JP3534599B2 - Encryption communication method, electronic voting system, and IC card - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention uses a cipher communication method using a public key system for voting processing (ticketing / refunding processing, the same applies hereinafter) in public competitions such as horse racing, bicycle racing, and boat racing. The present invention relates to an electronic voting system that performs automatically and electronically.

[0002]

2. Description of the Related Art A conventional electronic voting system for electronically voting for public competitions is provided with a plurality of voting machines for issuing voting tickets made of paper or magnetic media, and a refund of winnings to the purchaser of the voting tickets. And a center host connected to each voting machine and refund machine via a communication line,
After issuing a voting ticket that records voting data such as expected winning numbers on a voting machine, if the winning voting ticket is brought in by the purchaser, check whether the voting ticket is genuine and make a regular vote. In the case of a ticket, a predetermined refund process is performed.

Whether or not the voting ticket is authentic is confirmed as follows. First, when a voting ticket is issued by a voting machine, voting data is recorded on each voting ticket together with voting data, and the recorded data is notified to the center host. On the center host side, voting data and voting ticket ID are recorded by online processing, batch processing, or the like. When the winning money is to be refunded after the competition is over, the voting data recorded on the voting ticket and the voting ticket ID are transmitted from the refunding machine to the center host. On the side of the center host, this voting data is compared with the voting ticket ID and the recorded content previously notified, and if the two match, it is determined that the voting ticket is authentic,
We try to allow refund of winnings.

[0004]

In the case of public competitions, for example, the minimum amount of voting is 100 yen, and the voting ticket is usually discarded for each competition, so the production cost of each voting ticket is one. It is kept at around 10 yen. Therefore, the conventional electronic voting system uses paper or magnetic media for the voting ticket. However, with such a voting ticket, it is difficult to take strong counterfeiting / alteration measures, and it is also impossible to authenticate the recipient or to prevent falsification of voting data when making a refund. . Therefore, the conventional electronic voting system has a risk of causing a crime that exploits such low security of the voting ticket.

Therefore, an object of the present invention is to provide a data security technique suitable for application to or in an electronic voting system.

[0006]

In order to solve the above problems, the present invention provides a cryptographic communication method for ensuring the security of voting data by using a public key system, and an electronic voting system suitable for implementing this cryptographic communication method. , And IC cards are provided.

The electronic voting system of the present invention comprises a card system in which a voting card having an electronic data recording area is used as a recording medium for unique data and predetermined voting data, and a center host for performing predetermined processing relating to voting. Consists of The card system is recorded in any one of the voting card and a key holding means for holding a card ID, a card private key unique to each voting card, and a host public key unique to the center host for each voting card issued. The voting data that was encrypted is encrypted with the card private key of the voting card to generate encrypted voting data.
An encryption unit that encrypts the set of voting data before encryption and the card ID with the host public key to generate encrypted transmission data, and a unit that transmits the generated encrypted transmission data to the center host. I have. An IC card is preferably used as the voting card so that it can be used repeatedly.

On the other hand, the center host can freely read its own host private key, the card ID of the voting card notified when the voting card was issued, and a plurality of card public keys associated with the card ID. A card management unit that holds the data; a first unit that decrypts the encrypted transmission data received from the card system with the host secret key to decrypt the voting data, the encrypted voting data, and a card ID; and the decrypted card ID. Second means for obtaining the public key of the corresponding voting card from the key holding means as a search key, and decrypting the decrypted encrypted voting data using the obtained card public key, and the voting data obtained by this decryption and the voting data. A third means for collating the voting data decrypted by the first means and a voting process relating to the voting data when the collation result is valid. Preferably provided and oriented data processing means.

Preferably, the second means collates the card ID decrypted by the first means with the card ID already held, and when the two match, the card ID concerned is matched.
Is used as the search key.

