JP2003323654A - Electronic voting device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic voting device which executes operation recording on an accurate time synchronized among electronic voting devices, and easily realizes the matching of clocks in an off-line electronic voting system configured of the electronic voting devices which record the history of the voting operations of voters. <P>SOLUTION: This electronic voting device is configured to synchronize the incorporated clocks of the electronic voting devices set in off-line conditions with a standard time by receiving a standard radio wave before the start of voting, and correcting the incorporated clocks. Thus, it is possible to execute the matching of the operation recording of those electronic voting devices, and to accurately analyze the factor of any failure, thereby improving the reliability of the electronic voting system. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic balloting device for electronically voting by using a computer in domestic and foreign official elections.

[0002]

2. Description of the Related Art Recent information technology (IT: Information Te
With the development of chnology), patents relating to a touch panel system, such as Japanese Patent No. 2747171 and a mark sheet system, Japanese Patent No. 2669371, disclose inventions relating to electronic voting for the purpose of IT in voting and voting processes.

The invention relating to electronic voting for which the applicant has already applied for a patent (Japanese Patent Application No. 2001-112491, Japanese Patent Application No. 2001-19194, Japanese Patent Application No. 2001-24966, Japanese Patent Application No. 2001-53972, and Japanese Patent Application No. 2001-260619).
Etc.), according to the universal design technology, when an elector (voter) selects a candidate using a computer installed at a designated polling place, the candidate's display means (output means) and voting are performed. It is possible to arbitrarily select means (input means). The above-mentioned patent-pending invention has not been disclosed yet and is not publicly known. In such an electronic voting system, the operation from the start to the end of the electronic voting system can be read out afterwards in order to use it to create a voting record of elections and to analyze a failure when a system error occurs. It is required to keep a record. Therefore, the exact time must be recorded as the time stamp.

For a network-connected computer used in electronic commerce, etc., the NTP (Netw
It is known that the clock is set by the ork Time Protocol. However, in the case of the electronic voting system, the electronic voting device is legally prohibited from connecting to the network for security reasons, and therefore each electronic voting device must independently perform the clock adjustment. . Therefore, the voting manager of the polling place purposely makes time adjustments individually for a plurality of electronic voting devices by using a time signal or the like.

[0005]

As described above, in the electronic voting system, the electronic voting system is activated for use in creating a voting record of elections and for analyzing a failure when a system error occurs. It is required to record the operation from the end to the end as a readable record after the fact. In this operation record (so-called log), an accurate time must be recorded as a time stamp in order to perform a correct failure analysis. However, since the timepiece built into a general computer is not very accurate, it is easily out of order due to changes in the external environment such as temperature and humidity. For networked online systems, NTP that provides accurate time
It is known to automatically adjust the clock using a server or the like, but in the case of an offline system such as an electronic voting system, the clock must be adjusted individually.

Therefore, there is a practical problem that the voting manager at the polling place has to purposely set the clocks individually for a plurality of electronic voting devices by using a time signal or the like. Further, in such a case, there is a problem in that the accuracy of time adjustment is not high because the time adjustment is manually performed at a timing while listening to a time signal or the like on a radio or a telephone. In the conventional electronic voting device that manually adjusts the time and saves the operation record, the voting time recorded by each electronic voting device is insufficient because the internal clocks of the electronic voting devices at all polling stations are insufficiently synchronized. The log time could not be consistent. Therefore, it is impossible to correctly analyze the cause of failure, which is an obstacle to ensuring the reliability of the system.

The present invention has been made in view of the above circumstances, and in particular, in an offline electronic voting system including an electronic voting device that records the history of voting operations of electors, the electronic voting devices are synchronized. It is an object of the present invention to provide an electronic voting device which can record an operation at a precise time, can easily adjust the clock, and is low in cost.

[0008]

In order to solve the above problems, the present invention comprises the means described in 1) to 3) below.
That is, 1) An electronic voting device having means for recording a history of voting operations performed by an elector before selecting and confirming a desired candidate at the time of voting by electronic voting, and a standard radio wave including Japanese standard time information. Receiving means, decoding means for decoding standard time from the standard radio wave, control means for correcting an internal clock based on the decoded standard time, and recording means for recording the corrected time together with a history of voting operations. An electronic voting device comprising: 2) The electronic voting device according to 1), further comprising means for confirming zero votes prior to the start of voting. 3) It further comprises a means for reading an operation card inserted by a voting manager prior to the start of voting, and a means for receiving the standard radio wave when the operation card is normally read, 1). Electronic voting device.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION The present invention will be described below with reference to preferred embodiments. FIG. 1 is a diagram illustrating an example of the configuration of the electronic voting system according to the present embodiment. The electronic voting system shown in the figure is managed by an election management organization such as an election management committee or a central election management committee, and is roughly classified into an election data creation system 100, a polling place system 200, and a voting place system 300. It is composed of It should be noted that there are a plurality of election data creation systems 100 for each municipality nationwide, and a plurality of polling place systems 200 are also installed for each voting district for each election data creation system 100. A plurality of 300 are also installed in each of the voting areas. Therefore, a plurality of election data creation systems 100 and a plurality of polling place systems 2
00, there are multiple voting place systems, but in Figure 1,
For simplicity, one election data creation system 100, 2
One polling place system 200, Two voting place system 30
Only 0 is shown.

The election data creation system 100 comprises an election data management creation machine 101 and an election data media copy machine 1.
02 and. The election data management creation machine 101
Type of implementation election 402 (type of election such as single-entry candidate election or non-binding roster-type proportional representative election), card authentication key (also referred to as authentication key) 403, management of voting program 404, candidate By managing update / deletion of name / party registration, etc. and creating candidate data 401 composed of candidate screen and election data, it will be used for electronic voting devices, voting card ticketing machines and voting data collection, which will be described later. It is a subsystem that creates an election data master 400 for a counting machine in advance before voting.

In particular, when registering the candidate name and political party name,
Data such as the name of the candidate, the political party to which the candidate belongs, the pronunciation, the career, and the promise are stored as text format data in a storage unit (not shown) such as a hard disk or a memory. Also,
These data are used as ADPCM (Adaptive Differential Pulse) in order to provide voice guidance to the visually impaired.
Code Modulation) and MP3 (MP3: MPE)
G-1 / Audio Layer3, MPEG: Motion Picture Experts Gro
up) and the like are stored as audio data in an appropriate compressed format. In addition, image information such as the candidate's facial photograph and poster is JPEG (Joint Photographic Exp
erts Group) is stored as image data in an appropriate compression format. In addition, this election data management creation machine 101
Is a PC (Personal Computer: Personal Comput
er) can be realized.

In the election data master 400 created by the election data management creation machine 101, the voting program 404,
Candidate data 401 and card authentication key 403 are recorded. The card authentication key 403 is a key for authenticating the reading of the IC card in this embodiment. The election data master 400 is usually created as one medium, and is tested and approved by a testing device owned by an election management organization (hereinafter, also referred to as an election management committee or a jurisdiction), and the election data media copying machine 102 is approved. Be transferred to.

The election data media copier 102 is an election data master 4 tested and approved by the election.
This is a device for copying 00 data to a plurality of media. The media created by this election data media copy machine 102 is a polling place system 200 described later.
The recording medium (duplicate recording medium) 409 distributed to the electronic voting device 203 and the recording medium distributed to the voting card ticketing machine at the polling place (ticketing machine media)
It is 202.

On the duplicate recording medium 409, the voting program 404, the candidate data 401, and the card authentication key 403.
Are copied and recorded from the election data master 400. It should be noted that an original recording medium 408 is prepared separately from the duplicate recording medium 409, and the electronic recording apparatus 203 is in a blank state in which no data is recorded on the original recording medium 408.
Will be distributed to. The voting program 404 is, in the electronic voting device 203, using candidate data 401 including a screen and voice guidance and a card authentication key 403,
It is an application program that controls voting and records voting data. Also, the card authentication key 40
3 is data for initializing the voting card and authenticating the validity of the voting card.

On the ticket issuing machine medium 202, the type 402 of the election to be held and the card authentication key 403 are duplicated from the election data master 400 by the election data media copying machine and recorded. The ticket issuing machine medium 202 is a recording medium required to activate the voting card ticket issuing machine 201. A floppy (registered trademark) disk (hereinafter referred to as FD) or an IC card is used as the medium.

The polling place system 200 has a voting card ticket issuing machine 201 and an electronic voting device 203. The voting card issuing machine 201 is an admission numbered ticket (mainly a postcard mailed to the elector) distributed in advance to the electoral listed in the electoral list created based on the Basic Resident Register or in the abstract.
This device is for issuing a voting card 406 according to the described electoral characteristics (type of disability) after performing identity verification in contrast with. The voting card 406 can store a lot of information by using an IC card, for example. This voting card 406 is shown in FIG.
As shown in the figure, data such as the date of card issue, the electoral characteristic ID 2021 indicating the type of disability of the elector, the language classification, the election ID indicating the type of election, and the voting type are stored.

The voting card issuing machine 201 shown in FIG.
It also has a function of issuing an operation card 405 owned and managed by the voting manager. The voting manager is the voting card issuing machine 20
A unique polling place ID 4055 (hereinafter, also referred to as a management ID) created by using the voting card authentication key 403 using 1 is an operation card (hereinafter, also referred to as an administrator card) 40.
Record at 5. On the operation card 405, a polling place ID 4055 generated by using the card authentication key 403 common to all polling places generated by the election management committee is recorded. The operation card 405 is realized by an IC card or the like, and the polling place I
D4055 needs to take a different eigenvalue for each polling place.

The operation card 405 is used by the electronic voting device 203.
Inserted into the electronic voting device, the card authentication key 403 on the duplicate recording medium 409 attached to the electronic voting device is used to authenticate the reading of the operation card 405, and the polling place ID 4055 is read. The read polling place ID 4055 is stored in the RAM 453 (disk memory or the like) of the electronic voting device 203. In this way, the polling place ID unique to the polling place is propagated from the voting card ticket issuing machine 201 to the electronic voting device 203,
The electronic voting device 203 is ready to accept the voting card 406 from the elector. At this time, since this polling place ID (management ID) is recorded and issued on the voting card 406, voting cards other than the voting card 406 issued by the voting card issuing machine 201 at this polling place are different voting places. Since it has an ID, it cannot be accepted.

The voting card 406 has a polling place ID 405.
In addition to 5, information that allows the elector to select the input / output means is recorded in the voting card issuing machine 201. For example, the electoral characteristic ID 2021 indicating that the person is a visually impaired person at the polling place is recorded on the voting card 406 of the elector who has a description of the visually impaired person in the electoral characteristic column of the entry numbered ticket, and is lent to the elector. To be done. When this elector inserts the voting card 406 into the electronic voting device 203, the voting mode for the visually impaired is entered, and the appropriate display input mode is selected. It should be noted that this voting card 406 preferably does not store personal information that can identify the elector who uses the card, in order to keep the voting secret defined in Article 15 of the Constitution. Therefore, when using a card in which personal information such as a basic resident register card is recorded as a voting card, it is necessary to restrict reading of personal information by the electronic voting device 203.

A plurality of electronic voting devices 203 are installed in polling stations and are devices for accepting votes by electors. When the electronic voting device 203 is installed at a polling place, no data related to elections is stored and the electronic voting device 203 is in an empty ballot box. The function as the electronic voting device comes to be performed only after the transfer of the data relating to the implementation election from the election data system 100 to the electronic voting device 203 is completed. That is, election data media copier 10
The voting program 404, the candidate data 401, and the card authentication key 403 are transferred from 2 to the portable duplicate recording medium 409, and are recorded in the storage unit (RAM 453 described later) of the electronic voting apparatus 203.

After the voting is completed, the electronic voting device 203 records the voting data 40 recording the voting contents of the elector.
7 and the electronic voting program (hereinafter also referred to as the voting program) 404, all the data related to the election existing inside the electronic voting apparatus 203 is stored in the RAM 453 when the power is turned off because the storage unit uses the volatile memory. It is automatically deleted. Then, a portable recording medium such as a memory card (that is, the original recording medium 408 and the duplicate recording medium 409) is sent to the vote counting system 300. In this way, by placing the data and software related to the election in the electronic voting device 203 only during the voting time, it is possible to reduce the risk of unauthorized operation by a third party.

The electronic voting device 203 uses the polling place ID 4055, which is an identification code issued by the voting card ticket issuing machine 201, before the start time of voting on the voting day, prior to the start of voting, the operation card (administrator card) 405. It has a function to read and store in the electronic voting device. Then, after the voting start time, the electronic voting device 203 has a function of reading the voting card 406 issued by the voting card issuing machine 201 to a voter (hereinafter, also referred to as an elector or a voter) whose identity has been confirmed. Have. The voting card 406 is the operation card 40 described above in the same polling place.
The same polling place ID as that recorded in No. 5 is recorded, and the voter makes a vote card 4 to the electronic voting device 203.
When 06 is inserted, after the data reading is successfully authenticated by the authentication key 403, the polling place ID recorded on the card is read and compared and collated with the polling place ID inside the electronic voting device to insert the vote. Determine the authenticity of the card. In addition to the polling place ID 4055, the voting card 406 read by the electronic voting device 203 includes the above-mentioned electoral characteristic ID 2021 and the types of votes that can be voted (see FIG. 1).
Then, a voting flag 2022 indicating a voting right corresponding to the type 402 of the open election is shown. These data are sequentially read after the collation of the polling place ID 4055 is successful.

