JP4630144B2 - Electronic voting apparatus, voting apparatus, electronic voting system, electronic voting method and program - Google Patents

Description

  The present invention relates to information security technology, and more particularly, to electronic billing technology.

  As a typical example of the conventional electronic balloting technique, there is a method in which an election manager realizes anonymity and one vote by attaching a blind signature to a vote (see, for example, Non-Patent Document 1). The outline of the electronic billing method will be described below.

[Preparation]
The election manager A generates a signature key and a verification key for the blind signature, and discloses the verification key.

[Voting]
The voter iεN (N represents a set of voters) sends M, which is a mask of the vote content m, to the election manager A. Here, the election manager A is not a human but a server that realizes a predetermined function (giving a blind signature).
When the election manager A authenticates the voter iεN by a predetermined method (for example, identity verification) and confirms that the voter is a voter, the election manager A generates a blind signature σ (M) and sends it to the voter iεN. The voter iεN removes the mask from the received blind signature σ (M) to obtain the signature σ (m) of the election manager A, and sends the vote contents m and the signature σ (m) via the anonymous communication path. To the public bulletin board B. Here, the public bulletin board B is a server that can provide predetermined information when, for example, access is received from a terminal device.
As a blind signature, for example, there is a method based on RSA encryption (for example, see Non-Patent Document 2).

[Voting]
The voter verifies the signature σ (m) of the election manager A published on the public bulletin board B with the verification key, and publishes the vote contents m and the signature σ (m) that have passed the verification as the voting results.

In this method, since (M, σ (M)) and (m, σ (m)) cannot be associated due to the nature of the blind signature, anonymity can be realized. Further, since the blind signature σ (m) cannot be forged, one vote per person can be realized.
Atsushi Fujioka, Tatsuaki Okamoto, Kazuo Ohta, A Practical Secret Voting Scheme for Large Scale Elections, ASIACRYPT 1992, 244-251. Okamoto Tatsuaki, Yamamoto Hiroshi, "Series / Mathematics of Information Science Modern Cryptography", First Edition, Sangyo Tosho Co., Ltd., 1997

  However, the conventional electronic balloting method requires a special server for electronic balloting, which is a reliable election manager A. In order to realize a reliable server, it is costly such as distributed implementation, so it is uneconomical to install a reliable server only for one vote and there is a problem that it is not possible to easily perform electronic balloting there were.

The present invention relates to an electronic voting apparatus which does not require the electoral administrator, vote counting device, electronic Tokaihyo system, and an object thereof is to provide an electronic Tokaihyo method and program.

  In order to solve the above-described problem, in the present invention, the electronic voting device uses the public key of all voters who have been given a public key certificate in the public key infrastructure and the contents of the vote using the private key unique to each voter. A signature is generated, and electronic voting is performed with this signature (voting signature). For vote-voting, the vote-voting device verifies the voting signature electronically voted from the electronic voting device using the public keys of all voters who have been given public-key certificates in the public-key infrastructure, and passed the verification. This is done by counting the voting signatures made. In addition, the public key, the contents of the vote, and the vote signature of all voters who have been given public key certificates in the public key infrastructure are made public on the information public server.

  Also, in the electronic voting apparatus, a unique temporary public key unique to the voter is generated using the private key unique to the voter and the public key of all the voters, and the unique temporary public key and the public key of all the voters are generated. Is used to generate a disturbance factor, and using the disturbance factor and the public keys of all voters, the number of disturbance temporary public keys obtained by subtracting 1 from the total number of votes is generated. The signature information for the voting content may be generated using the disturbance temporary public key, and a set of the signature information and the disturbance factor may be used as a signature for the voting content (voting signature). Note that the unique temporary public key and the disturbing temporary public key are generated from the disturbance factor, and the unique temporary public key and the disturbed temporary public key cannot be distinguished. For vote counting, a temporary public key (unique temporary public key and disturbed temporary public key) is generated for each voting signature for all the voting signatures for a given vote, and this temporary public key and the public keys of all voters Is used to verify the vote signature for which the temporary public key has been generated, and count the vote signatures that have passed the verification.

The electronic voting system of the present invention, electronic voting a program that causes a vote counting equipment on a computer, the vote counting program Accordingly, the electronic voting system computer can be operated for as tally votes equipment.

  According to the present invention, a signature for voting content is generated using the public keys of all the voters who have been given public key certificates in the public key infrastructure and the private key unique to each voter, and this signature (voting signature) The balloting is verified using the public keys of all the voters who have been given public key certificates on the public key infrastructure for the voting signature electronically voted from the electronic voting device. And counting the number of voting signatures that have passed the verification, it is possible to realize an electronic voting vote without using a special server (election management device) for the electronic voting vote.

  In addition, a unique temporary public key and a disturbing temporary public key are generated, and these can be generated from the disturbance factor, but by distinguishing the unique temporary public key from the disturbing temporary public key, at least in counting votes Since it is unknown whether the temporary public key generated from the disturbance factor included in the voting signature is the unique temporary public key, anonymity can be realized, and the temporary public key includes the unique temporary public key. Therefore, it is possible to eliminate duplicate votes (one vote per person) by comparing temporary public keys generated from each vote signature.

<First Embodiment>
A first embodiment of the present invention will be described below.
First, let G be a cyclic group of prime order q, which is difficult for the discrete logarithm problem, and let g be its generation source. Examples of the cyclic group G include a multiplicative group Z _p ^* [q = p−1], a group defined by points on an elliptic curve, and the like.
Further, H, H ′, and H ″ have the properties of H: {0, 1} ^* → G, H ′: {0, 1} ^* → G, H ″: {0, 1} ^* → Z _q. A hash function (one-way function) is used. Here, {0, 1} ^* represents a binary sequence having an arbitrary bit length, and Z _q represents an additive group.
Furthermore, it is assumed that there are n voters, and a set of these voters is N = {1,..., N}. Each voter participates in electronic voting by using a voting device described later. Here, the voter i's ID (identification) is i (i = 1,..., N).
Hereinafter, it is abbreviated as y _N = (y _i ) _iεN .

[Information disclosure server]
The public bulletin board (information disclosure server) in the first embodiment will be described.
FIG. 1 is a configuration block diagram illustrating a hardware configuration of the information disclosure server (1) according to the first embodiment.

  As illustrated in FIG. 1, the information disclosure server (1) communicates with an input unit (11) to which a keyboard or the like can be connected, an output unit (12) to which a liquid crystal display or the like can be connected, and the information disclosure server (1). A communication unit (13) to which a possible communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (14) [a cache memory, etc. may be provided. ] RAM (15) as a memory, ROM (16), external storage device (17) as a hard disk, and these input unit (11), output unit (12), communication unit (13), CPU (14), The bus (18) is connected so that data can be exchanged between the RAM (15), the ROM (16), and the external storage device (17). If necessary, the information disclosure server (1) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (17) of the information disclosure server (1) stores and stores a program for information disclosure, data necessary for processing of this program, and the like. Further, it is assumed that data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  More specifically, the external storage device (17) [or ROM, etc.] of the information disclosure server (1) includes an electronic voting device (described later) and a vote counting device (described later) that accessed the information disclosure server (1). Etc.) for obtaining information stored and stored in the external storage means (17), information obtained from an electronic voting device or a voting device accessing the information disclosure server (1), and the external storage means (17) stores and stores programs to be stored and stored, data necessary for processing of these programs, and the like. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

  In the information disclosure server (1), each program stored in the external storage device (17) [or ROM, etc.] and data necessary for processing each program are read into the RAM (15) as necessary, and the CPU Interpretation is executed and processed in (14). As a result, the CPU (14) realizes predetermined functions (information providing unit, information acquiring unit), thereby realizing information disclosure.

  The information disclosure server (1) permits access from the electronic voting device and the vote counting device, and gives predetermined information (public key to be described later, the vote counting result obtained by the vote counting device) to these devices. In order to maintain the fairness of voting, it is temporarily stored (stored in the external storage device of the information disclosure server (1)). It is assumed that these devices do not accept change requests (information content) and that they have a robust maintenance function against unauthorized access from third parties (devices) ( In other words, it is assumed that information cannot be falsified.)

[Electronic voting device]
The electronic voting apparatus (hereinafter referred to as “voting apparatus”) in the first embodiment will be described.
FIG. 2 is a block diagram illustrating a hardware configuration of the voting device (2) according to the first embodiment.

  As illustrated in FIG. 2, the voting device (2) can communicate with an input unit (21) to which a keyboard or the like can be connected, an output unit (22) to which a liquid crystal display or the like can be connected, and the voting device (2). A communication unit (23) to which a communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (24) [a cache memory or the like may be provided. ] RAM (25) as a memory, ROM (26), external storage device (27) as a hard disk, and these input unit (21), output unit (22), communication unit (23), CPU (24), The bus (28) is connected so that data can be exchanged between the RAM (25), the ROM (26), and the external storage device (27). If necessary, the voting device (2) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (27) of the voting device (2) stores and stores a program for electronic voting, data necessary for processing of this program, and the like. Further, data obtained by the processing of these programs is appropriately stored and stored in a RAM or an external storage device.

More specifically, the external storage device (27) [or ROM, etc.] of the voting device (2) has values h, σ _i , σ _j , A ₀ , A ₁ , a _i , b _i , a described later. a program for generating _j , b _j , z _i , _βφ , a program for arbitrarily selecting an element from a group, a program for generating a signature, and data required for processing of these programs, etc. Is stored and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

In the voting device (2), each program stored in the external storage device (27) [or ROM, etc.] and data necessary for processing each program are read into the RAM (25) as necessary, and the CPU ( 24) Interpretation is executed and processed. As a result, the CPU (24) has predetermined functions (h generator, σ _i generator, σ _j generator, A ₀ generator, A ₁ generator, a _i generator, b _i generator, a _j generator. , B _j generation unit, z _i generation unit, β _φ generation unit, original selection unit, signature generation unit, control unit), thereby realizing voting in electronic voting.