Then, the encryption communication method is executed between the card system and the center host in the following process. (1) The card system encrypts the voting data recorded on the voting card with the card secret key, and the encrypted voting data obtained by this is used together with the voting data before encryption and the card ID of the voting card. A process of encrypting with the host public key and transmitting the encrypted transmission data obtained thereby to the center host, (2) The center host receiving the encrypted transmission data,
This encrypted transmission data is decrypted with its own host private key, the card public key of the voting card is retrieved using the card ID obtained thereby as the search key, and the encrypted voting data is decrypted with the retrieved card public key. At the same time, when the voting data obtained by the decryption and the voting data before the encryption match, the process of holding the combination of the voting data and the card public key retrieved as the subsequent communication partner information. As a result, it is possible to prevent falsification of the voting data addressed to the center host from the card system. When performing a subsequent process such as a refund, the following process is further executed. (3) A process in which the card system transmits the voting data recorded on the voting card to the center host, (4) The center host which has received the voting data is already held based on the voting data. The communication partner information being specified is specified, arbitrary authentication data is generated when the voting data included in the specified communication partner information and the received voting data match, and this authentication data is held and addressed to the card system. (5) The card system receiving the authentication data encrypts the authentication data with the card private key, and transmits the encrypted authentication data obtained thereby to the center host. ) The center host that received the encryption authentication data
This encrypted authentication data is decrypted with the card public key included in the communication partner information, and when the authentication data obtained thereby and the held authentication data match, the voting process based on the voting data is executed. process. This allows for the refund of the voting card to the legitimate holder.

As a more preferable form, the card system is configured such that at least the recording area of the voting data in the data recording area of the voting card is initialized every time the voting processing is completed, and The card system or the center host is provided with voting history management means for holding the history of the completed voting process for each voting card.

The IC card of the present invention is read by a voting machine that performs mutual communication with a center host that performs predetermined processing related to voting via a communication line, and functions as a reusable voting card. In order to temporarily record the key area in which the card ID unique to the own card, the card private key, and the host public key unique to the center host are recorded, and the voting data input through the voting machine is recorded. The IC chip is provided with a data area and an encryption means for performing encryption based on the data recorded in the key area and the data area and outputting the encryption result to the center host.

The encryption means encrypts the voting data recorded in the data area with the card secret key to generate the encrypted voting data, and the encryption voting data,
The set of voting data before encryption and the card ID is encrypted with the host public key to generate encrypted transmission data. The authentication data input from the center host through the voting machine is encrypted with the card private key to generate encrypted authentication data.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram of an electronic voting system in which the present invention is applied to electronic voting in public competition. This electronic voting system 1 is an IC card (hereinafter, a voting card) 10 that functions as a voting ticket for a conventional system.
And a plurality of voting machines 20 that also function as a refund machine while issuing a voting card 10 in which voting data is written
And the voting card 1 through the communication line L and each voting machine 20
0 and a center host 30 that performs encrypted communication with each other.

The voting card 10 is not a one-time disposable card, but can be reused repeatedly by a card holder who is a voter. The voting card 10 has at least an I / O port 12 in the IC chip 11,
CPU13, ROM14, RAM15, EEPROM1
6 is formed.

The CPU 12 is a logical operation processor for performing cryptographic operations and input / output control. The ROM 14 has a CPU 1
The program read and executed by the program 2 is stored. The RAM 15 is a work area used by the CPU 12, and the EEPROM 16 stores voting data and a card private key and a host public key used for encryption / decryption processing.

In FIG. 2, the voting card 10 is created by the CPU 12 reading and executing the program in the ROM 14.
FIG. 3 is a diagram showing a configuration of functional blocks formed in (IC chip 11) and a memory map in EEPROM 16. In the present embodiment, at least the voting card 10
A main control unit 111, a memory control unit 112 that controls recording and reproduction of data in the EEPROM 16, an encryption processing unit 113 that encrypts target data, and a decryption that decrypts input encrypted data. A functional block of the data processing unit 114 and a data input / output unit 115 for inputting voting data and outputting data to the center host 30 is formed. Further, in the EEPROM 16, an ID storage area 16 for storing a card ID for identifying the own card
1. Voting ticket number storage area 162 for storing the voting ticket number for identifying the vote for each competition, voting value storage area 163 for storing the voting value, Kis storage for storing the card secret key Kis An area 164 and a Kcp storage area 165 for storing the host public key Kcp are formed.