In the present embodiment, each of the plurality of electronic voting devices 203 in the polling place system 200 is configured to have an electromagnetic recording medium capable of recording the voting data 407. A local area network (LAN) is built in the system 200, the data of each electronic voting device 203 is transmitted online to one server, and the server records the voting data 407 in a portable electromagnetic recording medium. It is also possible to have such a system configuration.

The counting place system 300 has a data collecting / totalizing machine 301 and a printer for printing the totaling result. The voting data collector / aggregator 301 is installed in a plurality of polling stations and collects voting data 407 of the electronic voting device 203 and the electronic voting device serial number 203s (serial number given at the time of manufacturing each electronic voting device). , A device for associating the two and storing them in a storage means (not shown). In this embodiment, as a method of collecting the voting data 407, a physical transport means using a portable original recording medium 408 is used. As another embodiment of the present invention, the polling place system 200 and the counting place system 300 are network-connected by an electric communication line so that the data recorded in the electromagnetic recording media 408 and 409 are read out and transmitted through the network. It is also possible to configure.
If a hybrid network type system that uses both such an electromagnetic recording medium and a network is adopted, data transmission can be performed collectively after the time when the polling place is closed without requiring constant connection. It is possible to further enhance security in.

The hardware and software constituting the electronic voting system will be described below in detail with reference to the drawings starting from FIG. FIG. 2 is a perspective view showing an example of the exterior of the electronic voting device 203 to which this embodiment is applied. The electronic voting device 203 is a liquid crystal display device 20311 (hereinafter referred to as L
Also called a CD. LCD: Liquid Crystal Display) and touch panel 20313, a touch panel control board (not shown), and an inverter board 20312 described later.
And a display unit 20 composed of a housing part
Has 31. The LCD 20311 visually informs the voter of the information related to the vote. L in this embodiment
The size of the CD 20311 is 15 inches, and has a size and resolution (1024 × 768 pixels) sufficient for displaying a screen that is easy for anyone to see. The touch panel 20313 is a resistive film type transparent tablet which is arranged so as to be superimposed on the upper surface of the LCD and allows coordinate input by touching with a finger or a stylus pen. The touch panel 20313 has a resolution higher than that of the LCD (4096
It has × 4096 pixels and has a GUI (Graphical User Interface: Graphical) on the LCD.
When an operation button displayed by the user interface) is pressed from the touch panel, it is possible to reliably identify it.

Further, it has a voting card recording / reading means 2032 (hereinafter, also referred to as a card recording / reading means, a card reader / writer, and a card R / W) for reading the voting card 406. Further, it has a speaker (voice output means) 2033 for guiding voice voting operation. Further, the electronic voting device 203 has a front door 203 that can be opened / closed by a padlock key 2030a managed by a voting manager at the polling place.
Has 0. Inside the front door 2030, as will be described later, a slot or the like for inserting a recording medium (original recording medium 408, duplicate recording medium 409) for recording voting data 407, voting log 4075, etc. is stored. By locking the front door 2030 with the padlock 2030a, unauthorized attachment / detachment to / from the medium by a third party is prevented. Also, the front door 20
Reference numeral 30 denotes a sensor 203 capable of electrically detecting the open / closed state.
10 is arranged, and during the voting, when the front door 2030 is opened, it is detected as an abnormality and displayed on the operation display lamp 20301b of the status display lamp 20301.

The display unit 2031 including an LCD and a touch panel is configured to have a tilt of 15 degrees with respect to a horizontal plane in order to realize a height and a shape that can be easily used by anyone, and electronic voting is available at a polling place. When the device 203 is installed on the entry table for self-voting, the angle is set so that it is easy for a standing voter to visually check and that the back surface of the voter can be prevented from snooping. The electronic voting device 203 has a status indicator 203.
The size of the exterior part except 01 is width 350mm x depth 35
The height is 0 mm and the height is 190 mm, and it is possible to stack five stages in a state of being stored in a storage box (not shown). It can also be installed on the entry table that has been used in the self-form voting. Further, since the weight of the electronic voting device 203 is about 8 kg, it can be sufficiently carried by one person,
It is a weight that does not interfere with election work such as transportation to the polling place or installation.

FIG. 3 is a perspective view showing another example of the exterior of the electronic voting device 203 applied to this embodiment. The housing portion of the display unit 2031 further includes a mechanism capable of adjusting the tilt of the display surface, and a supporting mechanism (not shown) having stability when operating the touch panel.
It is preferable to have a barrier-free specification so that an elector in a wheelchair can easily operate even when seated.
However, the angle of the display surface does not necessarily have to be adjustable to any angle. It is a perspective view when a display surface is arranged at 90 degrees (perpendicular) to an installation surface. As shown in FIGS. 2 and 3, the inclination of the display unit is
It has been clarified by a field test for persons with physical disabilities nationwide that, even if the voter selects from only two types of 15 degrees or 90 degrees with respect to the horizontal plane (installation surface), it does not matter in practice. Therefore, by omitting the adjustment mechanism for the other angles, the manufacturing cost of the support mechanism (not shown) can be reduced. In addition, when using the display unit in an upright position, install it in an appropriate orientation, such as with the wall of the polling place as a back, so that the secrets of the vote are not leaked by people behind you when they vote. Is preferred.

FIG. 4 shows an electronic voting device 203 according to the present invention.
It is a top view which shows one Embodiment of the exterior of. The top view of the electronic voting device 203 illustrates a state in which the display unit 2031 is tilted (that is, a state of 15 degrees from the horizontal plane). The electronic voting device 203 includes the lock bracket 20.
30b. The lock bracket 2030b is
The padlock 2030a has a hole through which the shackle part of the key can pass, and the diameter of the hole is large enough to allow the shackle part of the key to be fully inserted and removed, and the front door 2032 does not rattle when locked. It has a size of the order. The electronic voting device 203 also includes a pen holder 2031b that holds a stylus pen 2031a. The stylus pen 2031a used for touch panel input operation of the electronic voting device 203 of the present invention is selectively used in place of a voter touching the touch panel with his / her finger, and is a pen-shaped article having a properly pointed tip. Anything can be used.

The electronic voting device 203 includes the slide cover 2
Has 035. In the figure, the slide cover 203
5 is shown half open. A status indicator cable 2 for connecting the status indicator 20301 to the hardware inside the electronic voting device inside the slide cover.
It has 0301d. Status indicator cable 2030
1d passes through the inside of the pole 20301c (shown in FIG. 5) and is connected to the rear portion of the main body by a connector. This status indicator light cable 20301d is connected to a mother board 450 and a DC power source 20315 inside an electronic voting device to be described later, and by displaying the voting operation and the power supply state by the lighting state of the lamp, a position away from the electronic voting device 203 is displayed. The person who is present can monitor it visually. Although not shown in FIG. 4, a plurality of terminals for connecting barrier-free options related to display or input are arranged inside the slide cover.

For example, it has a push switch terminal 2037 for a motor function disorder used in a voting mode performed by a push switch 20371 for a motor function disorder that can be used on a scan input screen in which a candidate selection item moves cyclically. Further, a dedicated keyboard 20 for visually impaired persons is provided with a pin display for tactile recognition and a keyboard for the blind, which can be used by electors who have difficulty visually recognizing the candidate screen display.
Keyboard terminal 20 for the visually impaired who connects 381
38. Furthermore, the display unit 2031
A headphone terminal 2039 and the like for connecting the headphone with volume adjustment 20391 used in a voting mode in which only the voice is used for voting without using the are arranged.

FIG. 5 is a front view showing an example of the exterior of the electronic voting device 203 applied to this embodiment. The status indicator 20301 included in the electronic voting device 203 is the power indicator 2
0301a, operation indicator light 20301b, pole 2030
1c. The power indicator 20301a is
It is composed of an LED (Light-Emitting Diode) of a different color (for example, red) from the operation indicator lamp,
AC power source 2031 is used depending on the three states of off, blinking, and lighting.
6. Confirmation display of the power supply drive state of the DC power source 20315 (internal battery built in the electronic voting device for power failure or external battery connected to the electronic voting device) is performed. For example,
The LED off state is defined as AC power supply driving, the LED blinking state is not AC power supply and no external battery connection (during internal battery drive), and the LED lighting state is defined as no AC power supply and external battery connection drive. As a result, a voting witness who is away from the electronic voting device can always visually monitor the power supply state.

The operation indicator light 20301b is composed of an LED of a color different from that of the above-mentioned power indicator light (for example, green), and the confirmation display of the voting state is performed by the three states of off, blinking and lighting. For example, while voting for the LED lighting state, L
The ED off state is defined as waiting for voting, the LED blinking state is defined as when an error occurs, etc., and it is monitored from a position away from the electronic voting device 203 whether or not a voting manager or a voting witness is performing an illegal operation. You can As an example of the error occurrence, when the front door opening / closing sensor 20310 detects that the front door 2032 that stores a recording medium for recording voting data, a power switch, etc. is opened during voting, a reading error of a voting card described later is generated. When it occurs, etc. The pole 20301c is a flexible 4
It is a stepped pole and has a structure in which LEDs of two colors (green and red) are attached to the tip. In this embodiment, the length of the maximum extension is about 110 cm, and the height when installed on the writing table (height 75 cm) is higher than the average height of voters, and It is designed to be easily monitored by voting managers and witnesses.

The electronic voting device 203 has a voting confirmation LED 2
Has 034. The vote confirmation LED 2034 is a display LED that indicates that the vote confirmation of the vote data 407 is completed when the vote data 407 and the vote log 4075 are normally recorded in the original recording medium 408 after the candidate selection confirmation by the elector. Is. However, the voting confirmation is established when the voting data 407 and the voting log 4075 are recorded and confirmed on the original recording medium 408, as described later. The vote confirmation LED 2034 also has a function of clarifying whether or not the vote is completed when an unexpected failure occurs during the voting operation.

The electronic voting device 203 has a card insertion guide LED 2032a. Card insertion guide LED2
Reference numeral 032a is a lamp for clearly indicating to the voter the insertion slot of the card recording / reading means 2032. The card insertion guide LED 2032a has a lighting state of the voting card 4
06 (or the operation card 405) is being inserted, the blinking state means that the voting card 406 (or the operation card 405) has not been inserted or is waiting for card removal. The electronic voting device 203 includes a power lamp 20308 (hereinafter, referred to as A
C input confirmation LED). Power lamp 2
0308 is AC100V (50/60) which is a commercial power source.
(Hz) is input,
It is a green LED.

FIG. 6 is a front view (when the front door is open) showing an example of the exterior of the electronic voting device 203 applied to this embodiment. Inside the front door 2032, an original recording medium slot 20303, a duplicate recording medium slot 20304, and a power switch 2032 are stored. At the time of voting, the front door 2032 has a small padlock 2030 on the lock bracket 2030b.
According to a, since the voting administrator locks the door, it is prohibited for a third person to illegally touch the inside of the front door. Although not shown, the front door opening / closing sensor 20
Also stored is 310 (shown in FIG. 8), which acts as a dual key for monitoring accidental front door unlocking.

Original recording medium slot 2 in FIG.
The original recording medium 408 mounted on the 0303 is a recording medium in which the voting data 407 is first recorded by the elector after confirming the candidate selection. Usually after recording voting data,
Voting log 4075 is also recorded. The original recording medium 408 sent to the polling place is generally a blank medium in which no data is recorded, and the voting data needs to be “zero votes”. Further, the duplicate recording medium 409 mounted in the duplicate recording medium slot 20304 is
As a backup of the original recording medium 408, it means a medium on which the same data is copied and recorded after recording voting data on the original recording medium.

The duplicate recording medium sent to the polling place is a voting program 4 for starting up the electronic voting device 203.
04, candidate data 401, voting card authentication key 403
Data such as the above may be supplied. As these recording media, an FD or a rewritable compact disc (C
D-RW: Compact Disk Rewritable (D), various electromagnetic recording media (electronic system, magnetic system, and other systems that cannot be recognized by human perception, and are used for information processing by an electronic computer. It is possible to use a recording medium according to a storage medium provided for the purpose, but in the present embodiment, a compact flash memory card (registered trademark, hereinafter referred to as C
It is supposed that the mechanical failure factor is eliminated by using (F). These CF memory cards use a CF memory card adapter (memory card socket) and use the original recording medium slot 2030.
3, mounted in the duplicate recording medium slot 20304.

The memory card socket is a CF type 1 dedicated PCMCIA (PCMCIA: Personal Computer Me
mory Card International Association: An organization that manages PC card standards) Interface cards can be used. Original recording medium slot 20
303, duplicate recording medium slot 20304 is a double push button type (to a media socket), that is, a mechanism type in which the ejecting operation of the media ejecting lever is enabled by the first pushing operation and the media is ejected by the second pushing operation. The attached memory card can be easily attached and detached.

The power switch 2032 is used for the electronic voting device 2
03 is a switch for turning on / off the AC100V commercial power source. The actual input state of the power supply voltage can be confirmed by the power supply lamp 20308 or the power supply indicator 20301a.

