JP2833427B2 - Electronic voting system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION The present invention proposes a system for minimizing the contents of own voting leaked to a center when an objection is filed in an electronic voting in which a voter can object to fraudulent counting. The purpose is to:

[0002]

The Ota's method has been conventionally known as an electronic voting method. This is disclosed in Japanese Unexamined Patent Publication No. 1-177164 and in the 1988 Spring Meeting of the Institute of Electronics, Information and Communication Engineers A-294, "Electronic voting method using a single election manager." In this method, a voter obtains a blind signature of an election manager for his or her voting sentence, and then sends it to the center by anonymous vote, thereby realizing anonymous voting. Each voter confirms that his / her vote has been accepted and counted in the list of voting contents announced by the center. Here, the blind signature means that, after obtaining the signature of the center for the voting content converted by random numbers, the voter creates the center's signature for the original voting content after removing the random number component.

In Ota's method, the center's signature can be obtained only for the voting content reflecting his / her opinion.
If the center does not count the voting content, it must disclose its voting content and file an appeal.

[0004] In order to solve this problem, even in the case of opposition, in order for a voter to make an opposition without disclosing his / her own voting content, a blind signature is obtained in advance only from a tag vote which does not depend on the voting content. Japanese Patent Application Nos. Hei 4-108069 and Hei 4-108069 send a tag vote with a signature and a voting sentence reflecting own opinion to the center.
No. 222580 and Japanese Patent Application No. 4-292854. In these methods, the election manager publishes a list of accepted voting statements and tag votes. If the user's own voting sentence is not accepted, the tag slip is disclosed to appeal that there is a legitimate tag vote not accepted.

[0005]

[Means for Solving the Problems] Japanese Patent Application No. 4-108069.
No., Japanese Patent Application No. 4-222580 and Japanese Patent Application No. 4-2928
In No. 54, the center has a problem that the contents of the vote of the opponent may be found in some cases. For example, it is assumed that the set of voting sentences received by the center and the set of published voting sentences are different due to the intention or mistake of the center. At this time, if the tag vote released by the opponent is included in the set of received voting sentences, the center determines that the voting sentence sent with the tag vote is the content of the opponent's vote. Recognize.

According to the present invention, there is provided a system which does not leak information which specifies the content of a vote of an opponent by an opposition even if the difference between the set of voting sentences received by the center and the set of received voting sentences is known. suggest.

[0007]

An electronic voting system according to a first aspect of the present invention is an electronic voting system for voting between a plurality of voting devices and an election management device using cryptography. A voting sentence generating means for generating a voting sentence, a signature generating means for generating an undeniable signature for the voting sentence, and a voting means for transmitting a voting sentence with a blind signature by anonymous. a blind signature generating means for performing the blind signature for,
Signature publishing means for publishing the undeniable signature;
An electronic voting system comprising: a vote publishing unit that publishes all accepted voting sentences.

[0008] The electronic voting system of the second invention is characterized in that, in the first invention, the vote publishing means publishes a voting sentence encrypted with a public key that has been made public in advance.

[0009]

EXAMPLES Next, describes the embodiments Nitsu of the first, and second invention with reference to FIGS.

As shown in FIG. 2, the electronic voting system of the present invention is constructed by m voter subsystems 101 (1) to 101 (101).
(M) and one election management center 100 are connected to each other by a secure communication channel (for example, data line) 105, and can be used either in a registered or unregistered form. , An electronic bulletin board 102 that can be read by all voter subsystems
An example will be described in which the present invention is applied to an anonymous electronic voting system in the case where a voting exists. For the sake of simplicity, the election management center will be referred to as the center, and the voter subsystem will be referred to as the voter.

This voting system includes a preparation phase, a signature generation phase, a voting phase, and a result publication phase.

The first invention relates to a signature generation phase, and the second invention relates to a result publication phase.

First, the preparation phase of the first invention will be described with reference to FIG.

As preparation for implementing the anonymous electronic voting system, the center 100 sets a constant for signature,
The constant is posted on the electronic bulletin board 102. For example, using the RSA encryption as a blind signature method,
Fujioka, which was announced at the 1992 Cryptography and Information Security Symposium as a signature (hereinafter abbreviated as U-signature) method.
The Okamoto-Ota method is used. Therefore, prime n _c two p _c, the product of q _c, the e _c and _{d c e c · d c =} 1
An integer satisfying mod (p _c -1) (q _c -1).
Next, p is a prime number, and g is g ⁱ modp (i = 1,
2,. . . Let p-1) be constants that all have different values. At this time, the center sets e _c , n _c , p, and g as constants. (Step 11). These constants are written on the electronic bulletin board 102 (step 12). This constant e
_c, n _c, p, g so frequently used to allow write easy access to their constant holding means 201 (Step 13). On the other hand, d _c is stored in the own secret information holding means 202 (Step 14).

Next, the center 100 determines rules regarding voting. First, identify the agenda items to be voted on. Next, for example, the following can be considered as a voting format. Concatenated opinion x and random number y

[0016]

And its hash value

[0018]

What is obtained by connecting

[0020]

Is a voting sentence v. In this case, v is assumed is less than n _c as a value. The opinion x may be an option number given in advance, or a sentence described in a free form replaced with an ASCII character string (step 15).