[Voting device]
The vote counting device in the first embodiment will be described.
FIG. 3 is a configuration block diagram illustrating a hardware configuration of the vote counting device (3) according to the first embodiment.

  As illustrated in FIG. 3, the vote counting device (3) can communicate with an input unit (31) to which a keyboard or the like can be connected, an output unit (32) to which a liquid crystal display or the like can be connected, and the vote counting device (3). A communication unit (33) to which a communication device (for example, a communication cable) can be connected, a CPU (Central Processing Unit) (34) [may include a cache memory and the like. ], A memory (RAM) 35, a ROM (36), a hard disk external storage device (37), an input unit (31), an output unit (32), a communication unit (33), a CPU (34), The bus (38) is connected so that data can be exchanged between the RAM (35), the ROM (36), and the external storage device (37). If necessary, the vote counting device (3) may be provided with a device (drive) capable of reading and writing a storage medium such as a CD-ROM.

  The external storage device (37) of the vote counting device (3) stores and stores a program for counting votes, data necessary for processing of this program, and the like. Further, data obtained by the processing of these programs is appropriately stored and stored in a RAM or an external storage device.

More specifically, a program for generating values h, σ _N , A ₀ , a ′ _N , and b ′ _N to be described later is stored in the external storage device (37) [or ROM, etc.] of the vote counting device (3). , a program for verifying the source z, the program for verifying the a _1, a program for verifying the beta _phi, program for verifying the number of _{β φ, β φ (φ =} 0) to a predetermined value A program for determining whether or not there is a match, a program for counting according to the determination result, a program for verifying the presence or absence of duplicate voting, and data necessary for processing of these programs are stored and stored. In addition, a control program for controlling processing based on these programs is also stored as appropriate.

In the vote counting device (3), each program stored in the external storage device (37) [or ROM, etc.] and data necessary for processing each program are read into the RAM (35) as necessary, and the CPU ( 34) Interpretation is executed and processed. As a result, the CPU (34) has predetermined functions (h generation unit, σ _N generation unit, A ₀ generation unit, a ′ _N generation unit, b ′ _N generation unit, z verification unit, β _φ verification unit, order verification unit. , a ₁ verification unit, determination unit, the counter section, the flag section, overlapping voting verification unit, the control unit) to realize a ballot in electronic voting is achieved.

[Network configuration]
A network configuration in the electronic voting system of the first embodiment will be described.
FIG. 4 is a diagram illustrating a network configuration in the electronic voting system according to the first embodiment. FIG. 4 shows a state before electronic voting is performed.

The electronic voting system in the first embodiment is based on PKI (Public Key Infrastructure), which is an example of a public key infrastructure. PKI is a well-known technology that has been in widespread use in Japan due to the enactment of the “Act on Electronic Signatures and Authentication Services (Act No. 102 of 2000)” in Japan (see, for example, Reference 1). )), Detailed description thereof is omitted. The present invention is not limited to the premise of PKI in Japan. If the public key infrastructure is widely spread and maintained, the scale and nature of the public key infrastructure (national / local)・ It can be applied regardless of a relatively large scale such as a region, a relatively small scale such as a company, a university, a local government or an organization, a public property as a social infrastructure, or a private property within a private company. . Please refer to Reference Document 2 regarding the Government Public Key Infrastructure (GPKI) in Japan.
(Reference 1) Information-technology Promotion Agency, "PKI-related technical explanation", [Search June 30, 2005],
Internet <URL: http://www.ipa.go.jp/security/pki/>
(Reference 2) Administrative Management Bureau, Ministry of Internal Affairs and Communications, “Government Authentication Infrastructure (GPKI)”, [Search June 30, 2005],
Internet <URL: http://www.gpki.go.jp/>

A CA (Certification Authority) (4) shown in FIG. 4 represents a certificate authority in PKI.
The information disclosure server (1), the one or more voting devices (2-1), (2-2),..., (2-n), the vote counting device (3), and the CA (4) are connected to the network (5 ) To communicate with each other. At least between each voting device and the network is preferably an anonymous communication path so that the privacy of the voter who uses each voting device is maintained.

  In the first embodiment, one voting device is assigned to each of the n voters. That is, each voter performs electronic voting using a separate voting device. However, as will be described later, each voter performs electronic voting by using a secret key / public key unique to each voter. Therefore, it is not essential to assign a separate voting device to each voter. Even in the same voting device, each voter inputs a secret key / public key unique to the voter to the voting device (for example, the voting device reads a recording medium in which the secret key / public key is recorded). ), It is possible to perform electronic voting unique to each voter.

[Preparation]
Preparations for carrying out electronic voting in the first embodiment will be described (see FIG. 4).
First, the voter i selects the secret key x _i from the element of the group Z _q and generates the public key y _i = g ^ x _i using the generator g of the cyclic group G. The symbol ^ represents a power. The voter i transmits the public key y _i unique to the voter _i to the CA (4) and registers the public key y _i in the CA (4). CA (4) issues public key certificate Cert _i to public key y _i . In this way, CA (4), the public key _{y 1, y} 2 of each voter,..., Against _{y n,} public key certificate Cert _1, Cert _2, ···, the Cert _n Issued (known technology).

Next, the information disclosure server (1) accesses the CA (4) via the network (5) and issues it from each voter's public keys y ₁ , y ₂ ,..., Y _n and the CA (4). Obtained public key certificates Cert ₁ , Cert ₂ ,..., Cert _n .

Information public server (1), public key _y 1 of each voter _{acquired, y 2, ···,} y _n and CA (4) issued from the public key certificate Cert _1, Cert _2, ··· , Cert _n are stored and saved in the external storage device (17) in association with each public key and each public key certificate. These can be said to be equivalent to a voter list.

Also, information disclosure server (1) is, vote content _{m 1,} m 2 of the electronic voting, · · ·, _{m s} are also stored in the external storage device (17). Here, s represents the number of types of voting content.

The information disclosure server (1), when accessed from each voting device or the voting device, receives these data (public keys y ₁ , y ₂ ,..., Y _n , public key certificates Cert ₁ , Cert _2). ,..., Cert _n , voting content m ₁ , m ₂ ,..., M _s ) are transmitted by the information providing unit (800) to the accessed device through the communication unit (13). In addition, after electronic voting, the signature stored and stored in the external storage device (17) is also transmitted by the information providing unit (800) to the accessed vote counting device through the communication unit (13).

Hereinafter, with reference to FIG. 4 to FIG. 14, processing of the electronic opening / closing vote processing in the first embodiment will be described.
FIG. 5 is a diagram showing a processing flow in the information disclosure server (1).
FIG. 6 is a diagram illustrating a functional configuration example of the voting device (2).
FIG. 7 is a diagram showing a processing flow in the voting apparatus (2) (No. 1).
FIG. 8 is a diagram showing a processing flow in the voting apparatus (2) (No. 2).
FIG. 9 is a diagram illustrating a state after electronic voting.
FIG. 10 is a diagram illustrating a functional configuration example of the vote-tapping device (3).
FIG. 11 is a diagram showing a processing flow in the vote-tapping device (3) (No. 1).
FIG. 12 is a diagram showing a processing flow in the vote-tapping device (3) (No. 2).
FIG. 13 is a diagram exemplifying a functional configuration in a process for verifying duplicate votes in the vote counting device (3).
FIG. 14 is a diagram showing a processing flow for verifying duplicate voting in the vote counting device (3).

[Voting]
First, electronic voting by a voting device will be described.
In the following, it is assumed that the voter i performs an electronic vote by the voting device i.
In the external storage device (27) of the voting device i, it is assumed that i, which is the ID of the voting device i, the generator g of the cyclic group G, and the secret key xi unique to the voter _i are stored in advance. As described above, the voting device i is made to read the recording medium on which the ID i of the voting device i, the generation g of the cyclic group G, and the secret key xi unique to the voter _i are recorded. The device can be used as the voting device i.

The voting device i accesses the information disclosure server (1) through the communication unit (23) under the control of the control unit (613), and is transmitted through the communication unit (13) of the information disclosure server (1) (step). S1s), public keys {y ₁ ,..., Y _n } of all voters (voting people) stored in the external storage device (17) of the information disclosure server (1), all public key certificates {cert ₁ , · · ·, cert _n} (these are equivalent to voters list.), vote content m (vote content is _{m 1,} m 2, · · ·, if there are a plurality and _{m s,} all the m Voting can be performed for a plurality of voting contents by performing the same open / close vote processing, and these are stored in the external storage device (27) of the voting device i. Further, the number n of public keys {y ₁ ,..., Y _n } of all the voters (voters) is also stored and stored in the external storage device (27) of the voting device i (step S2).
Next, a verification unit (not shown) of the voting device i (a function is realized by the CPU (24) that interprets and executes a predetermined program) verifies each public key certificate (step S3). If all the verifications are passed, the following predetermined processing is executed. If this verification does not pass, it indicates that the acquired public key contains an illegal public key, and thus the voting device i ends without executing the following processing (step S4).
Since the verification process is achieved by a known technique in PKI, detailed description is omitted. Also, between a server (information disclosure server) and a client (voting device) that can communicate with each other, the client (or conversely, the client to the server) is accessed from the server to acquire predetermined information (data). Since information (data) is stored and stored in an external storage device by a known technique, detailed description thereof is omitted in this specification.

