the masked voting result.

[0132] Specifically, the voting party can determine the voting result based on the voting options, and use a secure multi-party computing preprocessing function based on the topological structure of the counting tree announced by the counting party to generate a mask bit share, and then process the voting result based on the mask bit share to determine the masked voting result, and generate an initial label value corresponding to the masked voting result. The masked voting result is announced, and the initial label value is sent to the counting party. The counting party is enabled to count each masked voting result based on the counting tree according to the masked voting results announced by each voting party and the received initial label value, determine the masked statistical result output by the counting tree, and determine the first result and intermediate label value output by each operation node among the multiple operation nodes included in the counting tree, and generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and announce the label commitment value and each first result.

[0133] In the present disclosure, an operation node may include an AND operation unit, and an operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, when sending the initial label value to the vote counting party, the voting party needs to send the unit ciphertext corresponding to the AND operation unit in the vote counting tree to the vote counting party in addition to sending the initial label value corresponding to the masked voting result to the vote counting party. Therefore, the voting party can determine the verifiable mask bit share and label value input to the AND operation unit for each operation node in the vote counting tree, and for each AND operation unit in the operation node in turn, and use a secure multi-party computing preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit. Then, based on the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, determine the unit ciphertext corresponding to the AND operation unit. Then, the unit ciphertext corresponding to each operation unit in the vote counting tree and the initial label value corresponding to the masked voting result are sent to the vote counting party.

[0134] If the operation node is an upstream operation node of a leaf node in the vote counting tree, the verifiable masked bit share input to the operation node is generated by the voting party using the secure multi-party computation preprocessing function, and the label value input to the operation node is a K-bit bit string randomly generated by the voting party or the result of an XOR operation between a randomly generated K-bit bit string and a global key, that is, the initial label value. If the operation node is not an upstream operation node of a leaf node in the vote counting tree, the verifiable masked bit share and label value input to the operation node are the verifiable masked bit share and label value output by the previous operation node of the operation node.

[0135] If the AND operation unit is the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit.

[0136] In addition, when the previous operation unit of the AND operation unit is an AND operation unit, a secure multi-party computing preprocessing function is used to determine the verifiable mask bit share output by the previous operation unit of the AND operation unit, and use it as the verifiable mask bit share of the input AND operation unit, and determine the label value output by the previous operation unit of the AND operation unit, and use it as the label value of the input AND operation unit. Of course, in the present disclosure, the operation node can also include several XOR operation units, so when the previous operation unit of the AND operation unit is an XOR operation unit, determine the verifiable mask bit share and label value of the previous operation unit (i.e., XOR operation unit) input to the AND operation unit, perform XOR operation on the determined verifiable mask bit share, and use the result after the operation as the verifiable mask bit share output by the XOR operation unit, and perform XOR operation on the determined label value, and use the result after the operation as the label value output by the XOR operation unit. The verifiable mask bit share and label value output by the above-mentioned XOR operation unit are used as the verifiable mask bit share and label value of the input AND operation unit.

[0137] When determining the unit ciphertext corresponding to the AND operation unit based on the triple, the share of verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, the voting party may determine the first value based on the first value in the triple and the first share of verifiable mask bits input to the AND operation unit, and determine the second value based on the second value in the triple and the second share of verifiable mask bits input to the AND operation unit. Specifically, the following formulas (5) to (6) may be used for calculation:

[0138] The triplet is three parameters generated by the secure multi-party computation preprocessing function, which includes the first value, the second value and the third value, i.e., the voting party D i The first value, the second value and the third value determined by the AND operation unit are respectively as well as The verifiable mask bit share input to the AND operation unit includes the first verifiable mask bit share and the second verifiable mask bit share, that is, the voting party D i The first verifiable mask bit share and the second verifiable mask bit share determined to be input to the AND operation unit are respectively as well as When the AND operation unit is the first operation unit of the operation node, and the operation node is the upstream operation node of the leaf node in the vote counting tree, as well as Both can be generated by the voting party based on a secure multi-party computing function, or can be 0, which is not specifically limited in this disclosure. Indicates voting party D i The first value determined, Indicates voting party D i The second value is determined.