Next, the names of subsystems having the right to vote (hereinafter referred to as voters) are listed (step 16). The deadlines for the signature generation and voting phases are set and announced (step 17), and the start of the signature generation phase is signaled (step 18).

The above is the preparation phase.

Next, the signature generation phase and the voting phase will be described.
Follows the same procedure for each voter, so the description will be continued with the procedure for a specific voter and subsystem 101 (i) as an example.

As shown in FIG. 1, the secret electronic voting system includes a secure communication channel 103 in which a center 100 writes constants and voting rules on an electronic bulletin board 102, and a voter 101.
(I) is composed of a secure communication channel 104 (i) for reading out the content written on the electronic bulletin board 102 and a secure communication channel 105 (i) for communicating between the voter and the sensor.

First, the voter 101 will be described with reference to FIG.
The (i) signature creation phase will be described.

The voter 101 (i) reads out the contents written on the bulletin board 102 by using the bulletin board reading means 301, stores the constants e _c , n _c , p, and g in the constant holding means 302, while reading it out. A voting sentence v that conforms to the format is created by the voting sentence creator 310. That is,
According to the voting format, a voting v reflecting the voting content x of the user is generated as follows.

[0028]

Here, the random number component y is the output of the generator 303.

Next, the voting sentence converter 304 uses the output r of the random number generator 303 and the constants e _c and n _c to calculate

[0031]

, And outputs a converted voting sentence s. The output r of the random number generator 303 at this time is stored in the random number holder 309.

Next, to generate a signature u corresponding to v in U signature generation unit 312 as described below, using the output k of the generator 303, a u ₁ = g ^k modp as u _1, as u ₂ , U ₂ = v ^k modp, and u = (u ₁ , u ₂ ).

The named communication means 305 transmits s and u to the center 100 via the secure channel 105 (i).

The center 100 receives the converted voting sentence s and the U signature u received from the valid voters received by the U signature receiving means 206.

The blind signature generator 204 uses d _c and n _c read from the secret holding means 201 and the constant holding means 202 to obtain

[0037]

Is calculated and output. The blind signature transmitting means 205 transmits D to the voter 101 (i).

The center 100 transmits the received U signature u together with the name of the voter 101 (i) to the U signature publicizing means 203.
The center declares that it will move to the voting phase if it sends a blind signature to all voters who have created a U-signature to be published in. The above is the signature generation phase.

Next, the voting phase will be described.

The signature converting means 306 uses D received from the center 100 by the blind signature receiving means 311 and e _c and n _c read from the constant holding means 302.

[0042]

It is verified whether or not the above holds. If it is confirmed, by using the integer r read from the random retainer 309, a n _c read out from the constant hold means 302, calculates the T = D / rmodn _c.

Note that T is the public key e _c , n _{c of the} center.
Is a signature sentence of the voting sentence v that can be verified. That is,

[0045]

Has become. Obtaining a signature for the converted voting sentence and obtaining the signature of v without displaying the voting sentence v itself to the center is called a blind signature, and a series of voting sentence converters 304, blind signature generator 204, and signature converting means Reference numeral 306 denotes a voting statement authentication unit.

The anonymous transmission means 308 sends the voting text T with the signature of the center obtained by the voting text authentication means to the center 100 without adding the sender name.

The center 100 uses the received T

[0049]

Is calculated. α is equal to v if the voter has not cheated. If α is the format of a predetermined tag, x is extracted from this, and this is totaled.

When the voting of all members is completed, the center publishes the result. That is, a list of all voting sentences is posted on the bulletin board. Each voter can look at the list to see if their votes have been counted. If not, you can use the objection method described below to indicate that your ballot is missing, and at this time other voters will know what they voted for Never.

The method of appeal will be described. Suppose that the voter 101 (i) filed an objection. At this time, the center 100 determines the U signature u = (u ₁ , u) of the voter 101 (i).
Since u ₂ ) has been received in advance by the U-signature receiving means 206, the following protocol is performed based on this. Hereinafter, the voter 101 (i) will be referred to as a claimant.

The claimant indicates that none of the published acceptance voting statements correspond to his U-signature. Therefore, a set of published acceptance voting sentences is set as v _j (j = 1, 2,...), And the following is performed for each v _j .

The sovereign generates a random number a from the random number generator,

[0055]

Is created and sent to the center.

The center arbitrarily selects 0 or 1 as h,
Reply to the sovereign.

The sovereign replies f = a + h · k.

The center is

[0060]

It is checked whether or not the above holds. When h is 0, both hold, and when h is 1,

[0062]

Only the above should hold. The above protocol is repeated a predetermined number of times (for example, 20 times) using different a and h for each v _j .

If all v _j can be confirmed as expected, the center regards the opponent's claim as correct. That is, the center admits that the opponent's voting statement was disclosed and leaked.

The correctness of this protocol is described in the document “Interactive Bi-Proof and Unable Signature Method”.
(Fujioka, Okamoto, and Ota, 1991 Cryptography and Information Security Symposium Lecture Book 2B).