FIG. 7 is a rear view showing an example of the exterior of the electronic voting device 203 applied to this embodiment. The electronic voting device 203 has a volume 2033a, a power cable, an external display terminal 20302, and the like. The volume 2033a is used to adjust the volume of the speaker 2033 described above. The reason why the volume 2033a is arranged on the back surface of the device is to prevent the elector from unnecessarily performing volume operation during voting. On the other hand, the reason why it is not arranged inside the locked front door 2032 is that the voting witnesses can make adjustments as needed without interrupting the voting program. The display unit 2031
If the elector who votes by voice guidance without using the headphones uses the barrier-free headphones 20391, the speaker volume is automatically cut off when the barrier-free headphones 20391 are connected to the headphone terminal 2039. It Use the attached volume control function to adjust the volume of the headphones.

The electronic voting device 203 has an external display terminal 20302. External display terminal 2
To the 0302, for example, it is possible to connect a head mounted display which is a visual display to be worn on the head. This is because an elector who has difficulty in getting up and an elector who has a physical disability accompanied by involuntary movements and who has difficulty in keeping the display unit 2031 in view is continuously displayed.
It can be used instead of 31.

The electronic voting device 2 shown in FIGS.
The case of 03 is made of ABS resin (ABS: Acrylonitrile).
Butadiene Styrene polymer) is preferably used. This is because if a material other than resin, for example, a metal is used as the casing material, the sensitivity is lowered due to the shielding of the radio waves when the standard radio wave receiver described later is built in.

FIG. 8 is a diagram showing an example of a hardware configuration inside the electronic voting device 203 applied to this embodiment. The motherboard 450 has a CPU 45 on its substrate.
1 (CPU: Central Processing Unit), ROM 45
2 (ROM: Read Only Memory), RAM 453 (RAM:
Random Access Memory), buses and connectors for connecting various devices.

The ROM 452 is a basic software BIOS for controlling data transfer between the OS and hardware.
Stores (Bios: Basic Input / Output System). The RAM 453 is a volatile main memory, and the voting program 4 loaded from the duplicate recording medium 409.
It functions as a RAM disk that temporarily stores data such as 04 and candidate data 401 only during voting.

Silicon disk 454 (silicon disk)
Is a disk memory using a CF memory card, and is based on the IDE standard (IDE: Integrated Device Electron).
ics) interface, motherboard 450
Connected with. OS in the silicon disk 454
411 (OS: Operating System) and various drivers are stored and function as a system disk. Unlike a hard disk (HD: Hard Disk) which is a commonly used system disk, it has no physical drive part such as a magnetic head, so that the failure rate is low and high-speed access is possible. Hereinafter, the silicon disk 454 will also be referred to as a system disk 454.

The mother board 450 has a VRAM 456.
Also, the LCD 20311 displays LVDS (LVDS: Low Vo
ltage Differential Signaling High-speed, low-power image information general-purpose interface standard). The LCD 20311 has a diagonal size of 15 inches (3
8.1 cm) TFT liquid crystal (TFT: Thin Film Transi)
stor thin film transistor) with a resolution of 1024 × 7
A color screen with 68 pixels and RGB 64 gradations of 260,000 colors can be displayed with a brightness of 170 cd.

The touch panel 20313, which is a transparent tablet arranged on the LCD 20311, is RS-
It is connected to the motherboard 450 by the H.232 standard (standard interface for serial data transmission), and has a size of 15 inches diagonal and a resolution of 1024 × 1024. As a method of detecting an input operation on the touch panel 20313, it is preferable to use a resistance film method having excellent environment resistance against water and dust. The resistance film method is a method for electrically detecting that an electrode (transparent conductive substrate) provided between two pieces of glass is energized by pressing a finger or a stylus pen.

The card reader / writer 2032 is a device for reading or writing an IC card, which is an embodiment of the voting card 406 or the operation card 405 of the present invention, and is connected to the motherboard 450 by an RS-232 interface. Card reader / writer 2032
Automatically carries in and ejects the voting card 406 or the operation card 405. The card transport speed is about 200 millimeters per second and the transport time is 1/4 second.

The speaker 2033 is for voice guidance and is compatible with both non-disabled persons and persons with motor dysfunction. It is arranged near the card insertion slot of the electronic voting device 203. The volume adjusting volume 2033a adjusts the speaker volume. It does not affect the headphone volume.

A CF memory card, which is an example of the original recording medium 408 or the duplicate recording medium 409, is attached to a CF memory adapter and connected to the mother board 450 by a PCMCIA interface. Voting data and voting log are recorded on the original recording medium 408, and backup recording of the original data is performed on the duplicate recording medium 409. These media packages include
In order to prevent confusion, a print indication is given to each of the “original copy” and the “duplicate copy”.

The status indicator 20301 is composed of two color lamps, an operation indicator 20301b which is a green LED and a power indicator 20301a which is a red LED.
The operation indicator 20301b is a GPIO standard (GPIO:
It is connected to the motherboard 450 by a General Purpose Input / Output) interface, and confirms and displays the voting status. The display of the operation indicator light 20301b is expressed using three states of lighting, extinguishing, and blinking of the lamp.
For example, lighting is defined to indicate voting, extinguishment to stand by for voting, and blinking to define when an error occurs. On the other hand, the power supply indicator 20301a has a DC power supply (also referred to as DC power supply) 203
It is connected to 15, and displays the confirmation of the power supply drive state. The power indicator 20301a can also be expressed using the above three states. For example, OFF indicates that AC power (also referred to as AC power) is being driven, blinking indicates that AC power is not being supplied, and external battery 20316 is not connected (that is, internal battery 20314 is being driven), and lighting is that AC power is not being supplied, and The external battery 20316 is defined as being driven. The external battery 20316 is the electronic voting device 20.
A battery that is connected to the outside of 3 with a dedicated connector, which enables voting during a long-term power outage. An example is a vehicle battery.

When the vote confirmation LED 2034 confirms the selection of candidates by the elector and the voting data 407 and the voting log 4075 are normally recorded in the original recording medium 408,
It is a display LED for notifying the elector that the voting confirmation of the voting data has been completed. Voting confirmation LED 2034
Are connected to the motherboard 450 by a GPIO interface. The voting confirmation LED 2034 is defined to indicate that the voting data is normally recorded on the original recording medium when the voting holding LED 2034 is on, and that the voting card is removed when the voting confirmation LED 2034 is off. The vote confirmation LED 2034 is
Since the lighting is turned on and off by hardware control, the lighting state is saved even if an unexpected failure such as a hangup caused by software occurs during the voting operation, and whether the vote was completed at the time of the error occurrence. It is possible to clarify.

As described above, the electronic voting apparatus 203 of the present invention is provided with a display function for indicating the operation state in addition to the screen display by the LCD 20311 for the voting manager and the operator. Since these display states are latched by GPIO, even if the voting program 404 is stopped, if the power is on and the circuit is operating, that information is saved. However, there is a possibility that an illegal access to the latch address may occur due to the runaway of the voting program 404.

A plurality of card guide LEDs 2032a are arranged in the card insertion opening of the card reader / writer 2032, and are LEDs for guiding the voting or insertion of the voting card 406 and the operation card 405 to the elector. The card guide LED 2032a is provided on the mother board 4
50 and the GPIO interface are connected in parallel. When the card guide LED 2032a is lit,
The IC card is being inserted, and the blinking state shows the IC card insertion waiting state.

Power LED 20308 (AC input confirmation L
The ED is an AC power source (AC 100V for a commercial AC power source in Japan, frequency 50 Hz or 60 Hz).
LED) to monitor that the
Is. The power LED 20308 is a DC power source 20315.
And a GPIO interface for monitoring the voltage of the AC power source input to the DC power source 20315. The power LED 20308 indicates that the lit state indicates that AC power is being supplied, and the off state indicates that AC power is off.

The junction board 455 (also referred to as a junction board) is used for the mother board 450 and the RS-2.
It is connected by 32 interfaces. The junction substrate is a dedicated substrate for performing communication control and data communication by connecting a barrier-free dedicated keyboard, headphones, a push switch, or the like on the substrate. On the junction board 455, a push switch terminal 2037 for a motor function disorder, a keyboard terminal 2038 for a visually impaired person, a headphone terminal 2039.
Is installed, and optional devices compatible with barrier-free can be connected. The touch switch 2 of the electronic voting device 203 is connected to the push switch terminal 2037 for motor function disorder.
A push switch of 3.5φ make contact type, which is an input device for an elector who has a motor function disorder and whose input by 0313 is difficult, is connected. The elector can use the push switch to vote according to a scan screen (voting screen in which selection items are automatically switched in sequence).

Dedicated keyboard terminal 2038 for the visually impaired
Also, the headphone terminal 2039 has a dedicated keyboard 20381 for the visually impaired and a headphone 203 with a volume control.
91 are respectively connected. Electors with visual impairments can use the dedicated keyboard 20381 that can be held by the desk or hand.
And headphone 20 with volume adjustment for voice voting guidance
By using 391 together, a voice vote can be performed. The voice voting keyboard for visually impaired persons (also used for persons with motor disabilities) is composed of six function keys (○, ×, ←, →, △, flat buttons) with Braille, and up / down / left / right Both have a 26 mm pitch. When the headphone 2039 with volume control is connected to the headphone terminal 2039 on the junction board 455, the connection to the speaker 2033 is automatically cut off.

The built-in clock 457 is a clock module mounted on the motherboard 450. The time information from the built-in clock 457 is used, for example, as an audit record (audit trail) of voting when creating a voting log 4075 in which an operation state including a voting operation is recorded. Built-in clock 4075
Is an RTC that is a quartz (crystal oscillator) and control IC
It is composed of (Real Time Clock) and backup battery. this house,
The accuracy of quartz (quartz oscillator) is affected by changes in the external environment such as temperature and humidity, or vibration during transportation, so there are variations, generally ± 10 ppm, ± 20 ppm,
It is classified into four levels of ± 50ppm and ± 100ppm. Even if a relatively accurate quartz of ± 20 ppm is used, the deviation of about 0.9 seconds occurs during the 13 hours of the voting time (from 7 am to 8 pm). If the times of the built-in clocks of the voting devices 203 are different,
Various malfunctions may occur, such as the time stamp recorded in the file of the voting log 4075 being deviated and the log cannot be correctly verified later. In order to prevent this, it is necessary to synchronize the time of the built-in clock 457 which each of the plurality of voting devices 203 has with an accuracy of 1 second or less.

The radio wave receiving section 458 is a device for setting the clock. The radio wave receiving unit 458 receives a standard radio wave including time information and GPS (GPS: Global Positioning Sys
tem) to receive radio waves from. In particular, the standard radio wave is the Japan Standard Time (JST) generated by the cesium atomic clock of the National Institute of Communications
Radio waves transmitted by the Fukushima longwave standard frequency station (frequency: 40 kHz, callsign: JJY (registered trademark)) and the Kyushu longwave standard frequency station (frequency: 60 kHz, callsign: JJY). By receiving the time information and decoding the time information, the accurate Japan Standard Time can be obtained. By correcting the internal clock 457 using this time, all the electronic voting devices 203 can be synchronized with the Japanese standard time.

FIG. 9 is a diagram showing an example of the data structure inside the RAM 453 inside the electronic voting device 203 applied to this embodiment. As shown in FIG.
Has a voting program area 404b that temporarily stores the voting program 404 while voting is being performed.
The voting program 404 is the election data creation system 10
In the election data media copier 102 at 0, the election data master 400 to the duplicate recording medium 40
9 and was distributed to the polling place system 200. When the duplicate recording medium 409 is attached to the electronic voting apparatus 203 via the duplicate recording medium slot 20303, the voting program 404 is stored in the voting program area 4 on the RAM 453 by the program loader 436.
It is loaded into 04b.

The RAM 453 has a candidate data area 401b for storing the candidate data 401. RAM45
3 has an authentication key area 403b for storing an authentication key 403 for reading the voting card 406 and the operation card 405. The RAM 453 is a polling place ID area 4055b that stores a polling place ID that is a random number issued by the ticket issuing machine 201.
Have.

In the RAM 453, voting data 407 by the elector is recorded in the original recording medium 408 and the duplicate recording medium 40.
It has a voting data area 407b for temporarily storing the voting data 407 until it is recorded in No. 9 and collation is performed. This cache area does not exist at a fixed address. It will be allocated appropriately to the vacant address. The RAM 453 has a voting log area 4075b that stores a voting log 4075. The RAM 453 has a local disk area 4075b for copying and storing an OS 411 and a driver, a voting program 404, candidate data 401, etc. recorded on a system disk described later.

FIG. 10 is a diagram showing an example of the data structure inside the silicon disk 454 used as a system disk inside the electronic voting device 203 applied to this embodiment. The silicon disk 454 has an area for storing the program loader 436. The program loader 436 stores the voting program 404 in the duplicate recording medium 40.
It is a program to be loaded from 9.

The silicon disk 454 has an area for storing the electronic voting device serial number recording unit 203s.
The silicon disk 454 has an area for storing the I / O control unit 412. The I / O control unit 412 is a program for performing control to continuously input or output data bit by bit when inputting / outputting data. The silicon disk 454 has an area for storing the window control unit 413. The window control unit 413 is a program for managing a display portion delimited by a frame or the like in the screen displayed on the touch panel LCD 2031 or the like.