  It should be noted that the operation of selecting whether or not to vote content m included in the information disclosed in the information disclosure server (1) can only be done by humans, and only this point is a voting device (hardware). It cannot be said that it is the work by. However, once one voting content is selected, subsequent processing is performed according to interpretation processing of a predetermined program (software) by a voting device (hardware), and electronic voting is performed by this information processing. It must be noted that is realized.

Under the control of the control unit (613), from the external storage device (27), i which is the ID of the voting device i, the generator g of the cyclic group G, the secret key x _i unique to the voter _i , all public key _{{y 1, ..., y n} } of voters (voters), vote content m, the public key of all of the voters (voters) _{{y 1, ..., y n} } reads the number n of, RAM, respectively Store in the predetermined storage area of (25). Hereinafter, the public keys {y ₁ ,..., Y _n } of all the voters (voters) are abbreviated as y _N. In addition, the description “read XX from RAM” means “read XX from a predetermined storage area in which XX is stored in the RAM”.

First, h generator (600) reads n from RAM (25), m, and _{y N,} respectively, h = H _{(n, y} N, m) is calculated and the calculation result h RAM (25) Store in a predetermined storage area (step S5). Here hash calculation _{H (n, y N, m} ) is a value linked with the binary sequence _{n‖y N ‖m (= n‖y 1 ‖y} 2 ‖ ··· ‖y _n ‖m) [symbol ‖ is Represents a combination of binary sequences. ] Represents the calculation of the hash function H. The same applies to the other hash functions H ′ and H ″. Note that h is an element of the cyclic group G, that is, h∈G. The input of the hash function H is the value _n値 y _N but are not limited to ‖M, from the viewpoint of safety in electronic voting, it is preferable to use a combined value of a binary sequence with at least y _N and m.

Next, sigma _i generator (601) is stored from RAM (25) h, reads each _{x i,} calculates the sigma _i = h ^ _{x i,} the result of the calculation sigma _i RAM predetermined (25) Store in the area (step S6). Note that σ _i is an element of the cyclic group G, that is, σ _i εG. This σ _i corresponds to a unique temporary public key unique to the terminal device i.

Subsequently, the A ₀ generation unit (602) reads n, m, and y _N from the RAM (25), calculates A ₀ = H ′ (n, y _N , m), and calculates the calculation result A ₀ . The data is stored in a predetermined storage area of the RAM (25) (step S7). Note that A ₀ is an _element of the cyclic group G, that is, A ₀ ∈G. Further, the input of the hash function H ′ need not be the same as the input of the hash function H, but in this embodiment, the same input is used.

Next, the A ₁ generation unit (603) reads i, A ₀ and σ _i from the RAM (25), and calculates A ₁ = (σ _i / A ₀ ) ^ (1 / i). results stores _{a 1} in a predetermined storage area of the RAM (25) (step S8). Note that A ₁ is an element of the cyclic group G, ie A ₁ ∈G. The _{A 1} corresponds to the disturbance factor.

Next, the σ _j generation unit (604) reads A ₀ , A ₁ , n, i from the RAM (25), calculates σ _j = A ₀ (A ₁ ^ j), and calculates the result σ _j Is stored in a predetermined storage area of the RAM (25) (step S9). Here, j is jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. Note that σ _j is an element of the cyclic group G, that is, σ _j εG. This σ _j corresponds to the disturbance temporary public key.

Further, there is a degree 1 polynomial α (x) ∈Z _q [x] that satisfies A ₀ = h ^ α (0) and σ _f = h ^ α (f) [where f∈N]. You have to be careful.
Note that the symbol α (x) ∈Z _q [x] represents that the polynomial α (x) is a polynomial having an element of the group Z _q as a coefficient.

Then, based on the selection unit (605) selects any one Tsunomoto _{w i} from the original group _{Z q,} and stores the original _{w i} in a predetermined storage area of the RAM (25) (step S10 ).

Next, the a _i generation unit (606) reads g and w _i from the RAM (25), calculates a _i = g ^ w _i, and stores the calculation result a _i in the RAM (25). Store in the area (step S11). Note that a _i is an element of the cyclic group G, that is, a _i εG.

Next, the b _i generation unit (607) reads h and w _i from the RAM (25), calculates b _i = h ^ w _i, and stores the calculation result b _i in the RAM (25). Store in the area (step S12). Note that b _i is an element of the cyclic group G, that is, b _i εG.

Subsequently, the original selection unit (605) reads i and n from the RAM (25), respectively, and jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. · for n, optionally select the two elements _z j, _{c j} from the original group _{Z q,} and stores these original _z j, a _{c j} in a predetermined storage area of the RAM (25) (step S13).

Next, the a _j generation unit (608) determines that jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. , Z _j , c _j , y _j are read (y _j is y _N minus y _i ), and a _j = (g ^ z _j ) × (y _j ^ c _j ) is calculated. Then, the calculation result _aj is stored in a predetermined storage area of the RAM (25) (step S14). Note that a _j is an element of the cyclic group G, that is, a _j ∈G.

Next, the b _j generation unit (609) generates h from the RAM (25) for jεN− {i}, that is, j = 1, 2,..., I−1, i + 1,. , Z _j , c _j , and σ _j , respectively, b _j = (h ^ z _j ) × (σ _j ^ c _j ) is calculated, and the calculation result b _j is stored in a predetermined storage area of the RAM (25). Store (step S15). Note that b _j is an element of the cyclic group G, that is, b _j εG.

Subsequently, the β _φ generator (610) generates the coefficient β _φ (φ = 0, 1, 2,..., N−1) of the polynomial β (x) ∈Z _q [x] of the order (n−1). ) That is, if the polynomial β (x) = β _n−1 x ^ (n−1) + β _n−2 x ^ (n−2) +... + Β ₁ x + β ₀ , n coefficients β _n−1 , β _n−2 ,..., β ₁ , β ₀ are obtained (β ₀ is a coefficient of x ^ (0)). These coefficients can be obtained by solving n simultaneous equations in which 0, 1,..., I−1, i + 1,. Since the algorithm for solving the simultaneous equations is known, the description thereof is omitted.
The β _φ generation unit (610) reads n, y _N , m, h, A ₀ , A ₁ , a _i , a _j , b _i , b _j , and c _j from the RAM (25), respectively, and β (0 ) = H ″ (n, y _N , m, h, A ₀ , A ₁ , a _N , b _N ), n simultaneous equations consisting of β (j) = c _j (j∈N− {i}) Is obtained by a known algorithm to determine the values of _n coefficients β _n−1 , β _n-2 ,..., Β ₁ , β ₀ , and these coefficients β _n−1 , β _{n− 2} ,. ., Β ₁ and β ₀ are stored in a predetermined storage area of the RAM (25) (step S16), where jεN− {i}, that is, j = 1, 2,. , I + 1,..., _N , a _N is a _N = (a ₁ , a ₂ ,..., A _n ), and b _N is b _N = (b ₁ , b ₂ ,. ..., and a _{b n).} in addition, β ( ), Β (j) is noted that the original group _{Z q.}

Subsequently, the z _i generator (611) reads n, i, w _i , x _i , β _φ (φ = 0, 1, 2,..., N−1) from the RAM (25), z _i = computes _{w i -β (i) × x} i, and stores the calculation result _{z i} in a predetermined storage area of the RAM (25) (step S17). β (i), using the read _{β φ, β (i) =} β n-1 × i ^ (n-1) + β n-2 × i ^ (n-2) + ··· + β 1 × i + β ₀ can be obtained. Note that z _i is an element of the group Z _q , that is, z _i εZ _q .

Subsequently, the signature generation unit (612) reads A ₁ , m, z _i , z _j , β _φ (φ = 0, 1, 2,..., N−1) from the RAM (25), respectively. Among these, a combination of A ₁ , z _i , z _j , and β _φ is a signature ξ _i for the vote content m in the voting device i (step S18). That is, ξ _i = (A ₁ , β, z _N ). Here, β is β = (β ₀ , β ₁ ,..., Β _n−1 ), and z _N is z _N = (z ₁ , z ₂ ,..., Z _n ).

Subsequently, under the control of the control unit (613), the voting device i sends the signature ξ _i and the voting content m generated in step S18 through the communication unit (23) to the information disclosure server ( 1) (step S19). This corresponds to “electronic voting”.

Disclosure server (1) is the information obtaining unit (801), the communication unit through (13) receives the transmitted signed xi] _i and vote content m in step S19, the corresponding signature xi] _i and vote content m At the same time, it is stored and stored in the external storage device (17) (step S2s).

  The same electronic voting is performed from each voting device, and as a result, the voting result electronically voted from each voting device is stored and stored in the external storage device (17) of the information disclosure server (1) (FIG. 10). reference).

[Voting]
Next, the electronic balloting process of electronic voting by the voter device (3) will be described.
It is assumed that the generation source g of the cyclic group G is stored and stored in advance in the external storage device (37) of the vote counting device (3).

The vote-tick device (3) accesses the information disclosure server (1) through the communication unit (33) under the control of the control unit (711), and is transmitted through the communication unit (13) of the information disclosure server (1). (Step S3s), public keys {y ₁ ,..., Y _n } of all voters (voting persons) stored in the external storage device (17) of the information disclosure server (1), all public key certificates {cert ₁ , .., Cert _n } (these correspond to the voter list) are received and stored in the external storage device (37) of the vote counting device (3). Further, the number n of public keys {y ₁ ,..., Y _n } of all voters (voting people) is also stored and stored in the external storage device (37) of the vote counting device (3) (step S21).
Next, a verification unit (not shown) of the vote counting device (3) (a function is realized by the CPU (34) that interprets and executes a predetermined program) verifies each public key certificate (step S22). If all the verifications are passed, the following predetermined processing is executed. If this verification is not passed, it indicates that the obtained public key contains an illegal public key, so the vote-tapping device (3) ends without executing the following processing. (Step S23).
Since the verification process is achieved by a known technique in PKI, detailed description is omitted. Also, between a server (information disclosure server) and a client (voting device) that can communicate with each other, the client (or conversely, the client to the server) is accessed from the server to acquire predetermined information (data). Since information (data) is stored and stored in an external storage device by a known technique, detailed description thereof is omitted in this specification.