[0139] above as well as When it is not 0, it can be expressed by the following formula (7):

[0140] in, Indicates voting party D i The generated verifiable mask bit share of the input operation node or the AND operation unit, Indicates voting party D i The generated mask bit share, express The corresponding message verification code, Indicates other voting parties D j The generated key corresponds to the message authentication code input into the operation node or the mask bit share of the operation unit.

[0141] Then, the first value and the second value are sent to other voting parties. The other voting parties are the voting parties that belong to the computing node together with the voting party, that is, the other voting parties are the voting parties that input data to the computing node except the voting party (that is, the above-mentioned voting party D i , that is, the voting party other than the voting party that is the executing party). Receive the third value and the fourth value sent by other voting parties, aggregate the received third value and the first value to determine the first total value, and aggregate the received fourth value and the second value to determine the second total value. Specifically, the following formulas (8) to (9) can be used for calculation:

[0142] Among them, d γ Indicates voting party D iThe first total value determined, n represents the number of voting parties, Indicates voting party D i The first value determined, Indicates voting party D n The third value is determined and sent to the voting party D i ,The first and third values ​​are determined in a similar way, except that they are determined locally by different voting parties. γ Indicates voting party D i The second total value determined, Indicates voting party D i The second value is determined. Indicates voting party D n The fourth value is determined and the third value is sent to the voting party D i ,The process of determining the second and fourth values ​​is similar, except that they are determined locally by different voting parties.

[0143] Afterwards, the mask voting result to be verified output by the AND operation unit is determined based on the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit. Specifically, the following formulas (10) to (11) can be used for calculation:

[0144] in, Indicates voting party D i The mask voting result to be verified output by the determined AND operation unit, Indicates voting party D i The determined share of the verifiable mask bits output by the AND operation unit is the share of the verifiable mask bits output by the AND operation unit for voting party D. i Generated by secure multi-party computation preprocessing function, t, s are bit values, each t, ​​s∈{0,1}.

[0145] Afterwards, the unit ciphertext corresponding to the AND operation unit is determined based on the mask voting result to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit. Specifically, the following formula (12) can be used for calculation:

[0146] in, Indicates voting party D i The unit ciphertext corresponding to the operation unit is determined. Since t can be 0 or 1, and s can be 0 or 1, there are 4 combinations of t and s. Each combination corresponds to a unit ciphertext, so there are 4 unit ciphertexts corresponding to the operation unit. := is the assignment symbol. Indicates voting party D i When the determined bit value is t, the label value of the AND operation unit is input. Indicates voting party D i When the determined bit value is t, the label value of the AND operation unit is input, and γ represents the output of the AND operation unit. The message verification code representing the mask voting result to be verified output by the AND operation unit, Indicates voting party D i When the determined bit value is 0, the label value output by the AND operation unit, Δ i Indicates voting party D i The global key of Indicates voting party D i Other voting parties D stored j The determined key corresponds to the message authentication code of the masked voting result to be verified output by the operation unit.

[0147] If the AND operation unit is the first operation unit in the operation node, and the operation node is the upstream operation node of the leaf node in the vote counting tree, the above and Both are voting party D i A randomly generated K-bit bit string, where the bit values ​​are t and s respectively.

[0148] In the present disclosure, since the masked voting results of a voting party are announced to all other voting parties (i.e., voting parties other than the voting party), the other voting parties can determine the initial label value corresponding to the masked voting results based on the masked voting results announced by the voting party, and send it to the vote counting party. The initial label value is a K-bit bit string randomly generated by the other voting parties based on the bit value of the masked voting results. The specific process is similar to the process of generating the initial label value in step S202 above, and will not be repeated here. Based on this, the vote counting party can receive the initial label values ​​corresponding to the masked voting results sent by each voting party.

[0149] S204: Determine the label commitment value and each first result published by the vote counting party.

[0150] S206: Determine the label value output by each operation node in the vote counting tree based on the first results, determine the verification commitment value of each label value based on the homomorphic commitment function, and publish the verification commitment value.

[0151] S208: Publicly verify the mask statistics result according to the label commitment value and the verification commitment value.