The silicon disk 454 has an area for storing the file control unit 414. File control unit 41
Reference numeral 4 is a program for performing file maintenance such as file registration, addition, modification, and deletion, and file protection for limiting access to a specific file. The silicon disk 454 has an area for storing the card controller 415. The card control unit 415 is a program for controlling loading, unloading, reading and writing of the voting card 406 or the operation card 405 issued by the card issuing machine 201.

The silicon disk 454 has an area for storing the touch panel control section 416. The touch panel control unit 416 is a program for controlling input from the touch panel on the touch panel 20313.
The silicon disk 454 has an area for storing the junction board control unit 418. The junction box control unit 418 is a program for controlling various external input / output devices connected to the electronic voting device 203 via the barrier-free compatible input / output device connection terminals 2037, 2038, 2039, and 20302.

The silicon disk 454 has an area for storing the OS 411. The OS 411 is not particularly limited, but is, for example, an OS manufactured by Microsoft Corporation in the United States.
It is possible to use Windows NT Embedded. The OS 411 is an embedded OS specialized for device control, and can operate even in the absence of an external input device such as a mouse or keyboard. And the OS recorded on the silicon disk
Other system disks can be copied and operated on the local disk area 454b of the RAM 453.

It should be noted that the silicon disk 454 is shipped from the factory with electronic voting device serial number recording section 20 which is a necessary program data and a unique device management serial number.
After writing 3s, write filter processing is performed, and the read-only memory (ROM) is obtained. By this processing, the system disk cannot be rewritten in the electronic voting device 203.

FIG. 11 shows the duplicate recording medium 40 in the RAM 453 inside the electronic voting device 203 applied to this embodiment.
FIG. 9 is a diagram showing an example of the structure of a voting program 404 loaded and stored from 9; The voting program 404 is
It has a card reading unit 431. The card reading unit 431 is
It is a program for controlling reading of the data recorded on the card after the voting card 406 or the operation card 405 provided in the form of an IC card or the like is carried into the card recording / reading means 2032.

The voting program 404 has a candidate data reading section 432. The candidate data reading unit 432 uses R
It is a program for controlling electronic reading of a database (which will be described later with reference to FIGS. 12 to 18) constituting the candidate data 415 stored on the AM 453. The voting program 404 has a voting screen creation unit 433.
The voting screen creation unit 433 is an LC when the elector votes.
This is a program for controlling the creation of the screen displayed in D20311. Candidate information or layout information necessary for screen creation is read from a database (described later, fixed screen layout table 401d in FIG. 16 and voting screen layout table 401e in FIG. 17) included in the candidate data 401. .

Voting program 404 illustrated in FIG.
Has a voting data recording unit 434. The voting data recording unit 434 uses the voting data 407 (voting results) of the elector.
Is a program for controlling recording on a portable electromagnetic recording medium. That is, the voting data recording unit 434 has the voting data area 407b of the RAM 453.
Voting data 407 read by the original recording medium 40
After the data is recorded in No. 8, it is collated with the RAM 453, and further copied to the duplicate recording medium 409. When saving voting data in two recording media, original and duplicate, open each file independently → write data
→ File close → Cache is flushed and the record is confirmed. By thus eliminating the active state of the two recording media at the same time, in the worst case, the data of one of the recording media can be secured in the event of a failure.

The voting program 404 is the voting control section 43.
Have 5. The voting control unit 435 is a program for controlling switching of voting screens by an elector performing a voting operation. On the voting screen, a candidate selection screen (shown in FIG. 34) that displays a list of candidates who can vote, and a voting intention confirmation screen (shown in FIG. 36) that displays candidates temporarily selected by the elector and confirms their voting intention (Shown) etc. When using Windows (registered trademark) as the OS 411, it is convenient to create the voting program 404 by using Visual Basic, which is a simple programming language that depends on the OS 411.

The voting program 404 is an application program supplied via an electromagnetic recording medium (duplicate recording medium 409) and cannot be resident in the electronic voting device 203. The program loader 436 is loaded every time the power is turned on.
Is newly loaded into the RAM disk 453. The supply form of the voting program 404 is an appropriate compression format file, and when loading from an electromagnetic recording medium,
The program loader 436 confirms the presence or absence of falsification by confirming the correctness of the program. The correctness is confirmed by calculating and comparing error detection codes. After the program is loaded, an error is detected by checking the CRC check during compression / decompression processing.

FIG. 12 is a diagram showing an example of the structure of the candidate data 401 stored in the RAM 453 inside the electronic voting device 203 applied to this embodiment. The candidate data 401 shown in the figure is composed of six types of tables existing as text format files. That is, first, candidate tables 401a1 to 401an that exist for each election ID that identifies the type of implementation election, second party list 401b, third polling place group table 401c, and fourth fixed screen layout table 401.
d, fifth, a voting screen layout table 401e1 to 401en existing for each election ID, and sixth, a display message table 401f) are associated with each other in a relational database (RDB: Relational Data Base).
It has the structure of.

Further, there are image files (candidate image data and political party image data) which are binary files referred to from these tables, and audio files (audio guide data etc.). These are related by referring to the relative position (path) of the file from each table. The method of referring to a binary file can be referred to by specifying a file name in the field portion of the table for an audio or image file existing in a previously designated directory. The file management by the directory uses the function of the OS which is the basic software.

FIG. 13 is a diagram showing an example of a candidate table 401a1 (for election ID = 1) which constitutes the candidate data 401 applied to this embodiment. The polling place table 401c shown in FIG.
It is configured as a table having fields such as D, candidacy notification name, candidate name phonetic, place of origin, political party ID for identifying the political party to which it belongs. For example, a record in which the value of the candidate ID field is “00001” has the candidate registration name “Kido Takayoshi”, candidate name furigana “Kido Takayoshi”, birthplace “Yamaguchi prefecture”, and political party ID “002”. Stores a series of data.

FIG. 14 is a diagram showing an example of a political party table 401b constituting the candidate data 401 applied to this embodiment. The political party table 401b has fields such as a political party ID, a language ID, and a political party name. For example, a record in which the field value of the party ID is "002"
The political party name is “Choshu Party,” which means that Takatomo Kido described above belongs to the Choshu Party. The party ID field is
This is called a primary key in database technology, and has a relationship with the field of party ID in FIG.

FIG. 15 is a polling place group table 401c constituting the candidate data 401 applied to this embodiment.
It is a figure which shows an example. Polling place group table 401
The field c has fields such as an election ID and an election name that identify the type of election, an election district ID that identifies an election district, and an election district name. Election ID field is voting card 40
When the voting program 404 reads the value of the voteable election ID recorded in No. 6, only the record of the required election ID is extracted and used.

FIG. 16 shows a fixed screen layout table 40 constituting the candidate data 401 applied to this embodiment.
It is a figure which shows an example of 1d. The fixed screen layout table is a table for defining a common screen layout regardless of election type. The fixed screen layout table 401d illustrated in FIG. 15 is an electoral characteristic ID 2021 that identifies the type of physical disability of an elector (voter).
Has a field of. Then, in the record for each electoral characteristic ID, the screen I for identifying the type of the display screen is displayed.
D, a function ID for identifying the function of the screen, a front color and a background color for defining the display color, a font of the display character, a size, a horizontal coordinate of the object to be displayed, and a field for storing layout data such as a vertical coordinate are provided. is doing.

The screen ID field shown in FIG.
This field is for defining a basic layout of a common screen consisting of a small number of screens, rather than creating a screen that is completely different depending on the type of election (ie, election ID) each time. Variations based on this common basic layout are realized in fields that define color, size, coordinates, alignment information, and the like. As the basic layout according to this embodiment, a single-page candidate selection screen, a candidate confirmation screen, a candidate selection method confirmation screen, a candidate number input screen, a candidate selection page guidance screen, an abstention confirmation screen,
Seven types of layouts for the multiple page candidate selection screen are sufficient. For example, the candidate selection screen in the single-entry candidate election and the political party selection screen in the restricted list proportional representation election can be created using the same screen ID. In this way, by sharing a small number of fixed screens in common, the creation of candidate screens becomes extremely easy, and the work load of office work for creating candidate data by tube selection can be reduced.

FIG. 17 shows the voting screen layout table 40 which constitutes the candidate data 401 applied to this embodiment.
It is a figure which shows an example of 1e1 (for election ID = 1). The voting screen layout database 401e1 is a table for defining different screen layouts depending on the type of election, the number of candidates to be displayed on the screen, or the value of the electoral characteristic ID. The voting screen layout table has fields for elector characteristic ID, screen ID, function ID, foreground color, background color, size, horizontal coordinate, vertical coordinate and the like. The table selects a required voting screen layout table based on the feasible election ID recorded on the voting card 406, and further prescribes a screen layout suitable for each electoral disability based on the elector characteristic ID. .

FIG. 18 shows a display message table 401f constituting the candidate data 401 applied to this embodiment.
It is a figure which shows an example. Display message table 401
f is the candidate table 401a1 or the party table 40
1b or a character string that is not stored in the polling place group table 401c and defines what should be displayed on the screen. For example, when the record of the message ID “00001” is referenced by the voting program 404, a message “Please insert a voting card.” Is displayed on the screen, and the voting card 406 is sent to the elector by the electronic voting device 203. Can be prompted to insert.

FIG. 19 is a diagram showing an example of the data structure of the original recording medium 408 stored inside the electronic voting device 203 applied to this embodiment. Original recording medium 408
Means a recording medium in which voting data 407 is first recorded by the elector after confirming the selection of candidates. In this embodiment, the voting log 4075 is also recorded after recording the voting data. The original recording medium 408 sent to the polling place is
Generally, it is a blank medium in which no data is recorded, and the voting data must be "zero votes."
The voting data is recorded in a random order in order to keep the voting secret. For example, the voting data 407 and voting log 4075 of the second voter are stored in the voting data 8 area for storing the voting data 407 and the voting log 4075 of the eighth voter and the area next to the voting log 8 area. The voting data 2 area and voting log 2 area are allocated.

FIG. 20 is a diagram showing an example of the data structure of the duplicate recording medium 409 stored in the electronic voting device 203 applied to this embodiment. Duplicate recording medium 409
Has an area for storing a voting program 404, candidate data 401, and a card authentication key 403 distributed from the selection. These are used by being copied to the RAM 435 of the electronic voting device as described above, but the data is still stored thereafter. Then, a copy of the voting data 407 of the original recording medium is recorded in such a manner that it is added to these.

By the way, the original recording medium 408 and the duplicate recording medium 409 having the data structures shown in FIGS.
Is recorded in a way that is not perceptible to human perception when recording information about which candidate an elector has selected in electronic voting. It is something to do. A recording medium for recording votes in electronic voting is a recording medium in which voting information by an elector is recorded electronically, magnetically, or by another method, and which can be processed by a computer. Specific examples of the recording medium include a CF card having a built-in flash memory. Memory cards of other standards, SmartMedia (registered trademark), Memory Stick (Memory
Stick) may be used. A memory card is lighter in weight than a hard disk and is resistant to vibration, so that it is excellent in data transportability and storability, and is inexpensive. Of course, as an electromagnetic recording medium, floppy (registered trademark)
It goes without saying that a disc (FD), an optical disc (CD, DVD), a magneto-optical disc (MO), etc. can be used.

In this embodiment, two memory cards (original recording medium 408 and duplicate recording medium 409) are used for one electronic voting device. In the present embodiment, these are from the election data creation system 100 to the electronic voting device 203 of the polling place system 200 before the election.
It acts as a carrier when carrying data necessary for elections. Then, during voting, it is mounted on the electronic voting device 203 and has a function as a substitute for a conventional ballot sheet, that is, a function of surely recording and holding a candidate name voted by an elector as electromagnetic data. After the voting, it has a function as a carrier when the voting data 407 is conveyed from the polling place system 200 to the counting place system 300.

When the present invention is implemented as a network type system in the case where the law is revised in the future, the electromagnetic recording media 408 and 409 are used in the election data creating system, the polling place system, and the voting place system. The base has a function of temporarily recording and accumulating data in the base before performing network transmission. The risk of data loss due to network failure is extremely low, as compared with the network type system using no electromagnetic recording medium in the present invention.

FIG. 21 is a diagram showing an example of the data structure of the voting card 406 or the operation card 405 inserted into the electronic voting device 203 applied to this embodiment. The voting card 406 or the operation card 405 stores a card authentication key 403 that is a key for authenticating access to the data recorded on the card, and the RAM of the electronic voting device 203.
The internal data can be read and written only when the authentication is successful with the card authentication key stored in 435. Voting card 406 or operation card 40
The following data is recorded in the inside of 5. That is, the municipality ID, the electoral characteristic ID 2021 indicating the type of disability of the elector, the language classification that distinguishes the type of language displayed by the electronic voting device 203, the polling place ID that is an ID unique to the polling place, the designated vote Voting type for identifying voting in a place or absentee voting or circuit voting, card issuing machine 20
For the date of ticketing issued by 1, the number of elections available, which is the number of elections when multiple elections are held on the same day, and each of the elections to be carried out (illustrated as election ID = 1, 2 to m, n) Voting flag 20 that identifies whether or not there is a right to vote and whether or not a ticket has been issued
Data such as 22 is stored.