  First, the vote-voting device (3) accesses the information disclosure server (1) through the communication unit (33) under the control of the control unit (711), and transmits it through the communication unit (13) of the information disclosure server (1). Received (step 4s), the vote content m for counting the total number of valid votes stored in the external storage device (17) of the information disclosure server (1) and the signature associated with the vote content m are received. Then, it is stored and stored in the external storage device (37) (step S24). Here, the total number of votes (not the total number of valid votes) electronically voted for the vote content m is assumed to be e (e ≦ n). Therefore, e signatures are received.

Subsequently, the control of the control unit (711), the public key _{{y 1, ..., y n} } from the external storage device (37), generation of the cyclic group G based g, total voters (voter), vote content m , Read the signature n selected from e signatures ξ = (A ₁ , β, z _N ), the number n of the public keys {y ₁ ,..., Y _n } of all voters (voting people), Store in the predetermined storage area (35) (step S25). Also, a predetermined storage area for storing the value v and the value F is secured in the RAM (35) under the control of the control unit (711). The initial value of the value v and the value F is 0.

Next, h generator (700), RAM read n from (35), m, and _{y N,} respectively, h = H _{(n, y} N, m) is calculated and the calculation result h RAM (35) Is stored in a predetermined storage area (step S26). Note that h is an element of the cyclic group G, that is, hεG.

Next, the A ₀ generator (701) reads n, m, and y _N from the RAM (35), calculates A ₀ = H ′ (n, y _N , m), and calculates the calculation result A ₀ . The data is stored in a predetermined storage area of the RAM (35) (step S27). Note that A ₀ is an _element of the cyclic group G, that is, A ₀ ∈G.

Next, the A ₁ verification unit (702) reads A ₁ from the RAM (35) and verifies whether A ₁ is an element of the cyclic group G (step S28). If this verification does not pass, this signature is an illegal signature, and therefore the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, does not execute the following processing). In step S45), one new signature ξ is newly selected from the e signatures, and the processes in and after step S26 are performed. If this verification is passed, the control unit (711) controls to execute the following processing.

Next, the σ _N generation unit (703) reads A ₀ , A ₁ , n from the RAM (35), respectively, and σ _f = A ₀ (A ₁ ^ f) [where f = 1, 2,. , N. ], And the calculation result σ _N (= (σ ₁ , σ ₂ ,..., Σ _n )) is stored in a predetermined storage area of the RAM (35) (step S29). This σ _N corresponds to a temporary public key. Note that σ _N (= (σ ₁ , σ ₂ ,..., Σ _n )) is an element of the cyclic group G, that is, σ _N εG. In addition, σ _N generated in step S29 includes a unique temporary public key and a disturbed temporary public key. Which σ _f is a unique temporary public key generated in a voting apparatus that electronically voted with a signature ξ. Note also that cannot be determined (ensure anonymity in electronic voting).

_Then, β φ verification unit (704) reads from _{β φ RAM (35) (φ} = 0,1,2, ···, n-1) , respectively, each β φ _(φ = 0,1, 2, ···, n-1) is verified whether the original group _{Z q} (step S30). If this verification does not pass, this signature is an illegal signature, and therefore the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, does not execute the following processing). In step S45), one new signature ξ is newly selected from the e signatures, and the processes in and after step S26 are performed. If this verification is passed, the control unit (711) controls to execute the following processing.

Subsequently, the order verification unit (705) reads n and β _φ (φ = 0, 1, 2,..., N−1) from the RAM (35), respectively, and whether the number of β _φ is n. It is verified whether or not (step S31). If this verification does not pass, this signature is an illegal signature, and therefore the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, does not execute the following processing). In step S45), one new signature ξ is newly selected from the e signatures, and the processes in and after step S26 are performed. If this verification is passed, the control unit (711) controls to execute the following processing.

Subsequently, the z verification unit (706) reads z _N (= (z ₁ , z ₂ ,..., Z _n )) from the RAM (35), and each z _N (= (z ₁ , z _2). ,..., Z _n )) is an element of the group Z _q (step S32). If this verification does not pass, this signature is an illegal signature, and therefore the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, does not execute the following processing). In step S45), one new signature ξ is newly selected from the e signatures, and the processes in and after step S26 are performed. If this verification is passed, the control unit (711) controls to execute the following processing.

Subsequently, the a ′ _N generation unit (707) reads n, g, β _φ , z _N , and y _N from the RAM (35), and a ′ _f = (g ^ z _f ) × (y _f ^ β (F)) [where f = 1, 2,..., N. ] And stores the calculation result a ′ _N (= (a ′ ₁ , a ′ ₂ ,..., A ′ _n )) in a predetermined storage area of the RAM (35) (step S33). β (f) is obtained by using β _φ that has been read, β (f) = β _n−1 × f ^ (n−1) + β _n−2 × f ^ (n−2) +... + β ₁ × it can be determined by f + β _0. Note that a ′ _N (= (a ′ ₁ , a ′ ₂ ,..., A ′ _n )) is an element of the cyclic group G, that is, a ′ _N εG.

Subsequently, the b ′ _N generation unit (708) reads n, h, β _φ , z _N , and σ _N from the RAM (35), and b ′ _f = (h ^ z _f ) × (σ _f ^ β (F)) [where f = 1, 2,..., N. ] And the result b ′ _N (= (b ′ ₁ , b ′ ₂ ,..., B ′ _n )) is stored in a predetermined storage area of the RAM (35) (step S34). β (f) is obtained by using β _φ that has been read, β (f) = β _n−1 × f ^ (n−1) + β _n−2 × f ^ (n−2) +... + β ₁ × it can be determined by f + β _0. Note that b ′ _N (= (b ′ ₁ , b ′ ₂ ,..., B ′ _n )) is an element of the cyclic group G, that is, b ′ _N εG.

Subsequently, the determination unit (709) reads n, y _N , m, h, A ₀ , A ₁ , a ′ _N , b ′ _N , and β _φ from the RAM (35), and β (0) = H. ”(N, y _N , m, h, A ₀ , A ₁ , a ′ _N , b ′ _N ) is determined, and this determination result R is stored in a predetermined storage area of the RAM (35). When this determination is not satisfied (determination is not satisfied), since this signature is an illegal signature, the control unit (711) counts the electronic vote with this signature as an invalid vote. Without (i.e., not executing the following processing), one signature ξ is newly selected from e signatures, and the processing after step S is performed. The unit (711) controls to execute the following processing.

  Subsequently, the counter unit (710) reads v from the RAM (35), and stores the value v + 1 obtained by adding 1 to this value by overwriting it in the storage area in which the value v of the RAM (35) is stored ( Step S36). Here, overwriting means deleting a previously stored value and storing a new value.

  Subsequently, the flag unit (712) stores the flag value F = 1 by overwriting the storage area in which the value F of the RAM (35) is stored (step S37).

Under the control of the control unit (711), the values F and σ _N obtained by the above processing are stored in association with the signature ξ stored in the external storage device (37) (step S38). Note that the flag value F = 0 is associated with the signature ξ for which the process of step S37 has not been executed.

  By performing the above processing for all e signatures (step S39), it is possible to count the total number of votes voted by voters among the e signatures associated with the vote content m. That is, after performing the above processing for all e signatures, the value of v stored in a predetermined storage area of the RAM (35) represents the total number of votes (of the vote contents m) by the voters. . Therefore, under the control of the control unit (711), the value v obtained by the above processing is stored and stored in the external storage device (37) (step S40).

Subsequently, processing for verifying the presence or absence of duplicate voting is performed.
The σ _N generated in step S29 includes a unique temporary public key and a disturbing temporary public key. Since this unique temporary public key is unique to the voting device (voter), it is the same for a plurality of signatures. Utilizing the fact that a unique temporary public key is not included (if the same unique temporary public key is included, it can be regarded as a duplicate vote). As described above, it is not clear which σ _f is a unique temporary public key unique to the voting device (voting person), but in σ _N obtained from the signature electronically voted by the voting device i Since the i-th σ _i is a unique temporary public key, the i-th σ _i value of each σ _N obtained from each signature is compared, and if the same value exists, the same value is given. A signature that generates σ _N including σ _i can be excluded from the count as being based on an illegal electronic vote (secure one vote for each electronic vote).

First, under the control of the control unit (711), σ _N associated with the signature associated with the value F = 1 is read from the external storage device (37) and stored in a predetermined storage area of the RAM (35). . The value v is also read from the external storage device (37) and stored in a predetermined storage area of the RAM (35) under the control of the control unit (711) (step S41). Here, for convenience of explanation, e signatures associated with the vote content m are denoted as ξ ₂ , ξ ₃ , ξ ₅ , ξ ₈ , ξ ₁₀ , ξ ₁₇ ,. Assume that the associated signatures are ξ ₃ , ξ ₅ , ξ ₈ , ξ ₁₇ ,. Further, σ _N associated with the signature associated with the value F = 1 is defined as σ _N (ξ ₃ ), σ _N (ξ ₅ ), σ _N (ξ ₈ ), σ _N (ξ ₁₇ ),.・ Let's say.