[0152] The voting party determines the label commitment value and each first result announced by the vote counting party, determines the label value output by each operation node in the vote counting tree based on each first result, and determines the verification commitment value of each label value based on the homomorphic commitment function, and announces the verification commitment value. Afterwards, the masked statistical results are publicly verified based on the label commitment value and the verification commitment value. Among them, the vote counting tree includes a number of operation nodes. When determining the label value output by each operation node in the vote counting tree based on each first result, since each first result is the masked voting result output by each operation node in the vote counting tree, the voting party can determine the masked voting results announced by other voting parties, and calculate the masked statistical results output by the vote counting tree according to each operation node in the vote counting tree based on the masked voting results determined in the above step S202, the masked voting results of other voting parties, and each first result, and determine the label value output by each operation node in the vote counting tree.

[0153] When determining the verification commitment value for each tag value based on the homomorphic commitment function, the voting party may first aggregate the tag values ​​and then, based on the homomorphic commitment function, determine the commitment value of the aggregated tag values ​​as the verification commitment value. The voting party may also first determine the commitment value corresponding to each tag value based on the homomorphic commitment function and use the result of aggregating the commitment values ​​as the verification commitment value, although this disclosure does not impose any specific limitations thereon.

[0154] In the present disclosure, the operation node may also include several XOR operation units and several AND operation units, so the label values ​​corresponding to the above-mentioned verification commitment values ​​are the label values ​​output by each operation unit. In addition, since the masked voting result output by the XOR operation unit can be obtained by performing an XOR operation on the masked voting result input to the XOR operation unit, and the masked voting result of each voting party is announced, that is, any party can know the masked voting result of each voting party, so when publicly verifying the masked statistical results, the counting party can only use the determined masked voting results output by each AND operation unit as the first result, and determine the label commitment value corresponding to the label value output by each AND operation unit, and announce the label commitment value and each first result. Correspondingly, the voting party can also only determine the verification commitment value corresponding to the label value output by each AND operation unit, and announce it. The verification commitment value can be specifically expressed as in, Indicates voting party D i The determined label value output by the AND operation unit w, where W represents the AND operation unit set.

[0155] In the above step S208, the voting party can determine the verification commitment values ​​announced by other voting parties as other verification commitment values, aggregate the other verification commitment values ​​and the verification commitment values, and then publicly verify the mask statistics results based on the aggregated verification commitment values ​​and the tag commitment values. The aggregated verification commitment value can be expressed as: Here, n represents the number of voting parties.

[0156] When the above-mentioned mask statistics result is publicly verified based on the aggregated verification commitment value and the label commitment value, when the aggregated verification commitment value is consistent with the label commitment value, it means that the mask statistics result verification has passed. When it is established, it means that the mask statistical result verification has passed. When the aggregated verification commitment value is inconsistent with the label commitment value or the above formula does not hold, it means that the mask statistical result verification has failed, and the voting party announces the message that the mask statistical result verification has failed. Indicates the label commitment value announced by the vote counter.

[0157] In addition to verifying the accuracy of the masked statistics by verifying the accuracy of the tag values, the accuracy of the masked statistics can also be further determined by verifying the masked voting results output by the operation nodes or operation units. Therefore, when the masked statistics are publicly verified based on the aggregated verification commitment value and the tag commitment value, when the aggregated verification commitment value is consistent with the tag commitment value, the masked voting results announced by other voting parties are determined. Subsequently, for each AND operation unit, based on each masked voting result and each first result, the masked voting result input to the AND operation unit is determined, as well as the verifiable masked bit share input to the AND operation unit and the verifiable masked bit share output by the AND operation unit are determined. Then, based on the determined verifiable masked bit shares of the input and output, and the masked voting result, the verifiable check bit of the AND operation unit is determined. Then, based on the verifiable check bit, the message authentication code of the AND operation unit is determined, and the verification code commitment value of the message authentication code is determined based on the homomorphic commitment function. Then, the sum of the verification code commitment values ​​is determined as the verification aggregate commitment value, and the verification aggregate commitment value is announced. Then, the verification code aggregate commitment value announced by the vote counting party is determined, and the masked statistical results are publicly verified based on the verification code aggregate commitment value and the verification aggregate commitment value. The verifiable check bit of the AND operation unit is determined based on the determined input and output verifiable mask bit shares and the masked voting results, and can be calculated using the following formula (13):

[0158] in, Indicates voting party D i The verifiable check bit of the determined AND operation unit, z′ α and z′ β Indicates voting party D i Determine the two mask voting results of the input and operation unit, as well as Indicates voting party D iDetermine the two verifiable mask bit shares of the input to the AND operation unit, Indicates voting party D i The determined share of verifiable mask bits output by the AND operation unit.