FIG. 3 is a block diagram of the voting machine 20. The voting machine 20 constitutes a card system together with the voting card 10, and the card issuing mechanism 21 for issuing the voting card 10 accommodates the issued voting card 10 and performs data input / output with the IC chip 11. Reader / writer mechanism 2
2. Data input mechanism 2 for inputting voting data, etc.
3. Communication mechanism 2 for mutual communication with the center host 30
4. A refund mechanism 25 is provided for paying the winning money upon receipt of a refund notice from the center host 30. Known mechanisms can be used for these mechanisms.

FIG. 4 is a block diagram of the center host 30. The center host 30 is realized by a computer device, and a known communication mechanism (not shown) for performing mutual communication with the voting machine 20 and, for example, data formed in the internal storage device of the computer device. Storage memory 3
1 and a memory control unit 3 formed by the computer device reading and executing a predetermined program.
2, functional blocks of a data processing unit 33, an encryption processing unit 34, a decryption processing unit 35, a random number generation unit 36, and a data input / output unit 37. The data storage memory 31 stores at least an ID storage area 311 for storing the card ID of the voting card 10, a Kcs storage area 312 for storing its own host secret key Kcs, and a Kip storage for storing the card public key Kip. An area 313 and a T-data storage area 314 for storing voting data T-data described later are formed.

The memory control unit 32 receives the card ID of each voting card 10 input through the data processing unit 33,
The card public key Kip and voting data T-data are stored in a predetermined area of the data storage memory 31, and these data and its own host secret key Kcs are read from the storage area and output to the data processing unit 33. Is. When the card public key Kip and the card ID are stored, they are linked and stored so that the card public key Kip can be searched using the card ID as a search key. At this time, if the Kip storage area 313 is configured so that the card ID can be immediately specified in the Kip storage area 313, the ID storage area 311 does not necessarily have to be provided.

The encryption processing unit 34 is for encrypting data and the like addressed to the voting card 10 by the public key method, and the decryption processing unit 35 is for decoding data from the voting card 10. The random number generation unit 36 randomly generates a random number used as authentication data in response to a request from the data processing unit 33. The data input / output unit 37 inputs and outputs data and the like to and from the communication mechanism.

Next, the operation of the electronic voting system 1 configured as described above will be described with reference to the sequence charts of FIGS. In each sequence chart, C, T, and H are the voting card 10 and voting machine 2, respectively.
0, the processing steps in the center host 30 are shown.

First, the processing procedure when the voting card 10 is issued will be described with reference to FIG. This processing is performed mainly by the voting machine 20. That is, when the voting machine 20 issues the voting card 10 by the card issuing mechanism 21 (T01),
A unique card ID, a card secret key Kis, and a host public key Kcp are given to each voting card 10 (T02).
The voting card 10 stores the card ID in the ID storage area 161 and the card secret key Kis in the Kis storage area 16
2 and the host public key Kcp is stored in the Kcp storage area 163. Storage of these keys is performed through the memory control unit 112. The voting machine 20 also uses the card ID of the issued voting card 10 and the voting card 10
Notifies the center host 30 of the card public key Kip of
02). Upon receiving the notification of the card ID and the card public key Kip, the center host 30 stores the card public key Kip in the Kip storage area 313 and the card ID in the ID storage area 311. At this time, the card ID and the card public key Kip are linked through the memory control unit 32, and the public key Kip of the voting card 10 is used by using the card ID as a search key.
(H01).