Next, the duplicate voting verification unit (713) starts from the RAM (35) to σ _N (ξ ₃ ), σ _N (ξ ₅ ), σ _N (ξ ₈ ), σ _N (ξ ₁₇ ),. , And for f = 1, 2,..., N, the same as σ _f (ξ ₃ ), σ _f (ξ ₅ ), σ _f (ξ ₈ ), σ _f (ξ ₁₇ ),. It is verified whether or not a value exists. If the same value exists, the number (τ) of σ _{N in which} the value exists is counted (step S42). The duplicate vote verifying unit (713) obtains v−τ and stores this value by overwriting it in the storage area where the value v of the RAM (35) is stored (step S43).

  Under the control of the control unit (711), the value v obtained by the above processing is stored and stored in the external storage device (37). This value v represents the total number of valid votes for electronic voting (for vote contents m) by the voter, excluding invalid voting due to duplicate voting.

The above processing, the vote content _{m 1,} m 2, · · ·, by performing the _{m s,} can count the valid votes cast for each voting contents.

Under the control of the control unit (711), the vote-voting device (3) transmits the total number of valid votes for each voted content to the information disclosure server (1) through the communication unit (33). The information disclosure server (1) receives the total number of valid votes for each vote content from the vote counting device (3), and saves and stores the total number of valid votes for each vote content in the external storage device (17).
As a result, each voting device can obtain the result of counting votes (the total number of valid votes for each voting content) by accessing the information disclosure server.

<Second Embodiment>
Next, a second embodiment of the present invention will be described with reference to FIGS.
In the first embodiment, the electronic voting / voting process using the coefficient of the polynomial β (x) is performed. In the second embodiment, the electronic voting / voting process without using the coefficient of the polynomial will be described. Thereby, it is possible to reduce the calculation amount of signature generation processing in electronic voting and verification processing in vote counting.
In the second embodiment, the same functions and processes as those in the first embodiment are given the same reference numerals and the description thereof is omitted.
FIG. 15 is a diagram illustrating a functional configuration example of the voting device (2 ′) in the second embodiment.
FIG. 16 is a diagram showing a processing flow in the voting apparatus (2 ′) (part 1).
FIG. 17 is a diagram showing a processing flow in the voting apparatus (2 ′) (part 2).
FIG. 18 is a diagram illustrating a functional configuration example of the vote counting device (3) in the second embodiment.
FIG. 19 is a diagram showing a processing flow in the vote-tapping device (3 ′) (No. 1).
FIG. 20 is a diagram showing a processing flow in the vote-tapping device (3 ′) (No. 2).

[Voting device]
The voting device (2 ′) in the second embodiment will be described.
The external storage device (27) of the voting device (2 ′) according to the second embodiment stores and stores a program for electronic voting and data necessary for processing of this program. Further, data obtained by the processing of these programs is appropriately stored and stored in a RAM or an external storage device.

The voting apparatus according to a second embodiment the external storage device (2 ') (27) [or a ROM, etc.], a program for generating the value c _i in place of a program to generate the value beta _phi is saved stored ing. Other programs are the same as those in the first embodiment.

In the voting device (2 ′) according to the second embodiment, each program stored in the external storage device (27) [or ROM, etc.] and data necessary for processing each program are stored in the RAM (25) as necessary. Are interpreted and executed and processed by the CPU (24). As a result, the CPU (24) has predetermined functions (h generator, σ _i generator, σ _j generator, A ₀ generator, A ₁ generator, a _i generator, b _i generator, a _j generator. , b _j generator, z _i generation unit, c _i generation unit, based on the selection unit, the signature generating unit, the control unit) to realize a vote in electronic voting is achieved.

[Voting device]
A vote counting apparatus in the second embodiment will be described.
The vote count device according to a second embodiment the external storage device (3 ') (37) [or a ROM, etc.], a program for verifying the number of programs, beta _phi for verifying beta _phi, beta _phi ( In place of the program for determining the coincidence between φ = 0) and the predetermined value, a program for verifying the element c and a program for determining the coincidence between the element c and the predetermined value are stored and stored. Yes.

In the vote counting device (3 ′), each program stored in the external storage device (37) [or ROM, etc.] and data necessary for processing each program are read into the RAM (35) as necessary, and the CPU Interpretation is executed and processed in (34). As a result, the CPU (34) has predetermined functions (h generator, σ _N generator, A ₀ generator, a ′ _N generator, b ′ _N generator, z verifier, c verifier, A ₁ verifier. By implementing a determination unit, a counter unit, a flag unit, a duplicate vote verification unit, and a control unit, vote counting in electronic voting is realized.

[Voting]
The same processing is performed from step S1 to step S15 of the first embodiment.
In step S16 of the voting device i in the first embodiment, the β _φ generation unit (610) determines the coefficient β _φ (φ = 0, 1) of the polynomial β (x) ∈Z _q [x] of the degree (n−1). , 2, · · ·, n-1) a was determined, in the second embodiment, _{c i} generation unit (615) is obtaining the _{c i.} That, _{c i} generation unit (615) reads _n from _{RAM (25), y N,} m, h, A 0, A 1, a i, a j, b i, b j, a _{c j} respectively, wherein It performs the operation of (1), and stores the calculation result _{c i} in a predetermined storage area of the RAM (25) (step S16 '). Here, j∈N- {i}, i.e. j = 1,2, ···, i- 1, i + 1, ···, a n, _{a N is, a N = (a 1,} a 2, , A _n ), and b _N is b _N = (b ₁ , b ₂ ,..., B _n ). Note that c _i is an element of group Z _q , that is, c _i εZ _q .

In step S17 of Vote device i in the first embodiment, _{z i} generation unit (611) _calculates the _{z i = w i -β (i} ) × x i, was calculated the result of the calculation _{z i,} the In the second embodiment, the z _i generator (616) obtains z _i different from that of the first embodiment. That, _{z i} generator (616) reads RAM (25) from the _{w i,} x i, a _{c i respectively, z i = w i -c i} × calculates the _{x i,} RAM and the calculation result _{z i} Store in the predetermined storage area of (25) (step S17 '). Note that z _i is an element of the group Z _q , that is, z _i εZ _q .

In step S18 of the voting device i in the first embodiment, the signature generation unit (612) _sets the combination of A ₁ , z _i , z _j , and β _{φ as} the signature ξ _i for the voting content m in the voting device i. In the second embodiment, the signature generation unit (617) obtains a signature different from that in the first embodiment. That is, the signature generation unit (617) reads A ₁ , m, z _i , z _j , c _i , and c _j from the RAM (25), and among these, A ₁ , z _i , z _j , c _i , The combination of c _j is a signature ξ _i for the vote content m in the voting device i (step S18 ′). That is, ξ _i = (A ₁ , c _N , z _N ). Where _{z N is, z N = (z 1,} z 2, ···, z n), c N _{is, c N = (c 1,} c 2, ···, c n) is. After step S18 ′, the same processing as in the first embodiment is performed.

[Voting]
The same processing is performed from step S20 to step S23 of the first embodiment.
In step S24 of the vote counting device (3) in the first embodiment, the control unit (711) controls the generation group g of the traveling group G and the public keys of all voters (voting people) from the external storage device (37). y ₁ ,..., y _n }, voting content m, one signature selected from e signatures ξ = (A ₁ , β, z _N ), public keys {y ₁ ,. The number n of y _n } is read and stored in a predetermined storage area of the RAM (35). In the second embodiment, the cyclic group is transferred from the external storage device (37) under the control of the control unit (711). Generator G of G, public key {y ₁ ,..., Y _n } of all voters (voting people), vote content m, signature selected from e signatures ξ = (A ₁ , c _N , z _N ), the public key of all voters _{(voter) {y 1, ..., y} n} reads the number n of the respective R Stored in a predetermined storage area of M (35) (step S24 ').

  After step S24 ', processing similar to that from step S25 to step S29 in the first embodiment is performed.

In step S30 of the vote counting device (3) in the first embodiment, the β _φ verification unit (704) receives β _φ (φ = 0, 1, 2,..., N−1) from the RAM (35). Reading and verifying whether each β _φ (φ = 0, 1, 2,..., N−1) is an element of the group Z _q is an unnecessary process in the second embodiment.

Further, in step S31 of the vote counting device (3) in the first embodiment, the order verifying unit (705) receives n, β _φ (φ = 0, 1, 2,..., N−1) from the RAM (35). ) read respectively, although the number of beta _phi was verified whether or not n, becomes unnecessary processing in the second embodiment.

In the second embodiment, following step S32, the c verification unit (715) reads c _N (= (c ₁ , c ₂ ,..., C _n )) from the RAM (35), and each c _N It is verified whether (= (c ₁ , c ₂ ,..., C _n )) is an element of the group Z _q (step S32a). If this verification is not passed, the signature is an invalid signature, and therefore the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, does not execute the following processing). Then, one new signature ξ is selected from e signatures, and the processing from step S26 is performed (step S45). If this verification is passed, the control unit (711) executes the following processing. Such control is the same as in the first embodiment.

In step S33 of the vote counting device (3) in the first embodiment, the a ′ _N generation unit (707) calculates a ′ _N , but in the second embodiment, a ′ _N different from the first embodiment is calculated. That is, the a ′ _N generation unit (716) reads n, g, c _N , z _N , and y _N from the RAM (35), and a ′ _f = (g ^ z _f ) × (y _f ^ c _f [Where f = 1, 2,..., N. ], And the calculation result a ′ _N (= (a ′ ₁ , a ′ ₂ ,..., A ′ _n )) is stored in a predetermined storage area of the RAM (35) (step S33 ′). Note that a ′ _N (= (a ′ ₁ , a ′ ₂ ,..., A ′ _n )) is an element of the cyclic group G, that is, a ′ _N εG.