[0159] Since the verifiable check bits are obtained through the above calculation, the verifiable check bits include the message authentication code corresponding to the check bits. The voting party can directly determine the message authentication code of the AND operation unit from the verifiable check bits corresponding to the AND operation unit, that is, the message authentication code corresponding to the check bits. Subsequently, based on the homomorphic commitment function, the authentication code commitment value of the message authentication code is determined, and then the sum of the authentication code commitment values ​​is determined as the verification aggregate commitment value. The verification aggregate commitment value can be expressed as in, Indicates voting party D i The message authentication code of the AND operation unit w is determined, where W represents the set of AND operation units and Com(x) represents the homomorphic commitment function.

[0160] When publicly verifying the masked statistical results based on the verification code aggregate commitment value and the verification aggregate commitment value, the voting party can determine the verification aggregate commitment value announced by other voting parties, aggregate the verification aggregate commitment values ​​of other voting parties and the above-determined verification aggregate commitment value, and publicly verify the masked statistical results based on the aggregated verification commitment value and the verification code aggregate commitment value. The aggregated verification commitment value can be expressed as When the aggregated verification commitment value is consistent with the verification code aggregate commitment value, it means that the mask statistics result verification is passed, that is, If the result is true, the masked statistical result verification has passed. If the aggregated verification commitment value is inconsistent with the verification code aggregate commitment value or the above formula does not hold, the masked statistical result verification has failed, and the voting party will announce the failure of the masked statistical result verification.

[0161] S210: When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit share announced by each voting party, determines and announces the final voting result.

[0162] When the masked statistical result is verified, the voting party determines the masked bit share corresponding to the masked statistical result and announces it, so that the counting party decrypts the masked statistical result according to the masked bit share announced by each voting party, determines the final voting result, and announces the final voting result.

[0163] In order to ensure the accuracy of the masked bit shares announced by each voting party, when the masked statistical results are verified, the voting party can determine the masked bit shares corresponding to the masked statistical results, determine the masked commitment values ​​corresponding to the masked bit shares based on the homomorphic commitment function, and announce them, so that the counting party can publicly verify each masked bit share based on the masked commitment values ​​corresponding to the masked bit shares announced by each voting party. When each masked bit share is verified, the counting party decrypts the masked statistical results based on each masked bit share, determines and announces the final voting results. Among them, the mask commitment value is used to verify whether the mask bit share is accurate. The mask commitment value includes the original commitment value and other commitment values. Therefore, when the mask commitment value corresponding to the mask bit share is determined based on the homomorphic commitment function and announced, the voting party can determine the commitment value corresponding to the mask bit share as the original commitment value based on the homomorphic commitment function, determine the mask bit share corresponding to the mask statistical result announced by other voting parties, and determine other commitment values ​​based on the homomorphic commitment function based on the mask bit share announced by other voting parties, and announce the mask bit share, original commitment value and other commitment values. The counting party determines that the sum of the original commitment values ​​is the first value and the sum of the other commitment values ​​is the second value based on the original commitment values ​​and other commitment values ​​announced by each voting party. When the first value is consistent with the second value, it is determined that the verification of each mask bit share has passed.

[0164] In this disclosure, when a voter announces masked voting results, they may post the masked voting results to a bulletin board, allowing other voters, vote counters, and third parties to learn of the masked voting results. Of course, when a voter announces other content, such as verification commitment values, verification aggregate commitment values, and masked commitment values, they may also post the content to the bulletin board, and this disclosure does not impose any specific limitations.

[0165] The above is the electronic voting method provided by the present disclosure. Based on the same idea, the present disclosure also provides an electronic voting device, which is applied to the vote counting party, as shown in Figure 4.