The electoral characteristic ID is used when the staff at the polling place issues a voting card based on the entry in the electoral characteristic column of the admission numbered ticket created based on the electoral list and mailed in advance to the elector. Recorded in. For example, for an elector who has a description of a visually impaired person in the electoral characteristics column, a voting card 40
6 is the electoral characteristic ID =
01 is recorded. This voter has this voting card 406
When the electronic voting device 203 is inserted into the electronic voting device 203, the voting program 404 reads the electoral characteristic ID 2021 and refers to the corresponding candidate data 401 from the database to vote in the display input mode for the visually impaired. Is possible.

The voting card 406 or the operation card 4
The media of 05 is an IC card (IC: Integrated Circuit
cuit), it is possible to set a lot of information as compared with a card of other recording system, and to set the data access right or to set the data itself to TDES (TDES: Triple Data).
It is possible to safely store the data by encrypting it with Encryption Standard). Of course IC
A magnetic card may be used instead of the card, and an optical recording medium may be used.
In addition, computer hologram (CGH)
It is also possible to use a hybrid card of irreversible recording of Hologram) and an IC card. It is also possible to perform recording on a liquid crystal recording medium known as electronic paper. Alternatively, an OMR method (OM) that optically reads characters or barcodes recorded on a paper print medium is used.
R: Optical Mark Reader) may be used.

The voting card 406 does not record any personal information that can identify an elector who uses the voting card 406 in order to keep the voting secret defined in Article 15 of the Constitution. Therefore, when using a card with personal information such as Basic Resident Register card (also called Resident Card or Juki Card) as a voting card,
A function is required to ensure that the voting data generated by the electronic voting device 203 does not read personal information.

FIG. 22 is a diagram showing an example of the data structure of the voting flag 2022 recorded in the voting card 406 applied to this embodiment. The voting flag 2022 is an identifier (token) indicating whether or not there is a voting right, and conventionally, it has been performed to prevent double voting by a value indicating whether voting is possible or voting has been completed. However, such a conventional token has a problem that it is complicated to deal with an error in reading a voting card. That is, when the elector selects a candidate, touches the confirmation button, and the voting data is recorded on the original recording medium 408, but a writing error occurs when the flag of the voted is recorded on the voting card, It will be difficult to immediately judge whether the vote is finalized. Therefore, in this embodiment, the use of a flag that has already been voted as the voting flag is abolished,
Only two types are available: voting enabled and card not issued. In other words, the voting card 40
6 is not carried out, but it is supposed to be carried out by hardware by the vote confirmation LED 2034. Then, as a measure to prevent double voting, after confirming the flag that allows voting, the voting card is initialized and discharged inside the electronic voting device,
Not reusable.

2022, which is the voting flag for the election ID = 1
“Votable” is recorded in a, “unissued” is recorded in the voting flag 2022b of the election ID = 3, and “votable” is similarly recorded in the voting flag 2022c of the election ID = 3. Card reading unit 431 of voting program 404 (see FIG.
(Detailed in 3), by reading these information, it is determined that the election in which this elector can vote is election ID = 1 and election ID = 3. Then, the candidate data reading unit 432 extracts the candidate data 401 corresponding to these election IDs from each table in the database, and the voting screen creating unit 433 determines the screen layout according to the number of candidates, A candidate selection screen as shown in FIG. 34 is displayed. The voting card 406 according to the present invention is issued to an elector who has the right to vote, but in order to eliminate illegal voting, the use of confirming the presence or absence of the voting right by the recorded information of the voting card after the ticket is issued. Not used for. The electronic voting device 203 displays information about the presence or absence of a voting right as much as possible when a failure occurs.

Voting card 4 shown in FIGS. 21 and 22.
06 or the operation card 405 stores data in 7-bit ASCII code (ASCII: American Standard Code).
for Information Interchange, American standard code for information exchange). For example, elector characteristic ID2
When 021 is recorded as the ASCII code “30”, the electoral characteristic ID 20 shown in FIG.
21 is "00", which means a non-disabled person. Also,
The voting flag 2022 indicates whether or not voting is possible, but if it is specified that 0 is a non-issued ticket and 1 is in a voting state when expressed in decimal number, for example, ASCII code corresponds to election ID1. The voting flag "31" is
It means that you can vote. The data on the voting card is composed of 256-byte data in total.

FIG. 23 is a flow chart showing an example of the processing flow of the card reading unit 431 which constitutes the voting program 404 applied to this embodiment. The computer program realized by this flowchart is a subroutine program for reading the IC card, which is the voting card 406 or the operation card 405. In the initial state of this routine, the card guide LED 2032a arranged near the card recording / reading means 2032 (card reader / writer) of the electronic voting device 203 is blinking (step A1). Then, it has a step of confirming whether or not an IC card is inserted into the card reader / writer 2032 (step A2).

The voter inserts the voting card 406 into the electronic voting device 203, and the IC card is the card reader / writer 20.
When it is confirmed that it exists in 32 (“YES” in step A3, in the next step A4, the card that is a code common to all polling stations from the electronic voting device 203 to the IC chip on the voting card 406) Authentication key 40
Electronic voting device 2 in which 3 is transmitted and received in the IC chip
The card authentication key from 03 is compared with the card authentication key previously recorded on the IC chip by the card issuing machine 201 to authenticate the access authority to the card data. If the two authentication keys match and the authentication succeeds (step A
("YES" in 5), the process moves to the next step and the card type is read (step A6). If the authentication is rejected (“NO” in step A5), the electronic voting device 203 displays an error occurrence screen (step A2).
3) The voting card 406 is ejected from the reader / writer 2032 (step A24). The ejected card is collected by a polling staff at the polling place, and if the card is the voting card 406, the voter receives appropriate measures such as reissuing the card. It should be noted that the occurrence of an error is indicated by a status display lamp 20301 (status display lamp, to a voting observer who monitors the voting situation from a place distant from the electronic voting device 203 in the polling place.
It is also visually notified by a warning light).

If the card authentication in step A5 is successful ("YES" in step A5), the card type reading process is performed in step A6. There are two types of readable card types, a voting card and an operation card, and the identification code (illustrated as "card type ID" in FIG. 21) recorded in a predetermined card type recording area in the card is read.

The flow when the card type ID is read as the voting card 406 in the step of reading the card type ID (“YES” in step A7) will be described below. When it is read that the type of the inserted card is the voting card 406, the polling place ID (also referred to as management identification ID, management ID, or random number) 4055 is read in step A8. Read polling station I
When D matches the polling place ID stored in advance in the RAM 453 of the electronic voting device 203 (“YES” in step A9), the process proceeds to the next step (A10) of confirming the next voting right. In the next step, the voting flag 2022 shown in FIG. 6 is read (step A).
10). The voting flag 2022 is a code for identifying whether or not a voter has a voting right in an election (when a plurality of elections are held on the same day). For example, “0” can be defined as a ticket not issued and “1” can be voted.

When the voting flag 2022 is read normally (“YE” in step A11)
S ”), if the voting flag 2022 is“ 1 ”ready for voting, that is, it is read that the voter has not voted for the election, the process proceeds to the next step (A13) that defines the mode of voting. To do. In Step A13, when the voting card 406 is issued by the card issuing machine 201, a code (elector) indicating the physical disability characteristic of the voter (elector) recorded in the voting card 406 based on the electoral list. The characteristic ID 2021, shown in FIG. 39) is read. In other words, the electoral characteristic ID is an input means (touch panel 2) performed by the voter using the electronic voting device 203.
0313, a keyboard 20381 for the visually impaired, a push switch 20371 for a motor function disorder, etc.) and a display means (LCD 20311, head mounted display, Braille display, voice guide, etc.).

In the step (step A14) showing the conditional branch for the value of the electoral characteristic ID 2022, if the electoral characteristic ID is 00, that is, non-disabled (healthy person), the touch panel 20313 as the input means and the LCD 20311 as the display means. Is selected, and a process of confirming whether or not it is usable is performed (step S15a). Also,
If the electoral characteristic ID is 02, that is, if the person is a visually impaired person, in step A15c, the keyboard 20381 for the visually impaired person as the input means and the headphone 20391 with the volume control as the display means are selected. As described above, when it is checked whether the input / output device corresponding to the voter characteristic ID of the voter recorded on the voting card 406 is usable, the initialization processing of the voting card 406 is performed in the next step A16. . This step is a step of erasing all the data by reformatting the data recording area of the voting card in order to prevent double voting by reusing the used voting card. From the above, step A4 of card type reading
The card reading routine when the voting card 406 is read in A5 ends.

Next, steps A4 to A for reading the card type
5, it is read that the card inserted in the electronic voting device 203 is not the voting card 406 (step A
The steps in the case of being read as “NO” in 5 and the operation card (also referred to as an administrator card) 405 will be described. This processing is preferably performed using the operation card 405 issued by the card issuing machine 201 before the voting start time on the voting day.

First, the card type ID is the operation card 405.
If it is, polling place ID4 in step A18
055 is read. If the polling place ID is read (“YES” in step A19), the polling place ID
4055 is stored in the address of the polling place ID area 4055b of the RAM 435 of the electronic voting device 203 (step A20). Then, a screen is displayed to notify the voting manager that the polling place ID has been registered in the electronic voting device (step A21), and the operation card is discharged (A).
22). After that, the electronic voting device 203 uses this polling place I.
Only the voting card 406 in which D is recorded can be accepted. Therefore, it is impossible to vote with a card issued by a card issuing machine at another polling place or a card that has been forged or altered.

FIG. 24 is a flow chart showing an example of the processing flow of the voting data recording unit 434 which constitutes the voting program 404 applied to this embodiment. The voting program 404 duplicates and records the voting data 407 and the voting log 4075 on two recording media of the original and the duplicate, and at the time of recording, by accessing the two media independently, even when a failure occurs, It is preferable to design such that any voting data is secured. LCD 20311 by voting screen creation unit 433 of voting program 404
The voter operates the screen displayed above (one example is shown in FIG. 32 to FIG. 37) to confirm the candidate who wants to vote (the “○ vote” button shown in FIG. 37). When the content of the vote is pressed and internally stored in the RAM 453, the subroutine of the vote data recording unit 434 is called, and the vote data recording process including the following steps is started.

That is, the voting log storage file on the original recording medium 408 is opened in step D1 in FIG. 24, and the voting start log is recorded in the original recording medium in step D2. The voting start log is a character string such as “start recording on original”. When recording of the voting start log is finished, the file is closed (step D3), and in the next step D4,
A file for storing voting data on the original recording medium 408 is opened.

Then, in step D5, the RAM 4 is added to the file opened on the original recording medium.
The contents of the voting stored internally in 53 are written. Writing is performed at high speed using a cache area (not shown) inside the RAM 453. When the writing is completed, the file is closed and a file having voting data is generated (step D6). Furthermore, steps D7 to D
In 9, the voting end log (for example, a character string such as “end recording on original”) is also written on the original recording medium 408. When the writing of the voting data 407 and voting log 4075 to the original recording medium 408 is completed, the cache is dumped (dump) in step D10.
After waiting for, move on to the next step.

Steps D11 to D18 are steps for verifying the voting data 407 initially recorded on the original recording medium 408. That is, in step D11, the voting data storage file (file closed in step D6) of the original recording medium 408 is opened, and in step D12, the voting data 407 in the file is read. The vote data 407 read out is the step D1.
3, the voting data stored in a work area (not shown) of the RAM 453 and stored in the memory space managed by the voting program 404 is compared and collated. If the collation is normally performed in the conditional branch of step D14 (“YES” in step D14), the next step D
Go to 15. If the collation is not normally performed, an error screen indicating that a voting data write failure has occurred is output to the LCD 20311 and a blinking signal is output to the operation indicator 20301b. In steps D15 to D18 after the collation is successful, the voting log recorded in the original recording medium 408 is collated by the same process.

In the conditional branch of step D18, if the collation of the voting log is normally performed (step D18
(YES)), it means that the voting data 407 and the voting log 4075 have been properly recorded in the original recording medium, and the voting in the legal sense is confirmed. When the vote is confirmed, in order to notify the voter that the vote is confirmed, in step D19, the vote confirmation LED 203
4 is output to the substrate arranged via GPIO, and the vote confirmation LED 2034 is turned on. The lighting state is maintained until the voting card 406 is ejected and pulled out by the voter's hand. Even if the system goes down by the time the voting card is ejected, the lighting state is saved with a high probability.

Next, steps D20 to D in FIG.
In 33, the voting data 407 is copied to the duplicate recording medium 409. A copy of voting data 407 is
The voting data on the RAM 435, which is collated with the voting data recorded on the original recording medium 407 and confirmed to match, is recorded on the duplicate recording medium 409. Therefore, at the time of recording on the duplicate recording medium, file access to the original recording medium 408 is not performed, and processes that may cause a failure are excluded as much as possible. Now, in step D20, the voting log storage file on the duplicate recording medium 409 is opened, and in step D21, the voting start log is recorded on the duplicate recording medium. The voting start log is a character string such as “start recording in duplicate”.