In step S34 of the vote counting device (3) in the first embodiment, the b ′ _N generation unit (708) calculates b ′ _{N. In} the second embodiment, b ′ _N that is different from the first embodiment is determined. That is, the b ′ _N generation unit (717) reads n, h, c _N , z _N , and σ _N from the RAM (35), respectively, and b ′ _f = (h ^ z _f ) × (σ _f ^ c _f [Where f = 1, 2,..., N. ] And the result b ′ _N (= (b ′ ₁ , b ′ ₂ ,..., B ′ _n )) is stored in a predetermined storage area of the RAM (35) (step S34 ′). Note that b ′ _N (= (b ′ ₁ , b ′ ₂ ,..., B ′ _n )) is an element of the cyclic group G, that is, b ′ _N εG.

In step S35 of the vote counting device (3) in the first embodiment, the determination unit (709) determines that β (0) = H ″ (n, y _N , m, h, A ₀ , A ₁ , a _N , b _N ) Is determined, but a different determination is made in the second embodiment, that is, the determination unit (718) determines n, y _N , m, h, A ₀ , A ₁ from the RAM (35). , A ′ _N , b ′ _N , and c _N are respectively read to determine whether or not Expression (2) is satisfied, and this determination result R is stored in a predetermined storage area of the RAM (35) (step S35 ′). If this determination is not established (determination is not established), since this signature is an invalid signature, the control unit (711) does not count the electronic vote with this signature as an invalid vote (that is, Do not execute the following process) and select one signature ξ from e signatures The processing after step S26 is performed (step S45), and when this determination is established (determination is established), the control unit (711) performs control to execute the following processing as in the first embodiment. After step S35 ′, the same processing as in the first embodiment is performed.

  The electronic voting device, the voting device, the information disclosure server, and the electronic voting and voting system / method according to the present invention are not limited to the above-described embodiments, and can be appropriately changed without departing from the gist of the present invention. For example, the signature generation method and the voting signature verification method can be changed as appropriate. In addition, the processes described in the above-mentioned electronic voting system / method are not only executed in time series according to the order of description, but also executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. It may be.

  Further, when the processing functions of the electronic voting device, the vote counting device, and the information disclosure server are realized by a computer, the processing contents of the functions that the electronic voting device, the vote counting device, and the information disclosure server should have are described by a program. By executing this program on a computer, the processing functions in the electronic voting device, the voting device, and the information disclosure server are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, an electronic voting device, a vote-tick device, and an information disclosure server are configured by executing a predetermined program on a computer. However, at least a part of these processing contents is realized by hardware. It is good to do.

  The present invention is useful for electronic billing.

The block diagram which illustrated the hardware constitutions of the information disclosure server (1) concerning 1st Embodiment. It is a block diagram which illustrated the hardware constitutions of the voting apparatus (2) concerning 1st Embodiment. The block diagram which illustrated the hardware constitutions of the vote-tick device (3) concerning 1st Embodiment. The figure which shows the network structure in the electronic voting system of 1st Embodiment (however, the state before electronic voting is performed is shown). The figure which shows the processing flow in an information disclosure server (1). The figure which shows the function structural example of a voting apparatus (2). The figure which shows the processing flow in a voting apparatus (2) (the 1). The figure which shows the processing flow in a voting apparatus (2) (the 2). The figure which shows the state after an electronic vote. The figure which shows the function structural example of a vote counting device (3). The figure (the 1) which shows the processing flow in a ticket-voking apparatus (3). The figure (the 2) which shows the processing flow in a ticket-voking apparatus (3). The figure which illustrated the functional structure in the process which verifies a duplication vote in a vote counting device (3). The figure which shows the processing flow which verifies duplication voting in a vote counting device (3). The figure which shows the function structural example of the voting apparatus (2 ') in 2nd Embodiment. The figure which shows the processing flow in a voting apparatus (2 ') (the 1). The figure which shows the processing flow in a voting apparatus (2 ') (the 2). The figure which shows the function structural example of the vote-tick apparatus (3) in 2nd Embodiment. The figure (the 1) which shows the processing flow in a ticket-voking apparatus (3 '). The figure which shows the processing flow in a ticket-voking apparatus (3 ') (the 2).

Explanation of symbols

1 Information disclosure server 2 Voting device 3 Voting device 4 CA (Certificate Authority)
5 network 601 σ _i generation unit 603 A ₁ generation unit 604 σ _j generation unit 612 signature generation unit 702 A ₁ verification unit 703 σ _N generation unit 709 determination unit 710 counter unit

Claims (10)