Next, the process when the voter votes will be described with reference to FIG. Voter is the voting data for each competition T-
The data, that is, the voting ticket number for identifying the competition and the expected winning number which is the voting value are input through the data input mechanism 23 of the voting machine 20 (T11). The voting machine 20 transfers this voting data T-data to the voting card 10 (T1
2).

The voting card 10 is an EEPROM for the voting ticket number in the transferred voting data T-data.
The number 16 is stored in the voting ticket number storage area 164, and the expected winning number is stored in the voting value information storage area 165 (C
11). The voting card 10 also has a Kis storage area 162.
The voting data T-data (which may be a hash value) is encrypted by using the card secret key Kis of No. 1 to generate encrypted voting data T-data '(C12). Further, the host public key Kcp in the Kcp storage area 163 is used to encrypt the voting data T-data, the encrypted voting data T-data ', and the card ID, and the encrypted transmission data E
-data is generated (C13). Then, the encrypted transmission data E-data is output to the voting machine 20. The voting machine 20 transfers this encrypted transmission data E-data to the center host 30 (T13).

The encrypted transmission data E-data is the center host 30.
When the host secret key Kcs of the Kcs storage area 312 is reached, the center host 30 first arrives at the encrypted transmission data Ed.
The voting data T-data, the encrypted voting data T-data ', and the card ID are decrypted from ata (H11), and the card public key Kip is retrieved using the restored card ID as a search key (H12). Then, the encrypted voting data T-data 'is decrypted using this card public key Kip (H13), and the voting data T-data obtained thereby is decrypted first (H11).
Collation with the voting data T-data is performed (H14). When the two match (H15: Yes), it is determined that the voting is legally performed, and the voting data T-data is stored in the T-data storage area 31.
Store in 4 (H16). On the other hand, if the voting data T-data do not match (H15: No), it can be determined that data tampering with the voting card 10 or other abnormal situation has occurred, and the voting data T-data is discarded (H17). In this way, only normal voting data T-data is accepted.

Next, the process for the refund by the voter will be described with reference to FIG. The voter sets the voting card 10 storing the winning vote data T-data in the voting machine 20 (T21). Taking this opportunity, the voting card 10
The voting data T-data is read (C12) and output to the voting machine 20 (C22). The voting machine 20 transfers this voting data T-data to the center host 30 (T22).

The center host 30 receives the voting data T-data, and then, based on the received voting data T-data,
T-data storage area 31 of the center host 30 at the time of voting
The voting data T-data stored in 4 and the card public key Kip corresponding to this voting data T-data are read (H
21). And first, the voting data T- from the voting machine 20
The data is collated with the already stored voting data T-data (H22). If the voting data T-data match (H
23: Yes), the random number r generated by the random number generation unit 36 is transmitted to the voting card 10 side and stored in a memory means (not shown) (H24). The voting machine 20 transfers the random number r to the voting card 10 (T23). The voting card 10 that has received the random number r encrypts the random number r using the card secret key Kis in the Kis storage area 164, generates an encrypted random number r ′, and outputs it to the voting machine 20 (C23). Voting machine 20
Transfers the encrypted random number r ′ to the center host 30 (T24).

The center host 30 which received the encrypted random number r '
Decrypts the encrypted random number r'using the card public key Kip in the Kip storage area 313 (H25). Then, the decrypted random number (encrypted random number r ′ → random number r) is collated with the stored random number r (H26), and when both match (H27:
Yes), it is determined that the refund request from the voting card 10 is valid, that is, the voter who requested the refund and the voting card 10 are valid, and the refund process is executed (H28). At this time, if the voting value is the value actually won, the voting machine 20 is notified of that fact and the winning money is paid to the voter. On the other hand, when the voting data T-data do not match (H23: No), or when the random number r does not match (H23:
27: No), it can be considered that the voting card 10 has been altered, or data has been tampered with in the process of communication, so the refund processing for the voting card is interrupted (H2
9).