When the recording of the voting start log is completed, the file is closed (step D22) and the next step D2.
3, the file for storing voting data on the duplicate recording medium 409 is opened. And step D2
In 4, the content of the voting stored internally in the RAM 453 is written in the file opened on the duplicate recording medium. Writing is performed at high speed using a cache area (not shown) inside the RAM 453. When writing is completed, the file is closed and a file having a duplicate of voting data is generated (step D2).
5). Further, in steps D26 to D28, the voting end log (for example, a character string such as "end recording in duplicate") is written on the duplicate recording medium 408. When the writing of the voting data 407 and the voting log 4075 to the duplicate recording medium 409 is completed, the process waits for the cache to be discharged (dump) in step D29, and then proceeds to the next step.

Steps D30 to D33 are steps for collating (verifying) the voting data 407 recorded in the duplicate recording medium 409. That is, step D3
At 0, the voting data storage file (file closed at step D25) of the duplicate recording medium 409 is opened, and at step D31,
The voting data 407 in the file is read.
The read voting data 407 is stored in a work area (not shown) of the RAM 453 in step D32.
The voting data stored in the memory space managed by the voting program 404 is compared and collated. Step D33
When the collation is normally performed in the conditional branch of (No in step D33), the next step D34
Move on to.

When the collation is not normally performed, an error screen indicating that a voting data write failure has occurred is output to the LCD 20311 and the operation indicator lamp 2
A blinking signal is output to 0301b. In steps D34 to D37 after the collation is successful, the duplicate recording medium 4 is recorded.
The voting log 4075 recorded in 09 is collated by a similar process. It is preferable to be able to confirm which of the voting data 407 is normal when a failure occurs. This confirmation is displayed by an electronic voting device as much as possible, but it is necessary to carefully examine the data in the recording medium depending on the degree of failure. Since the detailed examination is done at the ballot counting place, it is necessary to have voters voted in the event of a failure to make a preliminary self-voted vote and put it in an envelope.

FIG. 25 is a diagram showing an example of the hardware configuration of a card issuing machine which issues an operation card applied to this embodiment. The hardware configuration of the card issuing machine 201 can be realized by a personal computer (PC) having a general processing speed. The ticket issuing machine card reader / writer 2012 that issues the operation card 405 and the voting card 406 is an IC card reader / writer in this embodiment, and can be connected to the PC body by a USB interface (USB: Universal Serial Bus) or the like.

FD can be used as the ticket issuing machine medium 202 for storing the card authentication key 403 distributed from the selection and the type 402 of the holding election at the polling place. Further, the random number generator 20120 does not need to be particularly connected when the random number is generated by software.
It is used only when generating a physical random number described later. HD
The D (HDD: Hard Disk Drive) stores data such as an OS, a ticket issuing program 504 described later, and an electoral list. The ticket issuing machine display 2011 is a cathode ray tube (CR
T: Cathode Ray Tube) or liquid crystal (LCD) type may be used. A keyboard and a mouse can be used as the input device.

FIG. 26 is a diagram showing an example of the software configuration of a card issuing machine for issuing the operation card 405 applied to this embodiment. The ticket issuing program 504 illustrated in FIG. 26 includes a ticket issuing machine media reading unit 531, a card reading unit 532, a polling place ID generating unit 533, and a ticket issuing data recording unit 5.
34, and a ticket issuing control unit 535.

The card reading section 532 is for the card issuing machine 20.
Controls the reading of the card inserted in 1. Polling station I
The D generation unit 533 generates a polling place ID that is an identification number unique to the polling place. The ticket issuing data recording unit 534 records the data shown in FIG. 21 on the voting card 406 or the operation card 405. In particular, in the case of an operation mode in which the card authentication key 403 is distributed to the IC card distributed from the selection without recording, the ticket issuing data recording unit 53
4 has a function of recording the card authentication key in the IC card.

The ticket issuing control unit 535 shown in FIG. 26 controls the screen displayed on the ticket issuing machine display 2011.

FIG. 27 is a diagram showing an example of the data structure of the ticket issuing machine medium applied to this embodiment. The ticket issuing machine medium 202 stores a card authentication key 403, a type 402 of the open election, and a ticket issuing program 504.

FIG. 28 is a diagram showing the types 402 of open elections stored in the ticket issuing machine medium applied to this embodiment. An ID of the election to be conducted at the polling place where the card issuing machine 201 is installed is recorded in the type 402 of the election to be distributed from the election. The figure shows that elections with election ID = 1 and election ID = 3 must be conducted. These election IDs are the voting cards 406
21 is referred to when the ticket is issued, and a voting flag is set in the voting flags 2022a and 2022c of the voting card shown in FIG.

FIG. 29 is a flow chart showing an example of the polling place ID generation unit 533 which constitutes the ticket issuing program applied to this embodiment. In step S2301,
Random number data is input in real time. This may be input from the outside, or may be input generated by calculation in the card issuing machine 201. The input random number is taken into the RAM 20118 (S2
302). When the voting manager performs an appropriate key input using the keyboard, the data between the predetermined addresses on the RAM 20118 is cut out and stored in the manager ID (polling place ID) buffer (S2305), and preparation for writing to the operation card is made. If it is possible, the value of the buffer is output (S2
306) Confirm the polling place ID 4055.

30 and 31 are flow charts showing the flow of the electronic voting system using the operation card 405 and the voting card 406 applied to this embodiment. The electronic voting system creates election data (candidate data 4015, etc.) prior to the election date (voting date) at the time of election by electronic voting.
An electronic voting device 203 which is installed at each polling place on the election date and receives the vote by the elector (voter) using the data transferred from the election data creation system.
And a polling place system 200 including a card issuing machine 201 that issues a card (voting card 406 or operation card 405) from which the electronic voting device can read information, and is illustrated in FIGS. 30 and 31. The steps are as follows. The steps will be described in detail below.

First, before the voting start time on the voting day,
The election data creation system 100 generates in advance a card authentication key 403 relating to authentication of reading the card (voting card 406 or operation card 405) S18.
Has 01. As a specific embodiment of the card authentication key 403, a card equipped with an IC (Integrated Circuit) chip as a card, that is, in the case of using an IC card, is used for reading data recorded encrypted in the IC chip. Examples include a decryption key and password.
These are realized by an arbitrary combination of numerical values or character strings.

Next, the authentication key 40 common to all polling places created by the election data generation system 100.
3 is input to the electronic voting device 203 and the card issuing machine 201. Step S1802 is included. For example, FD
A card authentication key 403 is recorded on a portable recording medium such as a memory card or a memory card, and the card authentication key 403 is transferred to each polling place and read by the electronic voting device 203 and the card issuing machine 201 (in the case of the electronic voting device, FIG. RAM 453 in the electronic voting device 203 and RAM in the card issuing machine 201 via the duplicate recording medium slot 20304 in FIG.
The authentication key 403 is stored on the 20118. In this way, the card authentication key 403 to be distributed to each polling place is standardized, and the voting program 404 and the candidate data 40 are further shared.
1 is also shared, and a duplicate recording medium 40 of the same content
9 is distributed, it is possible to suppress the occurrence of human error during media delivery to each polling place to an extremely low level.

Next, the card issuing machine 201 installed at each polling place has a management identification code 4055 (polling place ID, management I
D, also called polling place ID) Step S180
Have three. The polling place ID 4055 can be implemented by an arbitrary numerical value string or character string generated using a random number or the like, or an arbitrary combination thereof. Since the management identification code 4055 is, in principle, a code different for each polling place, it is also called a polling place ID.

Next, using the card issuing machine 201, an operation card 405 which is an IC card managed and owned by a voting manager (different from the staff of the election management committee who issued the card authentication key 403) at each polling place. The card authentication key 403 and polling place ID 4055 are recorded in step S1.
804. In addition, as another embodiment, the present invention does not record the card authentication key 403 in the media at each polling place as described above, but operates the operation card when the election data creation system 100 generates the authentication key 403. Four
It is also possible to record it on a blank media for 05 and distribute it to the voting manager of each polling place. In this case, at the polling place, with respect to the operation card 405 in which the card authentication key 403 is recorded in advance, the polling place ID 40
Only record 55.

Next, the card authentication key 403 and polling place ID
The voting card at the polling place takes out the operation card 405 in which 4055 is recorded from the card issuing machine 201 and transfers it to the electronic voting device 203 in the same polling place S18.
Have 05.

Next, the operation card 405 is inserted into the voting card recording / reading means 2032 of the electronic voting apparatus 203 (step S1805a), the card authentication key 403 recorded in the operation card 405, and the R of the electronic voting apparatus 203.
It has step S1806 of collating with the card authentication key recorded on AM453. For example, the electronic voting device 2
03 is the authentication key 40 for the IC chip of the operation card
3 is transmitted and it is determined whether the password for reading the IC chip can be released. Alternatively, if the data in the IC chip is not plaintext but ciphertext, it is determined whether or not decryption is possible.

Next, in the conditional branch of step S1807, only when the collation is normally performed (step S1
“YES” at 807), the card type (ID of voting card or operation card) recorded on the card is read (step S1808). If the card type is an operation card (“YES” in step S1808a), the process moves to the next step.

Next, the electronic voting device 203 has a step S1809 for reading the management identification code 4055 recorded in the operation card 405. If it is read normally (“YES” in step S1810), it is stored and accumulated in the RAM 453 of the electronic voting device (step S1810).
1811), the card insertion waiting screen is displayed on the LCD screen 2031.
(Step S1812), the electronic voting device becomes ready to vote.

In this way, the management identification code 4055 generated by the card issuing machine 201 on the day of voting is propagated to each electronic voting device installed in the same polling place as the card issuing machine 201. Through these series of steps, the card issuing machine 201 in the polling place and the (usually a plurality of) electronic voting devices 203 have the same management identification code 40.
It will be managed by 55 (polling place ID), and only the voting card 406 having this management identification code can be accepted.

Since the above-described series of steps is a step for making the electronic voting apparatus ready to start voting, it is preferable to perform it before the voting start time on the day of voting. Before this step, no person can start voting after the electronic voting device is installed on the day before the voting day and on the day of the voting day. As described above, the operation method of the electronic voting system using the operation card has an effect that not only the cost of special security can be reduced but also the transparency of the election operation can be secured by a simple method.

It should be noted that these operations are not necessarily required to be performed by the voting manager. For example, a voting card 406 issued to an elector who first came to the polling place is used as a substitute for an operation card, and in the presence of a voting manager, the ticket issuing machine 201 to the electronic voting device 20 are used.
It is also possible to operate so as to propagate the polling place ID to No. 3. In such a case, the operation card is not necessary, only the voting card, polling place ID (management identification code)
It will be a form of operation that propagates.

Of the above steps, if the verification of the card authentication key 403 fails (step S180).
7 “NO”), or the card type is the operation card 40
If it is not 5 (“NO” in step 1808a, or if the management identification code (polling station ID) could not be read normally (“NO” in step S1810))
In step S1813, the operation card 405 is ejected by the card ejection processing, and the electronic voting device displays a card insertion waiting screen (illustrated in FIG. 32).

Next, steps after the voting start time will be described with reference to FIG. First, management identification I
FIG. 32 shows the electronic voting device 203 storing D4055.
A card insertion waiting screen as shown in FIG. 11 is displayed (step S1901). In FIG. 31, the card ticket issuing machine 201 is used by all the polling stations in common with all the polling stations for the elector (voter) whose identity is confirmed by the polling station staff at the reception of the polling station comparing with the electoral list. Authentication key 403
And a step S1902 of issuing a voting card 406 in which a management identification code 4055 unique to the polling place is recorded. The voting card 406 is an activator that makes the electronic voting device ready for voting when it is inserted into the electronic voting device 203. The voting card 406 is shown in FIG. 6 in addition to the management identification code (polling place ID) 4055. Electoral Characteristics I
D2021 (code of input / output means selectable according to type of disability of elector), voting flag 202 for identifying whether voting is possible or not for the election ID of the election to be conducted
2 etc. are recorded.

Next, referring to FIG. 31, the elector manually transfers the ticket from the ticket issuing machine 201 to the electronic voting device 203.
The elector has a step S1903 of inserting the voting card 406 into the electronic voting device 203. That is, the elector receives the voting card 406 issued at the polling place from the voting manager, and then the electronic voting device 20 installed in the polling place.
The card is inserted into the voting card recording / reading means 2022 toward 3. The voting card is mechanically taken into the electronic voting device 203 by the card transport mechanism.

Next, the electronic voting device 203 causes the RAM
Step S1 of reading the voting card 406 by using the authentication key 203 stored on 453 and collating the authentication key.
904. This is a step in which the card control unit 415 of the voting program 404 determines whether or not the data can be read before reading the data. When the collation is performed (“YES” in step S1905), the process proceeds to the next step. When the collation cannot be performed normally (“NO” in step S1905), the voting card is ejected from the voting card recording / reading unit 2022 (step S1914), and the process returns to step S1901 in the voting card input waiting state.

When the verification of the card authentication key is normally performed, there is a step of reading the card type. That is, a code for identifying whether the inserted card is a voting card or an operation card is read (step S1906).
This is shown as a card type in FIG.
If the card type is a voting card (step S
1907, "YES"), and proceeds to the next step. if,
When the card type is the operation card or the identification code cannot be normally read (“NO” in step S1907), the card discharge process (step S1914) is performed, and the process returns to step S1901.