By doing so, it is possible to prove to the other voters what the opponent has voted for and to prove that their own votes have not been counted. In addition, even the center, which may have a set of voting texts that have not been tabulated, does not know which of the opponent's voting texts.

Next, an embodiment of the second invention will be described with reference to FIG.

In the preparation phase, the embodiment of the first invention is performed in the same manner as in the preparation phase. In step 11, the center further generates RSA encryption keys n ₂ , e ₂ and d ₂ , and in step 12, the public key is generated. In addition to posting e ₂ and n ₂ , it is added in step 13 that d ₂ is to be written into its own constant holding means 201.

The U-signature generation phase is performed in the same manner as in the first embodiment, except that the bulletin board reading means 313 reads and stores e ₂ and n ₂ .

The voting phase is performed in the same manner as in the embodiment of the first invention, except that a voting sentence encrypting means 307 having the output V of the signature converting means 306 as an input in the voting phase is provided. In this voting sentence encrypting means, the voting sentence V is encrypted as follows. N read from the constant holding means 302
₂ and e ₂ ,

[0071]

The anonymous transmission means 408 sends V ′ to the center 100 without adding the sender name.

The center 100 uses the received V ′ in the reception slip verification means 417.

[0074]

Is calculated. α is equal to v if the voter has not cheated. If α is a predetermined voting sentence format, verify that this and the voting sentence have been used before. If not used, x is extracted from this, and this is totaled.

As a publicizing means, the encrypted V '
May be posted to verify whether or not their own voting sentences have been counted. Further, when an opponent appears, the encryption of all voting sentences may be decrypted and the opposition protocol may be executed as in the first embodiment.

In the above-described second embodiment, the voter sends a voting sentence that has been encrypted in advance, but the voter sends the voting sentence without encryption as in the first embodiment, and the center 100 sends it. Each voting sentence may be encrypted and made public together with the public keys e ₂ and n ₂ . At this time, each voter has only to confirm whether or not the voting texts sent by himself / herself are encrypted by e ₂ and n ₂ .

Referring to FIG. 4, the system described in any of the embodiments includes a terminal unit (TMU) 401 such as a personal computer having a communication processing function, a read-only storage device (ROM) 402, and a random access storage device. Device (RAM) 403, (RNG) 404, signal processor (SP) 406, TMU 401, ROM 40
2, a common bus 405 interconnecting the RAM 403, the RNG 404, and the SP 406.

The RNG 404 generates a random number in accordance with an instruction from the SP 406. This is used when the center 100 sets a constant, and the random number generator of each voter 101 (i) is 303
Used as In the case of the center 100,
It becomes the constant holding unit 202 or the secret information holding unit 201. The secret information may be stored in the RAM as needed from the TMU. In the case of the voter subsystem 101 (i), the ROM 407 includes a constant holding unit 302, a random number holding unit 309, and the like. The above operation is realized based on a program stored in the ROM. RAM403
Is used to temporarily store the results of the calculations during the execution of these steps.
01 (i) is a data processing device such as a general-purpose electronic calculator or an IC
It may be a card.

[0080]

As described in detail above, according to the present invention, a voter can open an objection to fraudulent counting without knowing what he / she has voted for. In addition, an electronic voting system that minimizes the amount of information leaked from the voting content to the center can be realized. In this electronic voting system, it is not necessary to determine options in advance, and the present invention can be easily applied to a free-form questionnaire.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of an electronic voting system of the first invention.

FIG. 2 is a diagram showing a secret electronic voting system.

FIG. 3 shows an example of a preparation phase.

FIG. 4 is an example of a system used in an embodiment of the present invention (a diagram showing a configuration of a center 100 and a voter subsystem 101 (i)).

FIG. 5 is a block diagram showing one embodiment of an electronic voting system of the second invention.

[Explanation of symbols]

 100 Election Management Center 101 (i) Voter Subsystem 102 Electronic Bulletin Board

Continuation of the front page (56) References JP-A-1-177164 (JP, A) Proceedings of the 1992 IEICE Autumn Conference, (Heisei 4) p. 1-191 "Practical and secure secret ballot method" Proceedings of the 1991 IEICE Spring Conference, (Heisei 3) p. 1-291 "Interactive bi-illumination method and Unable signature method" (58) Fields investigated (Int. Cl. ⁶ , DB name) G06F 19/00 G09C 1/00 660 JICST file (JOIS)

Claims (2)

(57) [Claims] 1. An electronic voting system for voting between a plurality of voting devices and an election management device using cryptography, wherein the voting device comprises: a voting sentence generating means for creating a voting sentence;
Signature to generate Andersson Nai Abul signature on the voting statement
Generating means, and voting means for transmitting a voting sentence with a blind signature in anonymous manner, wherein the election management device publishes the blind signature generating means for performing the blind signature on the voting sentence, and the undenialable signature An electronic voting system comprising a signature publishing unit and a vote publishing unit for publishing all accepted voting sentences. 2. The electronic voting system according to claim 1, wherein the vote publishing unit publishes a voting sentence encrypted with a public key that has been made public in advance.