[0166] FIG4 is a schematic diagram of the structure of an electronic voting device provided by an embodiment of the present disclosure, including:

[0167] A first determination module 300 is configured to determine the masked voting results announced by each voting party, and receive label values ​​corresponding to the masked voting results sent by each voting party, wherein the masked voting results are processed by the voting party according to the masked bit shares generated by the voting party based on the secure multi-party computation preprocessing function;

[0168] A vote counting module 302 is configured to count the masked voting results and the initial label values ​​based on a pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and intermediate label value output by each of the multiple computing nodes included in the vote counting tree;

[0169] A publishing module 304 is configured to generate a label commitment value based on the homomorphic commitment function and the intermediate label values, and publish the label commitment value and the first results, so that the voting parties can publicly verify the masked statistical results based on the label commitment value and the first results published by the vote counting party;

[0170] A second determining module 306 is configured to determine, when the mask statistical result is verified, the mask bit share corresponding to the mask statistical result published by each voting party;

[0171] The decryption module 308 is configured to decrypt the masked statistical results according to the bit shares of each mask, and determine and publish the final voting results.

[0172] Optionally, the operation node includes a plurality of AND operation units;

[0173] The publication module 304 is specifically used to determine, for each AND operation unit, the mask voting result of the input to the AND operation unit, and based on the secure multi-party computing preprocessing function, determine the verifiable mask bit share of the input to the AND operation unit and the verifiable mask bit share of the output of the AND operation unit; determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output, and the mask voting result; determine the message authentication code of the AND operation unit according to the verifiable check bit, and determine the authentication code commitment value of the message authentication code based on the homomorphic commitment function; determine the sum of the authentication code commitment values ​​as the authentication code aggregate commitment value, and publish the authentication code aggregate commitment value, the label commitment value and the first results.

[0174] Optionally, the decryption module 308 is specifically used to determine the mask commitment value corresponding to the mask bit share announced by each voting party; publicly verify the mask bit share according to each mask commitment value; when the verification of each mask bit share is passed, decrypt the mask statistical result according to the mask bit share to determine the final voting result.

[0175] Optionally, the masked commitment value includes an original commitment value and other commitment values;

[0176] The decryption module 308 is specifically used to determine, for each voting party, the original commitment value and other commitment values ​​corresponding to the mask bit share announced by the voting party, wherein the original commitment value is the commitment value determined by the voting party based on the mask bit share corresponding to the voting party, and the other commitment values ​​are the commitment values ​​determined by the voting party based on the mask bit shares announced by other voting parties; determine the sum of the original commitment values ​​as a first value, and determine the sum of the other commitment values ​​as a second value; when the first value is consistent with the second value, determine that the verification of the mask bit shares has passed.

[0177] The present disclosure also provides an electronic voting device, which is applied to a voter, as shown in FIG5 .

[0178] FIG5 is a schematic diagram of the structure of another electronic voting device provided by an embodiment of the present disclosure, including:

[0179] A generation module 400 is configured to determine the voting result based on the voting options and generate a mask bit share using a secure multi-party computation pre-processing function based on the topology of the vote counting tree pre-constructed by the vote counting party;

[0180] A sending module 402 is configured to process the voting result according to the mask bit share, determine the masked voting result, publish it, generate an initial label value corresponding to the masked voting result, and send the initial label value to the vote counting party, so that the vote counting party performs statistics on each masked voting result based on the vote counting tree according to the masked voting results published by each voting party and the received initial label value, determines the masked statistical result output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, generates a label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result;

[0181] Determination module 404, configured to determine the label commitment value and each first result published by the vote counting party;

[0182] Commitment module 406, configured to determine the tag value output by each operation unit in the vote counting tree based on the first results, determine a verification commitment value for each tag value based on a homomorphic commitment function, and publish the verification commitment value;

[0183] A verification module 408, configured to publicly verify the mask statistical result according to the label commitment value and the verification commitment value;

[0184] The mask module 410 is used to determine and announce the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party can decrypt the mask statistical result according to the mask bit share announced by each voting party, determine and announce the final voting result.

[0185] Optionally, the verification module 408 is specifically used to determine the verification commitment values ​​announced by other voting parties as other verification commitment values; aggregate the other verification commitment values ​​and the verification commitment value; and publicly verify the mask statistical results based on the aggregated verification commitment value and the label commitment value.