Next, there is a step S1908 of reading the management identification code 4055 of the voting card 406. If it is read normally (step S1908).
“YES” in a)), and moves to the next step. If the reading fails, the process returns to step 1901 through step S1914 of the card ejection process.

Then, the management identification code 4055 read from the voting card 406 and the RA of the electronic voting device 203
It has step S1909 of collating with the management identification code 4055 stored in advance on M453. This is a step of checking the validity of whether the voting card 406 inserted in the electronic voting device 203 is a card which is surely issued by the ticket issuing machine 201 of the polling place where the electronic voting device is installed. is there. If a card issued by a ticket issuing machine other than the polling place is used, those voting cards will not be accepted in step S1914 of the card ejection process. It is also extremely difficult to forge a voting card. Since the management ID recorded on the voting card is issued on the day of the voting day, it is virtually impossible to manufacture the counterfeit card prior to the voting day. Also, on the voting day, the voting card is read-protected by the authentication key, and since the data is initialized after the voting is finished as described above, it is extremely difficult to steal the management ID. . In this way, the risk of fraudulent voting due to misuse of the voting card can be virtually eliminated.

Finally, only when the management identification code 4055 is successfully collated ("YES" in step S1910), the election information recorded in the voting card is read (step S1911), and the read election candidate is read. It has a step S1913 in which a screen for selecting a person is displayed (step S1912), and the elector starts the voting operation by the electronic voting device 203. The elector uses the voting program 404 that operates inside the electronic voting device 203 to
The candidate selection screen displayed on the touch panel LCD 2031 is selected and operated to vote.

FIG. 32 is a diagram showing an example of a voting card input waiting screen displayed on the LCD 20311 of the electronic voting device 203 applied to this embodiment. Guidance "Please insert a voting card" is given by text and voice, and the position of the card recording / reading means 2032 of the electronic voting device 203 and the insertion direction of the voting card 406 are animated so that the voters can easily understand. . At the bottom right of the screen, the number of votes cast by this electronic voting device is displayed as the number of votes. The first voter is
Confirm that this display is 0 (zero vote confirmation) and start voting. The voting card input waiting screen is created by the voting screen creating unit 433 of the voting program 404 by referring to the fixed screen layout table 401d and the display message table 401f in the candidate data 401, and displayed on the LCD 20311.

FIG. 33 is a diagram showing an example of a voting card removal waiting screen displayed on the LCD 20311 of the electronic voting device 203 applied to this embodiment. When the voting is completed and the voting card 406 is automatically ejected from the card record reading means 2032, the elector who voted for the voting said, "The voting has been completed. Please remove the voting card and return it to the staff. Guidance "." The voting card extraction waiting screen is the voting screen creating unit 4 in the voting program 404.
33, the fixed screen layout table 401d and the display message table 4 in the candidate data 401 are displayed.
01f is created by referring to it and displayed on the LCD 20311.

FIG. 34 is a diagram showing an example of a candidate selection screen of the electronic voting device 203 applied to this embodiment.

FIG. 35 is a diagram showing an example of a candidate selection screen (when the button is pressed) of the electronic voting device 203 applied to this embodiment.

FIG. 36 is a diagram showing an example of a voting intention confirmation screen of the electronic voting device 203 applied to this embodiment.

FIG. 37 is a diagram showing an example of the voting intention confirmation screen (when the button is pressed) of the electronic voting device 203 applied to this embodiment.

FIG. 38 is a diagram showing an example of the card authentication key 403 applied to this embodiment. Card authentication key 4
Reference numeral 03 is a key for accessing the data of the IC card, and is realized as a string of numbers or characters as shown in the figure. In the electronic voting system applied to this embodiment, the card authentication key 403 is created by pipe selection, and the same card authentication key is distributed to all polling stations. As a form of distribution of the card authentication key 403, there is a method of inputting the card authentication key 403 to an IC card (voting card 406 or operation card) in advance by pipe selection and then distributing it to the polling place.
Alternatively, the card authentication key 403 is distributed to the polling place by a recording medium other than the IC card, and the IC
The card authentication key 403 may be introduced into the card.

FIG. 39 is a diagram showing an example of the input / output means determined by the electoral characteristic ID 2021 which defines the voting mode applied to this embodiment. The first column is a numerical value indicating the electoral characteristic ID 2021, and the second column is a specific example of the corresponding electoral characteristic. The electoral characteristics are non-disabled, visually impaired, deaf, impaired limb, internal impaired, and any combination thereof. Then, for the same electoral characteristic, the notifying means 20305 and the input means 20306 to be used are different as shown in the columns of the fourth and fifth columns of FIG. 16 depending on the weight of the disability grade. For example, elector characteristic I
For the elector who is a non-disabled person (normal person) whose D2021 is “00”, the LCD 203 of the electronic voting device 203
1, a voting screen for healthy persons is displayed, a touch panel is used as the input means 20306, and an LCD is used as the notification means 20305.
To use.

The electoral characteristic ID 20 shown in FIG.
Electors of visually impaired people (6th grade) whose 21 is "01" (one with a visual acuity of 0.02 or less and the other with a visual acuity of 0.6 or less measured by the Universal Eyesight Chart) The sum of eyesight is 0.2
(The number exceeding 100), a voting screen for the low vision is displayed on the display unit 2031 of the electronic voting device 203, and the touch panel 2031 is used as the input unit 20306.
3. The LCD 20311 is used as the notification means 20305. On the other hand, the elector of the visually impaired (first grade) whose elector characteristic ID 2021 is “02” (the sum of the visual acuity of both eyes is 0.0
(1 or less), the LC of the electronic voting device 203
A voting progress screen (a screen displaying only the progress status of the voting without displaying the voting contents such as the candidate name) is displayed on D20311 to prevent the secret of the voting from being leaked to the caregiver. Dedicated keyboard for the disabled 2
As the 0381 and the notification means 20305, the voice guidance using the headphone with volume adjustment 20391 and the speaker 2033 is used.

Further, the electoral characteristic ID 2021 is "0.
3 ”for electives of the visually impaired (blind deaf) who have a sum of visual acuity of both eyes of 0.01 or less and a hearing level of both ears of 100 decibels or more. A voting progress screen (a screen for displaying only the progress status of the voting without displaying the voting contents such as the candidate's name) is displayed on the LCD 20311 of the voting device 203 to prevent the leakage of the voting secret to the caregiver, and the input means. As 20306, a dedicated keyboard 20381 for visually impaired persons and a notification means 2030
A kana character pin display (or braille display) is used as 5.

For an elector who has a physically disabled person (upper limb amputation or upper limb dysfunction) whose electoral characteristic ID 2021 is “04”, the same voting screen as a normal person is displayed on the LCD 2031 of the electronic voting device 203. As the input means 20306, a foot switch capable of inputting with a keyboard (not shown) for physically handicapped persons or feet, and as the notification means 20305 LC
Use D. On the other hand, the electoral characteristic ID 2021 is "0.
For the elector of the physically disabled (general movement or dysfunction) which is 5 ”, the voting progress screen (voting without displaying the voting contents such as the candidate name) is displayed on the display unit 2031 of the electronic voting device 203. Screen displaying only the progress status of
Is displayed to prevent leakage of the secret of the vote for the caregiver, and the push switch 203 for motor dysfunction that can be input as the input means 20306 even if there is involuntary movement is displayed.
71, a head mount display, which is an eyeglass type display device that is fixed to the head and used as the notification means 20305, is a barrier-free head mount display terminal 20302.
Connect to and use.

The screen displayed on the head-mounted display used by the elector having the electoral characteristic ID = 05 is a scan input screen in which selectable items (that is, the reverse display portion in FIG. 37) are automatically switched at fixed time intervals. To use. Furthermore, the electoral characteristic ID 2021 is "0.
For an elector with an internal obstacle (obfuscation) of 6 ”, a voting screen for healthy persons is displayed on the display unit 2031 of the electronic voting device 203, a touch panel is used as the input unit 20306, and an LCD is used as the notification unit 20305. However, the progress of the screen and the voice guide are played back slowly. Thus, the electoral characteristic ID for all disabilities
By providing the input means 20306 and the notification means 20305 by adding the above, it becomes possible to provide the voting mode to all the electors, and the electronic voting device 203 can be universally designed. It should be noted that what kind of notification means and input means are suitable for actual voting has been empirically clarified by a simulated voting experiment conducted for persons with disabilities and elderly people nationwide.

40 to 42, an example of the flow from the notification by the candidacy of the election to the vote by the elector and the vote counting by the vote manager will be described. Figure 4
0 is a flow chart showing the flow of preparation for voting of the electronic voting device applied to this embodiment. On the day of the voting day, after the voting manager confirms that the power of the electronic voting device is turned off in step S201, the electronic voting device is started up, and the first elector is ready to wait for the "zero vote" confirmation. Done.

1) Sending the voting program 404, candidate data 401, and card authentication key 403 to the polling place The election data master 400 created in advance in step S204a is inspected and approved by the election management committee (step S204b). ), Is copied by the election data media copying machine 102 to a memory card which is a duplicate recording medium 409 for the electronic voting device 203 (step S204c), and is sent to each polling place together with the original recording medium 408. Therefore, at all polls,
Data such as the card authentication key 403 is common. Usually, it will be sent by the day before the voting date. 2) Creation of operation card The voting manager uses the voting card issuing machine 201 to create an operation card 405 to which a unique polling place ID is added. The polling place ID is a numerical value uniquely generated using, for example, a random number, and in principle, the polling place ID is different for each polling place. 3) Install voting program, candidate data, card authentication key before the start of election The voting administrator who holds the key of the padlock 2030a and the operation card 405 (IC card) unlocks the front door 2030, and the original recording medium 408. And the duplicate recording medium 409 are attached to the electronic voting device 203 (steps S203, S
204), the voting program 4 from the duplicate recording medium 409
04, candidate data 401, and card authentication key 403 are installed (step S210). 4) Recording Medium Attachment The original recording medium 408 and the duplicate recording medium 409 are usually attached at the time of the advance operation check on the day before the voting day, and are locked and managed by the padlock 2030a. In this way, the selected person who issued the card authentication key 403 and the polling place ID
Both voting managers of the polling place that issued the will be involved in security, and transparency of election management can be increased.

Next, an example of voting for a single election (single expression) will be described with reference to FIG. In actual elections, there are elections in which multiple candidates are selected from the candidate list, such as the national examination of a Supreme Court judge, but here we will explain only the single-entry election in which a single candidate is selected. FIG. 41 is a single election by the electronic voting system applied to this embodiment (single note type).
4 is a flowchart showing an example of the flow of the voting of “No. 1) Confirmation of "zero vote" The first elector at the polling place confirms the "zero vote" by the zero vote confirmation function in the presence of the vote manager and the vote observer (step S702). The zero vote confirmation function is, for example, a function of displaying the number of votes recorded in the original recording medium 408 of the electronic voting device, that is, the number of voting data 407 as the number of votes in the card insertion waiting screen. The “zero” vote confirmation is established at the time when the authentication of the operation card 405 is completed (“OK” in step S705) 2) Start of the electronic voting device After the confirmation of the “zero vote” is completed, the voting manager uses the operation card. A voting start procedure is performed and a voting card input waiting function is activated (step S709). That is, polling place ID40
55 is stored in the RAM 435 of the electronic voting device, and the voting card 406 can be accepted. The electronic voting device is started when the operation card 405 is removed from the electronic voting device. 3) Start of voting With the voting card input waiting function (step S709), the elector inserts the voting card 406 issued by the card issuing machine 201 into the electronic voting device 203 (step S7).
10), using the card authentication key 403, voting card 4
Voting place I recorded 06 on the voting card 406
D4055 and the polling place ID4055 on the RAM 435 of the electronic voting device are compared and collated. Only when the verification is successful, the voting right (that is, the voting flag 2022) recorded on the voting card 406 is read, and electronic voting is performed only when the voting right information (that is, the voting flag 2022 is “votable”) can be confirmed. The device function is activated (“OK” in step S711). At the same time as confirmation, voting card 40
The data area 6 is initialized and all data is erased (step S712). Initialization of the voting card is to completely eliminate the fear of illegal voting due to reuse of the card. The start of voting is established when the voting card is initialized. 4) Candidate selection In the candidate selection function (step S713) of displaying a screen as shown in FIG. 34 on the LCD screen, the elector selects the candidate by touching the candidate's name with a finger or a stylus pen. A selection is made (step S714). 5) Confirmation of Candidate Selection With the candidate confirmation function that displays a screen as shown in FIG. 36 on the screen of LCD 20311 (step S715), the elector confirms by touching the confirmation button with a finger or a stylus pen. (Step S716). 6) Recording Voting Data on Original Recording Medium According to the confirmation in 5) above, the voting data 407 is first recorded on the original recording medium 408 (step S71).
7). Next, the voting log 4075 is the original recording medium 40.
8 is recorded (step S717a). 7) Confirmation of voting and lighting of voting confirmation LED Voting data 407 and voting log 4 on the original recording medium 408.
After 075 is recorded, the vote confirmation LED 2034 is turned on (step S718). To confirm the vote, the voting data 407 and the voting log 4075 are recorded in the original recording medium 40.
It is established when the recording is confirmed in step 8 (step S71).
8) 8) Backup recording of voting data on duplicate recording medium Next, the same voting data 407 and voting log 4075 are recorded on the duplicate recording medium 409 for backup (steps S719 and S720). Note that the voting data 407 is not encrypted in this embodiment.
In the future, when the voting data 407 is transmitted via the network, DES encryption (DES: Data Encryption Stan
common key cryptography such as dard) or RSA cryptography (RSA: Rivest-
The voting data 407 may be encrypted by public key cryptography such as Shamir-Adleman) and decrypted when the votes are counted. 9) Completion of voting At the same time that the voting card 406 is ejected (step S721), the voting card removal waiting function (step S722) that displays a screen as shown in FIG. 33 and the voice guide guide the voting, and the election is conducted. The person removes the voting card 406 (step S723). The voting is completed when the voting card 406 is ejected. 10) Turn off the voting confirmation LED When the voting card is removed, the voting confirmation of the voting data L
The ED2034 is turned off (step S724). 11) Prevention of Double Voting Since the voting card 406 that has been ejected after the voting has been initialized, it is determined that the voting card has already been inserted even if the voting card is inserted again (“NO” in step S711), and the double voting is performed. Is prevented. 12) Voting for the second and subsequent persons The above 3) to 10) are repeated. 13) Reissue of voting card 1. Insert the voting card that was successfully issued. 2. A read error or an initialization write error by the electronic voting device 203 has occurred. 3. It is clear that no tampering has been done. 4. Collect the voting card and prohibit reuse of the voting card. 5. Reissue the voting card to the elector.