The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) Is set to y _i = g ^ x _i , H, H ′, H ″ are hash functions, respectively, and the vote contents m and the public keys y _N = {y ₁ ,..., Y _n } of all voters are stored. An electronic voting apparatus that performs electronic voting on an information disclosure server,
Storage means for storing a secret key x _i unique to the voter i ;
From the information public server, public vote content m and the total voters key _{y N = {y 1, ...} , y n} and receiving means for receiving,
A unique temporary public key generating means for obtaining a unique temporary public key σ _i = H (n, y _N , m) ^ x _i unique to the voter i ;
Disturbance factor generation means for determining the disturbance factor A ₁ = (σ _i / H ′ (n, y _N , m)) ^ (1 / i) ;
Disturbed temporary public key generation for obtaining n−1 disturbed temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,..., n} − {i}] Means,
For an arbitrarily selected element w _i ∈Z _q , a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i are obtained, and each j [j∈ {1,..., N} − {I}] using two elements z _j , c _j ∈Z _q arbitrarily selected , a _j = (g ^ z _j ) × (y _j ^ c _j ) and b _j = (H (n, y _N , m) ^ z _j ) × (σ _j ^ c _j ) is obtained, and β (0) = H ″ (n, y _N , m, H (n, y _N , m), H ′ (n, _{y n, m), A 1} , a 1, a 2, ..., a n, b 1, b 2, ..., b n), β (j) = c j [j∈ {1, ..., n} - {I}] polynomial of order (n−1) β (x) = β _n−1 x ^ (n−1) + β _n−2 x ^ (n−2) +... + Β ₁ x + β ₀ ∈Z _q coefficients _{[x] β φ (φ =} 0,1,2, ..., n-1) look, _{further, z i = w i -β (} i) × seeking _{i, ξ i = (A 1} , β 0, β 1, ..., β n-1, z 1, z 2, ..., z n) and signature information generation means for the signature for vote content m the,
Child voting device collector having a transmission means for transmitting to the information disclosure server as electronic voting signature xi] _i for vote content m and the vote content m. The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) Is set to y _i = g ^ x _i , H, H ′, H ″ are hash functions, respectively, and the vote contents m and the public keys y _N = {y ₁ ,..., Y _n } of all voters are stored. An electronic voting apparatus that performs electronic voting on an information disclosure server,
Storage means for storing a secret key x _i unique to the voter i ;
From the information public server, public vote content m and the total voters key _{y N = {y 1, ...} , y n} and receiving means for receiving,
A unique temporary public key generating means for obtaining a unique temporary public key σ _i = H (n, y _N , m) ^ x _i unique to the voter i ;
Disturbance factor generation means for determining the disturbance factor A ₁ = (σ _i / H ′ (n, y _N , m)) ^ (1 / i) ;
Disturbed temporary public key generation for obtaining n−1 disturbed temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,..., n} − {i}] Means,
For an arbitrarily selected element w _i ∈Z _q , a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i are obtained, and each j [j∈ {1,..., N} − {I}] using two elements z _j , c _j ∈Z _q arbitrarily selected , a _j = (g ^ z _j ) × (y _j ^ c _j ) and b _j = (H (n, _{y n, m) ^ z j} ) seek _{× (σ j ^ c j)} , c i = H "(n, y n, m, H (n, y n, m), H '(n, y n , M), A ₁ , a ₁ , a ₂ ,..., A _n , b ₁ , b ₂ ,..., B _n ) −Σ _{j∈ {1, ..., n}-{i}} c _j , obtains a _{z i = w i -c i ×} x i, ξ i = (a 1, c 0, c 1, ..., c n, z 1, z 2, ..., z n) signature for vote content m the and the signature information generating means and,
Child voting device collector having a transmission means for transmitting to the information disclosure server as electronic voting signature xi] _i for vote content m and the vote content m. The origin of the cyclic group G and g, the voter total number is n, the public key of the voter i (1 ≦ i ≦ n) and _{y i} = g ^ _x i, hash H, H ', H ", respectively The vote content m and the public key y _N = {y ₁ ,..., Y _n } of all the voters and the signature for the vote content m transmitted from the electronic voting apparatus according to claim 1 (hereinafter referred to as a vote signature) ) Ξ _i = (A ₁ , β ₀ , β ₁ ,..., Β _n−1 , z ₁ , z ₂ ,..., Z _n ) are stored, and at least the public keys of all voters _{y n = {y 1, ...} , y n} all voting signature xi] ₁ against and vote content m, ..., receives the ξ _{e (e} ≦ n), a vote counting apparatus for performing vote count relates vote content m ,
From the information public server, the public key _{y N = {y 1, ...} , y n} of at least all voters Oyo voting signature of all hands for beauty voting contents m xi] _1, ..., receiver means for receiving xi] _e When,
Each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., n] and the temporary public key generation unit asking you to ,
For each voting signature ξ ₁ ,..., Ξ _e , β (x) = β _n−1 x ^ (n−1) + β _n−2 x ^ (n−2) +... + Β ₁ x + β ₀ and a ′ _{f = (g ^ z f) ×} (y f ^ β (f)) [f = 1,2, ..., n] and _{b 'f = (H (n} , y n, m) ^ z f) × (σ _f ^ β (f)) [f = 1, 2,..., n], and β (0) = H ″ (n, y _N , m, H (n, y _N , m), H ′ (n _{, y n, m), a} 1, a '1, a' 2, ..., a 'n, b' 1, b '2, ..., b' n) and determining the verification means whether established ,
Counting the number v of voting signature passed to the decision, further overlap each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination voting signature featuring the same value than the vote was open form device having a counting means for effective votes cast the v-tau obtained by subtracting from the count result v the number tau of the duplicate voting. The origin of the cyclic group G and g, the voter total number is n, the public key of the voter i (1 ≦ i ≦ n) and _{y i} = g ^ _x i, hash H, H ', H ", respectively The vote content m and the public key y _N = {y ₁ ,..., Y _n } of all the voters and the signature for the vote content m transmitted from the electronic voting apparatus according to claim 2 ) Ξ _i = (A ₁ , c ₀ , c ₁ ,..., C _n , z ₁ , z ₂ ,..., Z _n ) is stored, and at least the public keys y _{N of} all the voters are stored. = {Y ₁ ,..., Y _n } and all the voting signatures ξ ₁ ,..., Ξ _e (e ≦ n) for the voting content m,
From the information public server, the public key _{y N = {y 1, ...} , y n} of at least all voters Oyo voting signature of all hands for beauty voting contents m xi] _1, ..., receiver means for receiving xi] _e and,
Each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., n] and the temporary public key generation unit asking you to ,
For each voting signature ξ ₁ ,..., Ξ _e , a ′ _f = (g ＾ z _f ) × (y _f ｃc _f ) [f = 1, 2,..., N] and b ′ _f = (H (n , Y _N , m) ^ z _f ) × (σ _f ^ c _f ) [f = 1, 2,..., N], and Σ _{j∈ {1,..., N}} c _j = H ″ (n, _{y n, m, H (n} , y n, m), H '(n, y n, m), A 1, a' 1, a '2, ..., a' n, b '1, b' 2 , ..., and verification means for b _'n) to determine whether satisfied,
Counting the number v of voting signature passed to the decision, further overlap each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination voting signature featuring the same value than the vote was open form device having a counting means for effective votes cast the v-tau obtained by subtracting from the count result v the number tau of the duplicate voting. An electronic Tokaihyo system including a electronic voting apparatus, and vote counting system, and an information public server,
The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) the public key and _{y i} = g ^ _x i, and H, H ', H "and the hash function each,
The upper Symbol information public server,
Vote content m and the public key _{y N = {y 1, ...} , y n} of all voters and the signature for the vote contents m (hereinafter, referred to as voting signature) capable of storing memory means,
With respect to the electronic voting device, the public key _{y N = {y 1, ...} , y n} of the vote content m and the total voters stored in the storage means of the information disclosure server transmission possible pairs electronic voting device transmits a Means,
A pair electronic voting device receiving means capable of receiving voting signature transmitted from the electronic voting device,
To said vote counting device, at least the public key _{y N = {y 1, ...} , y n} of all voters stored in the storage means of the information publishing server and all hands voting for voting contents m signature and a transmission possible pairs vote counting equipment transmission means,
The upper Symbol electronic voting equipment,
Storage means for storing a secret key x _i unique to the voter i ;
From the information public server, public vote content m and the total voters key _{y N = {y 1, ...} , y n} and receiving means for receiving,
A unique temporary public key generating means for obtaining a unique temporary public key σ _i = H (n, y _N , m) ^ x _i unique to the voter i ;
Disturbance factor generation means for obtaining the disturbance factor A ₁ = (σ _i / H ′ (n, y _N , m)) ^ (1 / i) ;
Disturbed temporary public key generation for obtaining n−1 disturbed temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,..., n} − {i}] Means,
For an arbitrarily selected element w _i ∈Z _q , a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i are obtained, and each j [j∈ {1,..., N} − {I}] using two elements z _j , c _j ∈Z _q arbitrarily selected , a _j = (g ^ z _j ) × (y _j ^ c _j ) and b _j = (H (n, y _N , m) ^ z _j ) × (σ _j ^ c _j ) is obtained, and β (0) = H ″ (n, y _N , m, H (n, y _N , m), H ′ (n, _{y n, m), A 1} , a 1, a 2, ..., a n, b 1, b 2, ..., b n), β (j) = c j [j∈ {1, ..., n} - {I}] polynomial of order (n−1) β (x) = β _n−1 x ^ (n−1) + β _n−2 x ^ (n−2) +... + Β ₁ x + β ₀ ∈Z _q coefficients _{[x] β φ (φ =} 0,1,2, ..., n-1) look, _{further, z i = w i -β (} i) × seeking _{i, ξ i = (A 1} , β 0, β 1, ..., β n-1, z 1, z 2, ..., z n) and signature information generation means for the signature for vote content m the,
And a transmitting means for transmitting to said information public server signature xi] _i for vote content m and the vote content m as electronic voting,
Above Symbol vote counting device,
All voting signature xi] ₁ for vote content m after the electronic voting, ..., xi] _e from the information public server to (e ≦ n) storing the public key of at least all voters _{y N = {y 1, ...} , y n } and voting signature of all hands for voting contents m ξ _1, ..., a receiving means for receiving xi] _e,
Each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., n] and the temporary public key generation unit asking you to ,
For each voting signature ξ ₁ ,..., Ξ _e , β (x) = β _n−1 x ^ (n−1) + β _n−2 x ^ (n−2) +... + Β ₁ x + β ₀ and a ′ _{f = (g ^ z f) ×} (y f ^ β (f)) [f = 1,2, ..., n] and _{b 'f = (H (n} , y n, m) ^ z f) × (σ _f ^ β (f)) [f = 1, 2,..., n], and β (0) = H ″ (n, y _N , m, H (n, y _N , m), H ′ (n _{, y n, m), a} 1, a '1, a' 2, ..., a 'n, b' 1, b '2, ..., b' n) and determining the verification means whether established ,
Counting the number v of voting signature passed to the decision, further overlap each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination voting signature featuring the same value than the And counting means that takes v−τ obtained by subtracting the number of duplicate votes τ from the count result v as a total number of effective votes .
Electronic Tokaihyo system. An electronic Tokaihyo system including a electronic voting apparatus, and vote counting system, and an information public server,
The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) Let y _i = g ^ x _i and H, H ′, H ″ be hash functions respectively,
The upper Symbol information public server,
Vote content m and the public key _{y N = {y 1, ...} , y n} of all voters and the signature for the vote contents m (hereinafter, referred to as voting signature) capable of storing memory means,
With respect to the electronic voting device, the public key _{y N = {y 1, ...} , y n} of the vote content m and the total voters stored in the storage means of the information disclosure server transmission possible pairs electronic voting device transmits a Means,
An electronic voting device receiving means capable of receiving a voting signature transmitted from the electronic voting device;
To said vote counting device, at least the public key _{y N = {y 1, ...} , y n} of all voters stored in the storage means of the information publishing server and all hands voting for voting contents m signature and a transmission possible pairs vote counting equipment transmission means,