[0186] Optionally, the operation node includes a plurality of AND operation units;

[0187] The verification module 408 is specifically used to, when the aggregated verification commitment value is consistent with the label commitment value, determine the mask voting results announced by the other voting parties; for each AND operation unit, determine the mask voting result input to the AND operation unit according to each mask voting result and the first results, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit; determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit share of the input and output, and the mask voting result; determine the message verification code of the AND operation unit according to the verifiable check bit, and determine the verification code commitment value of the message verification code based on the homomorphic commitment function; determine the sum of each verification code commitment value as the verification aggregate commitment value, and announce the verification aggregate commitment value; determine the verification code aggregate commitment value announced by the vote counting party, and publicly verify the mask statistical result according to the verification code aggregate commitment value and the verification aggregate commitment value.

[0188] Optionally, the mask module 410 is specifically used to determine the mask bit share corresponding to the mask statistical result; based on the homomorphic commitment function, determine the mask commitment value corresponding to the mask bit share, and publish it, so that the vote counting party can publicly verify each mask bit share according to the mask commitment value corresponding to the mask bit share published by each voting party.

[0189] Optionally, the masked commitment value includes an original commitment value and other commitment values;

[0190] The mask module 410 is specifically used to determine, based on the homomorphic commitment function, that the commitment value corresponding to the mask bit share is the original commitment value; determine the mask bit share corresponding to the mask statistical result announced by other voting parties, and determine other commitment values ​​based on the homomorphic commitment function according to the mask bit share announced by the other voting parties, and announce the mask bit share, the original commitment value and the other commitment values.

[0191] The present disclosure also provides a computer-readable storage medium storing a computer program, which implements the above-mentioned electronic voting method when executed by a processor.

[0192] This disclosure also provides an electronic device. As shown in Figure 6, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile storage, and may also include other hardware required for its operation. The processor reads the corresponding computer program from the non-volatile storage into the memory and then executes it to implement the aforementioned electronic voting method.

[0193] Of course, in addition to software implementation, this disclosure does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0194] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0195] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0196] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0197] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0198] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0199] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0200] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0201] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0202] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0203] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0204] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change RAM (PRAM), static random-access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape and disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. According to the definition in this article, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0205] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0206] The present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0207] The various embodiments of this disclosure are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0208] The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A method of electronic voting, characterized in that: The method is applied to a vote counting party, and the method comprises: Determine the masked voting results published by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function; According to each masked voting result and each initial label value, based on a pre-constructed counting tree, the masked voting results are counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each computing node among the multiple computing nodes included in the counting tree are determined; Based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result announced by the vote counting party; When the mask statistical result is verified, determining the mask bit shares corresponding to the mask statistical result published by each voting party; The masked statistical results are decrypted according to the bit shares of each mask, and the final voting results are determined and announced.

2. The method according to claim 1, characterized in that The computing node includes a plurality of AND computing units; The label commitment value and each first result are announced, including: For each AND unit, Determine the mask voting result input to the AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit based on the secure multi-party computation preprocessing function; Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result; Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function; The sum of the verification code commitment values ​​is determined to be the verification code aggregate commitment value, and the verification code aggregate commitment value, the label commitment value and the first results are published.

3. The method according to claim 1, characterized in that The masked statistical result is decrypted according to each mask bit share to determine the final voting result, including: Determining the mask commitment value corresponding to the mask bit share announced by each voting party; Publicly verifying each mask bit share according to each mask commitment value; When the verification of each mask bit share is passed, the mask statistical result is decrypted according to each mask bit share to determine the final voting result.

4. The method according to claim 3, characterized in that The masked commitment value includes the original commitment value and other commitment values; Determining the mask commitment value corresponding to the mask bit share announced by each voting party includes: For each voting party, determine the original commitment value and other commitment values ​​corresponding to the mask bit share announced by the voting party, wherein the original commitment value is the commitment value determined by the voting party based on the mask bit share corresponding to the voting party, and the other commitment values ​​are the commitment values ​​determined by the voting party based on the mask bit shares announced by other voting parties; According to each mask commitment value, each mask bit share is publicly verified, including: determining a sum of the original commitment values ​​as a first value, and determining a sum of the other commitment values ​​as a second value; When the first value is consistent with the second value, it is determined that the verification of each mask bit share is passed.