At the end of the refund process, the voting card 1
It is also possible to prevent double payment by deleting the voting data T-data at 0. In addition, voting data T-da is sent to the voting machine 20 or the center host 30.
It is also possible to provide a history storage area for recording ta, the amount of refund, the date and time of refund, etc., and a management means therefor to manage the voting data for each voting card and the history of refund processing.

As described above, in the electronic voting system 1 described above, the voting data passing through the communication line L is encrypted with the card secret key Kis, and the center host 30 authenticates it. It is easy to take measures against forgery / alteration, and it is also easy to authenticate whether the recipient is a legitimate one at the time of refund or confirm whether the voting data has been tampered with. Therefore, it is difficult to misuse the voting data, and a sound voting system can be realized.

In the present embodiment, the electronic voting system 1 has been described on the premise that the voter will be refunded after the vote has been cast. After sex confirmation and voting, the voter uses the voting card 10
It can also be an effective means for confirming the validity of access when reference access is performed.

Further, the electronic voting system of the present invention can be applied not only to the use as a vote for public competitions, but also to the same type of use requiring security, for example, issuing lottery tickets and refunding them. Is. In this case, the lottery ticket is a voting card, and in the voting data, the voting ticket number is the lottery issue type (00th Tokyo lottery ticket) and the voting value is the lottery number (00 set 000000).

In addition to the above electronic voting system, the cryptographic communication method of the present invention relates to a voting card system using a voting card having a recording area of electronic data as a recording medium of unique data and predetermined voting data, and voting. The present invention can be applied to the same type of application for performing communication using a public key method with a center host that performs predetermined processing.

[0035]

As is apparent from the above description, according to the present invention, it is possible to realize a data security technique suitable for an electronic voting system or applied to an electronic voting system by a simple method. Has the effect of.

[Brief description of drawings]

FIG. 1 is a block diagram of an electronic voting system in which the present invention is applied to electronic voting in public competition.

FIG. 2 is a diagram showing a configuration of functional blocks formed in an IC chip of a voting card and a memory map in an EEPROM.

FIG. 3 is a block diagram of a voting machine according to the present embodiment.

FIG. 4 is a configuration diagram of a center host according to the present embodiment.

FIG. 5 is a sequence chart showing processing when a voting card is issued.

FIG. 6 is a sequence chart when a voter votes by cryptographic communication.

FIG. 7 is a sequence chart when a voter makes a refund by cryptographic communication.

[Explanation of symbols]

10 voting cards (IC cards) 11 IC chip 20 voting machines 30 center host 31 Data storage memory 33 Data processing unit 36 Random number generator 112, 32 memory controller 113, 34 Encryption processing unit 114,35 Decoding processing unit 115, 37 Data input / output section 161, 311 ID storage area 162Kis storage area 163Kcp storage area 164 Voting ticket number storage area 165 voting value storage area 312Kcs storage area 313Kip storage area 314T-DATA storage area

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI G06F 17/60 512 G09C 1/00 620Z G09C 1/00 620 H04L 9/00 675B 673E (56) Reference JP-A-9-259190 (JP, A) JP 4-118777 (JP, A) JP 3-99364 (JP, A) JP 2-292666 (JP, A) (58) Fields investigated (Int. Cl. ⁷⁾ , DB name) H04L 9/32 G09C 1/00 620 G06F 17/60 146 G06F 17/60 148 G06F 17/60 510 G06F 17/60 512 G06F 3/08

Claims (10)