The upper Symbol electronic voting equipment,
Storage means for storing a secret key x _i unique to the voter i ;
From the information public server, public vote content m and the total voters key _{y N = {y 1, ...} , y n} and receiving means for receiving,
A unique temporary public key generating means for obtaining a unique temporary public key σ _i = H (n, y _N , m) ^ x _i unique to the voter i ;
Disturbance factor generation means for determining the disturbance factor A ₁ = (σ _i / H ′ (n, y _N , m)) ^ (1 / i) ;
Disturbed temporary public key generation for obtaining n−1 disturbed temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,..., n} − {i}] Means,
For an arbitrarily selected element w _i ∈Z _q , a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i are obtained, and each j [j∈ {1,..., N} − {I}] using two elements z _j , c _j ∈Z _q arbitrarily selected , a _j = (g ^ z _j ) × (y _j ^ c _j ) and b _j = (H (n, _{y n, m) ^ z j} ) seek _{× (σ j ^ c j)} , c i = H "(n, y n, m, H (n, y n, m), H '(n, y n , M), A ₁ , a ₁ , a ₂ ,..., A _n , b ₁ , b ₂ ,..., B _n ) −Σ _{j∈ {1, ..., n}-{i}} c _j , obtains a _{z i = w i -c i ×} x i, ξ i = (a 1, c 0, c 1, ..., c n, z 1, z 2, ..., z n) signature for vote content m the and the signature information generating means and,
And a transmitting means for transmitting to said information public server signature xi] _i for vote content m and the vote content m as electronic voting,
Above Symbol vote counting device,
All voting signature xi] ₁ for vote content m after the electronic voting, ..., xi] _e from the information public server to (e ≦ n) storing the public key of at least all voters _{y N = {y 1, ...} , y n } and voting signature of all hands for voting contents m ξ _1, ..., a receiving means for receiving xi] _e,
Each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., n] and the temporary public key generation unit asking you to ,
For each voting signature ξ ₁ ,..., Ξ _e , a ′ _f = (g ＾ z _f ) × (y _f ｃc _f ) [f = 1, 2,..., N] and b ′ _f = (H (n , Y _N , m) ^ z _f ) × (σ _f ^ c _f ) [f = 1, 2,..., N], and Σ _{j∈ {1,..., N}} c _j = H ″ (n, _{y n, m, H (n} , y n, m), H '(n, y n, m), A 1, a' 1, a '2, ..., a' n, b '1, b' 2 , ..., and verification means for b _'n) to determine whether satisfied,
Counting the number v of voting signature passed to the decision, further overlap each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination voting signature featuring the same value than the And counting means that takes v−τ obtained by subtracting the number of duplicate votes τ from the count result v as a total number of effective votes .
Electronic Tokaihyo system. And electronic voting apparatus, and vote counting device, an electronic voting method in an electronic Tokaihyo system including a public information server,
The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) Let y _i = g ^ x _i and H, H ′, H ″ be hash functions respectively,
It said information-to-electronic voting device transmitting means of the public server, to said electronic voting device, the public key y N _{= {y} 1 of vote content m and the total voters stored in the storage means of the information public _server, ... , Y _n } to the electronic voting apparatus transmitting step;
Said receiving means of the electronic voting apparatus, the public key _{y N = {y 1, ...} , y n} of the vote content m and the total voters transmitted in the pair electronic voting device transmitting step electronic voting apparatus receiving step of receiving When,
Specific temporary public key generating means of the electronic voting apparatus, unique temporary public key unique to the voter _{i σ i = H (n,} y N, m) ^ a unique temporary public key generation step of obtaining a x _i,
Disturbance factor generating means of the electronic voting apparatus, disturbance factor _{A 1 = (σ i / H} '(n, y N, m)) ^ and disturbance factor generation step of obtaining a (1 / i),
The disturbing temporary public key generating means of the electronic voting device has n−1 disturbing temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,. }-{I}], a disruptive temporary public key generation step;
The signature information generating means of the electronic voting apparatus obtains a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i for arbitrarily selected elements w _i εZ _q , Using two elements z _j and c _j εZ _q arbitrarily selected for [j∈ {1,..., n} − {i}] , a _j = (g ^ z _j ) × (y _j ^ c _j) and _{b j = (H (n,} y n, m) ^ z j) seek _{× (σ j ^ c j)} , β (0) = H "(n, y n, m, H (n, _{y n, m), H '} (n, y n, m), A 1, a 1, a 2, ..., a n, b 1, b 2, ..., b n), β (j) = c j Polynomial β (x) of order (n−1) satisfying [j∈ {1,..., n} − {i}] = β _n−1 x ^ (n−1) + β _n−2 x ^ (n− _{2) + ... + β 1 x} + β 0 ∈Z q coefficients _{[x] β φ (φ =} 0,1,2, ..., n-1) a Because, _further, it obtains a _{z i = w i -β (i} ) × x i, ξ i = (A 1, β 0, β 1, ..., β n-1, z 1, z 2, ..., z n ) As a signature for the vote content m ,
Transmitting means of the electronic voting apparatus, the signature for the vote content m and the vote content m (hereinafter, voting signature _{of) ξ i = (A 1,} β 0, β 1, ..., β n-1, z 1, z ₂ ,..., z _n ) as an electronic vote to the information disclosure server,
Vs. electronic voting device receiving means of the information disclosure server, voting signature transmitted in the pair information disclosure server transmission step _{ξ i = (A 1, β} 0, β 1, ..., β n-1, z 1, z ₂ ,..., Z _n ) for receiving an electronic voting device;
Storage means of the information disclosure server, voting signature xi] ₁ received as electronic voting for vote content _m, ..., xi] _e and public information server storing step of storing _(e ≦ n),
Pair ballot device transmitting means of the information disclosure server, to said vote counting device, at least the public key _{y N = {y 1, ...} , y n} of all voters and for voting contents m of all hands A counter-voting device transmitting step for transmitting voting signatures ξ ₁ ,..., Ξ _e ;
Receiving means of said vote counting device, the public key _{y N = {y 1, ...} , y n} of all voters transmitted in the pair vote counting device transmitting step and all hands voting signature for voting contents m xi] _1, ..., a vote counting apparatus receiving step of receiving xi] _e,
Temporary public key generating means of said vote counting apparatus, each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., and the temporary public key generation step asking you to n],
Verification means of the ballot-counting device, each voting signature ξ _1, ..., for _{ξ e, β (x) =} β n-1 x ^ (n-1) + β n-2 x ^ (n-2) + ... + β ₁ x + β ₀ , a ′ _f = (gｇz _f ) × (y _f ＾ β (f)) [f = 1, 2,..., N] and b ′ _f = (H (n, y _N , m ) ^ Z _f ) × (σ _f ^ β (f)) [f = 1, 2,..., N] and β (0) = H ″ (n, y _N , m, H (n, y _{N , m), H '(n} , y n, m), A 1, a' 1, a '2, ..., a' n, b '1, b' 2, ..., or b _'n) is satisfied A verification step to determine whether or not ;
Counting means of said vote counting device counts the number v of voting signature passed to the decision, further each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination same by comparing the voting signature included values and duplicate voting, counting steps and that electronic Tokaihyo method having a to enable the votes the v-tau obtained by subtracting from the count result v the number tau of the duplicate voting. And electronic voting apparatus, and vote counting device, an electronic voting method in an electronic Tokaihyo system including a public information server,
The generator of the cyclic group G is g, the total number of voters is n, the secret key x _i of the voter i (1 ≦ i ≦ n) is the element of the group Z _q , and the voter i (1 ≦ i ≦ n) Let y _i = g ^ x _i and H, H ′, H ″ be hash functions respectively,
It said information-to-electronic voting device transmitting means of the public server, to said electronic voting device, the public key y N _{= {y} 1 of vote content m and the total voters stored in the storage means of the information public _server, ... , Y _n } to the electronic voting apparatus transmitting step;
Said receiving means of the electronic voting apparatus, the public key _{y N = {y 1, ...} , y n} of the vote content m and the total voters transmitted in the pair electronic voting device transmitting step electronic voting apparatus receiving step of receiving When,
Specific temporary public key generating means of the electronic voting apparatus, unique temporary public key unique to the voter _{i σ i = H (n,} y N, m) ^ a unique temporary public key generation step of obtaining a x _i,
Disturbance factor generating means of the electronic voting apparatus, disturbance factor _{A 1 = (σ i / H} '(n, y N, m)) ^ and disturbance factor generation step of obtaining a (1 / i),
The disturbing temporary public key generating means of the electronic voting device has n−1 disturbing temporary public keys σ _j = H ′ (n, y _N , m) (A ₁ ^ j) [j∈ {1,. }-{I}], a disruptive temporary public key generation step;
The signature information generation means of the electronic voting apparatus obtains a _i = g ^ w _i and b _i = H (n, y _N , m) ^ w _i for arbitrarily selected elements w _i εZ _q , Using two elements z _j and c _j εZ _q arbitrarily selected for [j∈ {1,..., n} − {i}] , a _j = (g ^ z _j ) × (y _j ^ c _j) and _{b j = (H (n,} y n, m) ^ z j) seek _{× (σ j ^ c j)} , c i = H "(n, y n, m, H (n, y n , M), H ′ (n, y _N , m), A ₁ , a ₁ , a ₂ ,..., A _n , b ₁ , b ₂ , ..., b _n ) −Σ _{j∈ {1,. } - {i}} seek c _{j, further,} z _{i =} w _i -c _i seek _{× x i, ξ i = (} a 1, c 0, c 1, ..., c n, z 1, z 2, ..., z _n ) a signature information generation step with a signature for the vote content m ;
Transmitting means of the electronic voting apparatus, the signature for the vote content m and the vote content m (hereinafter, voting signature _{of) ξ i = (A 1,} c 0, c 1, ..., c n, z 1, z 2 ,..., Z _n ) to the information disclosure server as an electronic vote ,
The pair electronic voting device receiving means information disclosure server, voting signature transmitted in the pair information disclosure server transmission means _{ξ i = (A 1, c} 0, c 1, ..., c n, z 1, z 2, ..., z _n ) for receiving an electronic voting apparatus;
Storage means of the information disclosure server, voting signature xi] ₁ received as electronic voting for vote content _m, ..., a storing step of storing xi] _e a _(e ≦ n),
Pair ballot device transmitting means of the information disclosure server, to said vote counting device, at least the public key _{y N = {y 1, ...} , y n} of all voters and for voting contents m of all hands A counter-voting device transmitting step for transmitting voting signatures ξ ₁ ,..., Ξ _e ;
Receiving means of said vote counting device, the public key _{y N = {y 1, ...} , y n} of all voters transmitted in the pair vote counting device transmitting step and all hands voting signature for voting contents m xi] _1, ..., a vote counting apparatus receiving step of receiving xi] _e,
Temporary public key generating means of said vote counting apparatus, each voting signature xi] _1, ..., for _{ξ e σ f = H '(} n, y N, m) (A 1 ^ f) [f = 1,2, ..., and the temporary public key generation step asking you to n],
The verification means of the above-mentioned vote-voting device has the following for each voting signature ξ ₁ ,..., Ξ _e : a ′ _f = (g ^ z _f ) × (y _f ^ c _f ) [f = 1, 2,. b ′ _f = (H (n, y _N , m) ^ z _f ) × (σ _f ^ c _f ) [f = 1, 2,..., n] is obtained, and Σ _{j∈ {1,.} c _j = H ″ (n, y _N , m, H (n, y _N , m), H ′ (n, y _N , m), A ₁ , a ′ ₁ , a ′ ₂ ,..., a ′ _{n , b '1, b' 2} , ..., a verification step of b _'n) to determine whether satisfied,
Counting means of said vote counting device counts the number v of voting signature passed to the decision, further each _{{σ 1, ..., σ n} } corresponding to the voting signature passed the determination same by comparing the voting signature included values and duplicate voting, counting steps and that electronic Tokaihyo method having a to enable the votes the v-tau obtained by subtracting from the count result v the number tau of the duplicate voting.       An electronic voting program for causing a computer to function as the electronic voting apparatus according to claim 1.       A vote counting program for causing a computer to function as the vote counting apparatus according to claim 3 or 4.

Images