5. A method of electronic voting, characterized in that: The method is applied to a voting party, and the method comprises: Determine the voting result according to the voting options, and generate the mask bit share using the secure multi-party computing pre-processing function based on the topology of the counting tree pre-built by the counting party; According to the mask bit share, the voting result is processed to determine the masked voting result and publish it, and an initial label value corresponding to the masked voting result is generated and sent to the vote counting party. The vote counting party counts the masked voting results published by each voting party and the received initial label value based on the vote counting tree, determines the masked statistical results output by the vote counting tree, and determines the first result and the intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, generates a label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and the first results; Determine the label commitment value and each first result published by the vote counting party; Determine the label value output by each computing node in the vote counting tree according to each of the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value; Publicly verifying the mask statistical result according to the label commitment value and the verification commitment value; When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit shares announced by each voting party, determines and announces the final voting result.

6. The method according to claim 5, characterized in that The publicly verifying the mask statistical result according to the label commitment value and the verification commitment value includes: Determine the verification commitment values ​​announced by other voting parties as other verification commitment values; Aggregating the other verification commitment values ​​and the verification commitment value; The mask statistics result is publicly verified according to the aggregated verification commitment value and the label commitment value.

7. The method according to claim 6, characterized in that The computing node includes a plurality of AND computing units; The publicly verifying the mask statistical result according to the aggregated verification commitment value and the label commitment value includes: When the aggregated verification commitment value is consistent with the label commitment value, determining the masked voting results announced by the other voting parties; For each AND unit, Determine the mask voting result input to the AND operation unit, and determine the share of verifiable mask bits input to the AND operation unit and the share of verifiable mask bits output by the AND operation unit according to each mask voting result and each first result; Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result; Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function; Determine the sum of the verification code commitment values ​​as the verification aggregate commitment value, and publish the verification aggregate commitment value; Determine the verification code aggregate commitment value announced by the vote counting party, and publicly verify the mask statistical result based on the verification code aggregate commitment value and the verification aggregate commitment value.

8. The method according to claim 5, characterized in that Determining the mask bit share corresponding to the mask statistical result and publishing it, including: Determining a mask bit share corresponding to the mask statistical result; Based on the homomorphic commitment function, the mask commitment value corresponding to the mask bit share is determined and announced, so that the vote counting party can publicly verify the mask bit shares according to the mask commitment value corresponding to the mask bit share announced by each voting party.

9. The method according to claim 8, characterized in that The masked commitment value includes the original commitment value and other commitment values; The determining, based on the homomorphic commitment function, a mask commitment value corresponding to the mask bit share and announcing the same comprises: Based on the homomorphic commitment function, determining that the commitment value corresponding to the masked bit share is an original commitment value; Determine the mask bit shares corresponding to the mask statistical results published by other voting parties, and determine other commitment values ​​based on the mask bit shares published by other voting parties and based on the homomorphic commitment function, and publish the mask bit shares, the original commitment value and the other commitment values.

10. An electronic voting device, characterized in that: The device is applied to a vote counting party, and comprises: A first determination module is used to determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function; A vote counting module is used to count the masked voting results and the initial label values ​​based on a pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and the intermediate label value output by each computing node among the multiple computing nodes included in the vote counting tree; A publishing module, used to generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the mask statistical result according to the label commitment value and each first result published by the vote counting party; A second determination module is used to determine the mask bit shares corresponding to the mask statistical result published by each voting party when the mask statistical result is verified; The decryption module is used to decrypt the mask statistical results according to the bit shares of each mask, and determine and publish the final voting results.

11. An electronic voting device, characterized in that: The device is applied to a voting party, and comprises: A generation module is used to determine the voting result according to the voting options, and generate the mask bit share according to the topological structure of the counting tree pre-built by the counting party by using a secure multi-party computing pre-processing function; A sending module, used to process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate a label value corresponding to the masked voting results, and send the label value to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result; A determination module, used to determine the label commitment value and each first result published by the vote counting party; A commitment module, used to determine the label value output by each operation unit in the vote counting tree according to the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value; A verification module, used for publicly verifying the mask statistical result according to the label commitment value and the verification commitment value; The mask module is used to determine and announce the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party decrypts the mask statistical result according to the mask bit share announced by each voting party, determines and announces the final voting result.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images