(57) [Claims] 1. A public key system is used between a card system that uses a voting card having a recording area for electronic data as a recording medium for unique data and predetermined voting data and a center host that performs predetermined processing related to voting. An encryption communication method carried out by recording the card ID unique to the card, a card private key, and a host public key unique to the center host on each voting card issued by the card system. The card I of the voting card issued
D, a host secret key, and a process of recording a card public key that can be retrieved by a search key, and the card system encrypts the voting data recorded on the voting card with the card secret key, thereby obtaining the result. Encrypting the encrypted voting data together with the voting data before encryption and the card ID of the voting card with the host public key, and transmitting the encrypted transmission data obtained by the encryption to the center host; The center host that receives the data decrypts this encrypted transmission data with its own host private key, finds the card public key of the voting card using the card ID obtained thereby as the search key, and reveals the searched card. The encryption voting data is decrypted with a key, and the voting data obtained by this decryption matches the voting data before encryption. A cryptographic communication method characterized by executing a process of holding a pair of the voting data and the searched card public key as communication partner information thereafter, and at least in this order. 2. A process in which the card system transmits voting data recorded on the voting card to the center host, and the center host which has received the voting data is already held based on the voting data. The communication partner information being specified is specified, arbitrary authentication data is generated when the voting data included in the specified communication partner information and the received voting data match, and this authentication data is held and addressed to the card system. To the center host, the card system that receives the authentication data encrypts the authentication data with the card private key, and sends the encrypted authentication data obtained thereby to the center host; The center host that has received the decryption decrypts this encrypted authentication data with the card public key included in the communication partner information, and Cryptographic communication method according to claim 1, characterized in that the obtained authentication data and the authentication is held data is further executed a process, the executing the voting process based on the voting data when a match occurs. 3. The cryptographic communication method according to claim 2, wherein the authentication data is random number data. 4. A card system that uses a voting card having a data recording area as a recording medium for storing unique data and predetermined voting data, and a center host that performs predetermined processing related to voting are connected through a communication line, and the card system. Is a key holding unit for holding each card ID, a card private key unique to each voting card, and a host public key unique to the center host, for each voting card, and a vote recorded in any of the voting cards. The data is encrypted with the card private key of the voting card to generate encrypted voting data, and the encrypted voting data, the voting data before encryption, and the card ID set are encrypted with the host public key and encrypted transmission data. And an means for transmitting the generated encrypted transmission data to the center host. A card management means for the center host to readably hold its own host private key, the card ID of the voting card notified at the time of issuing the voting card, and a plurality of card public keys associated with the card ID. A first means for decrypting the encrypted transmission data received from the card system with the host secret key to decrypt the voting data, the encrypted voting data, and a card ID; and the key using the decrypted card ID as a search key. Second means for obtaining the public key of the corresponding voting card from the holding means, and decrypting the decrypted encrypted voting data by using the obtained card public key, and the voting data obtained by this decryption and the first means Third means for collating the voted data obtained, and data processing for performing a voting process relating to the voted data when the collation result is valid. Electronic voting system characterized by having a stage. 5. The second means collates the card ID decrypted by the first means with the card ID already held, and when the two match, the card ID is used as the search key. The invention is characterized in that
The electronic voting system described in 4 . 6. The card system is configured to initialize at least a recording area of the voting data in a data recording area of a voting card every time the voting process is completed. The electronic voting system according to 4 or 5 . 7. The electronic voting system according to claim 6, wherein the card system or the center host further comprises voting history management means for holding a history of the completed voting processing for each voting card. 8. The electronic voting system according to claim 4 , wherein the voting card is an IC card including at least the encryption means. 9. An IC card, which is read by a voting machine that performs mutual communication with a center host that performs a predetermined process related to voting via a communication line, and functions as a voting card that can be repeatedly used. A key area in which a card unique card ID, a card private key, and a host public key unique to the center host are recorded; a data area for temporarily recording voting data input through the voting machine; The IC chip is provided with an encryption unit that performs encryption based on the recorded data in the key area and the data area and outputs the encryption result to the center host, and the encryption unit is recorded in the data area. Generated voting data by encrypting the voting data with the card private key,
An IC card, which is configured to generate encrypted transmission data by encrypting a set of the encrypted voting data, voting data before encryption, and a card ID with the host public key. 10. The encryption means is configured to encrypt the authentication data input from the center host through the voting machine with the card private key to generate encrypted authentication data. The IC card according to claim 9 .