FIG. 42 is a flow chart showing the termination flow of the electronic voting device by the electronic voting system applied to this embodiment. 1) Closing the polling place The voting manager who holds the key of the padlock 2030a and the operation card 405 (IC card) performs the closing process of the polling place and the ending process of the voting under the presence of a voting observer (step S801). ~ S813). 2) Removal of the original recording medium and the duplicate recording medium in which the voting data is recorded The voting manager opens the front door 2032 of the electronic voting device 203 which stores the original recording medium 408 and the duplicate recording medium 409. Open, power switch 20 of this electronic voting device
The power is cut off by 32. After that, the original recording medium 4
08 and the duplicate recording medium 409 are taken out (step S8).
14, S815). 3) Sending of voting data The original recording medium 408 and the duplicate recording medium 409 are stored in the sending storage box (step S816), locked, and sent to the counting place.

FIG. 43 is a flow chart showing an example of the flow of processing when a recoverable error occurs in the electronic voting system applied to this embodiment. Here, the error means that the voting program 404 can be detected and is assumed in advance at the time of manufacturing. "Errors" are classified into the following two types. 1. "Recoverable error" that can be recovered by retrying 2. Unrecoverable "unrecoverable error""Recoverableerror" is a failure that occurs when there is a defective connection related to a barrier-free device connection failure voting card. Specifically, 1. There is a mistake in inserting the voting card from the front or back or in the vertical direction, or a reading error due to the insertion of the voted card. If the card itself is defective, there is no means to confirm the voting right, so a separate operational agreement is required. 2. Barrier-free device (keyboard 2 for the visually impaired)
It is conceivable that the 0381, the headphones 20391, and the push switch 20371 for motor dysfunction may be misconnected or disconnected. When a recoverable error occurs, the recovery is basically performed according to the screen display function, and the barrier-free device is reconnected or the voting card 406 is reinserted to recover. If the symptom is not improved by this, it is treated as an unrecoverable error in operation. The "unrecoverable error" is output when the voting program determines that the subsequent voting operation cannot be performed. The voting manager must take measures according to the items displayed on the screen and stop using the electronic voting device.

Now, in step S101 in FIG. 43, the voter (elector) inserts the voting card 406. Next, in the conditional branch of step S102, the voting right of the voter recorded on the voting card is confirmed, and it is assumed that there is no voting right recorded on the voting card, that is, the ticket has already been initialized or has not been issued (step "Voted (initialized)" in S102), move to step S105,
After displaying the type of recoverable error (that is, that voting has been completed) on the LCD 20311 of the electronic voting device 203,
In step S106, the voting card 406 is ejected. When the voting card 406 is ejected, step S10
In step 7, the voter and voting assistant
Check the error content displayed in. In this case, LC
D20311 displays that the voting card has been voted.

After confirming the error content, step S108
At, when the voter removes the ejected voting card, in step S109, the LCD 20311 enters a voting card insertion waiting state (shown in FIG. 32). Then, in step S110, a process of recovering from an error is performed by the voter and / or the vote assistant. Specifically, when it is confirmed by the voter's self-declaration and the testimony of the vote observer that the voter has not actually finished voting by using the vote card 406, the vote card issuing machine 201 The voting card 406 is reissued. In step S111, the voter reinserts the reissued voting card 406 and redoes the voting.

If a reading error of the voting card 406 occurs in the conditional branch of step S102 ("card identification is not possible" in step S102), the recoverable error type (that is, card identification is not possible) in step S105. LCD of the electronic voting device 203
After displaying on 20311, the voting card 406 is ejected in step S106. When the voting card 406 is ejected, the voter and the voting assistant display the LCD 20311.
Check the error content displayed in. In this case, LC
D20311 displays that the inserted card could not be recognized. After confirming the error content, when the voter removes the ejected card in step S108, the LCD 20311 is displayed in step S109.
Becomes a voting card insertion waiting state (shown in FIG. 32).
Then, in step S110, a process of recovering from an error is performed by the voter and / or the vote assistant. Specifically, the voting card ticket issuing machine 201 reissues the voting card 406. The voter reinserts the reissued voting card 406 in step S111,
The voting will be redone.

In the conditional branch of step S102, if the voting right of the voting card 406 is confirmed (“votable” in step S102), the elector characteristic 2021 is read in step S103, and the elector characteristic ID =
00, that is, whether to use the barrier-free I / O option. If elector characteristic ID =
If it is not 00 (“YE
S "), in step S104, it is confirmed whether the input / output device (illustrated in FIG. 39) corresponding to the electoral characteristic ID is connected. If the input / output device corresponding to the read electoral characteristic ID is not connected in the conditional branch of step S104 (“NO” in step S104), the type of recoverable error in step S105 (that is, the input / output device is (Not connected)
Is displayed on the LCD 20311 and the voting card 406 is ejected in step S106.

When the voting card 406 is ejected, the voter and the voting assistant are notified by the LCD 2 in step S107.
Check the error content displayed in 0311. In this case, the LCD 20311 displays that the headphones 20391 voting card has already been voted. After confirming the error content, in step S108, if the voter removes the discharged voting card 406, step S1
At 09, the LCD 20311 enters a voting card insertion waiting state (shown in FIG. 32). And step S1
At 10, a voter and / or vote assistant recovery process from the error is performed. Voter is step S1
At 11, the reissued voting card 406 will be reinserted and the voting will be redone.

In the conditional branch of step S104, it is assumed that the input / output device corresponding to the read electoral characteristic ID is normally connected ("YE" in step S104).
S "), initialization processing of the voting card 406 is performed in step S112. In the next step S113, the candidate selection screen is displayed on the LCD 20311,
Voters perform voting operations. If, for example, the plug of the headphone 20391 is disconnected from the headphone terminal 2039 during the voting operation (“NO” in step S114). In that case, step S
Due to the recoverable error display function of 115, a display indicating that the headphone terminal 2039 is not connected is displayed on the LCD 203.
11 is displayed. Then, in step S116, the process of recovering from an error by the voter and / or the vote assistant, that is, the connection of the headphone terminal is performed. When the connection is normally established, the screen returns to the candidate selection screen, and the voter continues voting in step S117.

FIG. 44 is a diagram showing an example of a voting log recording the operation history of the electronic voting device applied to this embodiment. The voting log 4075 is a record of all operation histories performed by the electronic voting program 404 of the electronic voting apparatus 203 as time series data. The time information is the year, month, day, hour, as shown in the "Time" column.
The processing is represented by minutes and seconds, and the processing corresponding to each time is stored in the “function classification” column and the “processing” column. For example, the processing (layout setting: candidate button, etc.) in a record (row) in which the function classification column is “select candidate” is the voting program 404.
Candidate selection screen made by the voting screen creation unit 433 of FIG.
The details of the creation process (shown in FIG. 4) are sequentially recorded. If an error occurs during voting, this voting log 4
By analyzing 075, it becomes possible to grasp the cause of failure. Note that these data are text files in an appropriate format such as CSV (Comma Separated Value (format): a file format in which items are separated by commas) in the recording medium 408 for the original and the recording medium 409 for the duplicate. Is saved as.

FIG. 45 is a sequence diagram showing an example of the flow from voting to completion by the electronic voting device applied to this embodiment. First, the screen shown in FIG. 32 is displayed by the voting card insertion waiting function of the voting program 404. Next, an elector inserts a voting card 406 into the card R / W 2032. Voting program 404
Detects that a voting card has been inserted, transmits a card authentication key 403. The card R / W writes the card authentication key 403 in the recording unit of the IC card, and returns a return value from the IC card, that is, a code indicating whether access is possible, to the voting program. When access is possible, the voting program 404 is a card type I which is a code for identifying the voting card 406 or the operation card 405.
D (illustrated in FIG. 21) is read. If card R / W
When it is read from 2032 that the card type ID is the voting card 406, the electoral characteristic ID 2021 and the voting flag 2022 are read from the voting card 406.

When these data are stored in the RAM 435, the voting program 404 opens the file for writing the voting log 4075 on the original recording medium 408, and the log relating to the voting card insertion processing is written (Fig. 45, all logs are voting logs 407
5). When the log recording is completed and the file is closed, the voting program 404 executes R
The cache existing in the cache area on the AM 435 is discharged. When the ejection of the cache is completed, a file for writing the voting log 4075 is opened on the duplicate recording medium 409, and the log having the same content as that recorded on the original recording medium 408 is written. When writing of the voting log 4075 to the duplicate recording medium 409 is completed, the file is closed and the cache is discharged.

Then, the voting program 404 outputs a lighting signal to the GPIO interface of the operation indicator lamp 20301b. The lighting of the operation indicator 20301b informs the voting manager and the voting witness that the voting has started. The voter touches the touch panel 20 according to the candidate selection screen (shown in FIG. 34) and the voting intention confirmation screen (shown in FIG. 36) displayed on the LCD 20311.
A voting operation is performed by touching 313. In a series of voting operations, all operation records of the electronic voting device 203 such as screen switching and touch panel operation are recorded in the form of a voting log as shown in FIG. 44 in the original recording medium 408 and the duplicate recording medium 409. , Respectively, and the ejection of cash is performed.

When the voter touches “I will vote” in the voting intention confirmation screen (shown in FIG. 36), the voting data recording unit 434 of the voting program 404 causes the voting of the candidate selected on the RAM 435. The data 407 is written to the original recording medium 408. And R
After the cache on AM435 has been spit out,
Voting data 407 created on the original recording medium 408
The file is opened and read again on the RAM, and comparison and verification (verification) are performed, and it is confirmed that the file is ensured. Then, the voting log is written to the original recording medium 408. Although not shown in the figure,
Also in writing the voting log, the generated voting log file is read after the cache is discharged, and the verification is performed.

Next, when writing of the voting data 407 and voting log 4075 to the original recording medium 408 is completed,
The voting program 404 outputs to the GPIO port a signal for turning on the voting confirmation LED 2034 for notifying the voter that the voting has been confirmed.

Next, when the vote confirmation 2034 is turned on, the voting program 404 performs the copy processing of the voting data 407 and the voting log 4075 on the duplicate recording medium 409. That is, the voting program 404 opens the file on the duplicate recording medium 409, and after writing the voting data 407 stored in the RAM 435, closes the file. And RAM4
After the discharge of the cache on 35 is completed, the file is opened again, the data is read into the RAM, the file is closed, and the data in the RAM are compared to verify. Then, with respect to the copy of the voting log 4075, recording and cache ejection are similarly performed.

Next, when recording of the voting data 407 and voting log 4075 on the original recording medium 408 and the duplicate recording medium 409 is completed, the voting program 404 is executed.
As a result, an instruction to eject the voting card 406 is transmitted to the card R / W. When the voting card is mechanically ejected by the transport mechanism, the voting program 404 records a log on the original recording medium 408 and the duplicate recording medium 409. At this time, similar to the processing so far, each time the writing to each recording medium is completed and the file is closed, the cache is ejected,
After that, the file is opened and the written data is verified.

Next, when the voter ejects the ejected voting card from the card R / W 2032, the voting program 404 issues an instruction to turn off the signals output to the voting confirmation LED 2034 and the operation display lamp 20301b. Is output. By turning off the operation indicator 20301b,
You will be notified that the voting has been completed. Voting logs for these processes are similarly recorded in the original recording medium 408 and the duplicate recording medium 409.

FIG. 46 is a schematic sequence diagram showing the time adjustment of the internal timepiece of the electronic voting device applied to this embodiment. After the voting start time on the voting day, the first voter who operates the electronic voting device 203 performs zero vote confirmation in the presence of the voting witness. Specifically, it is visually confirmed that the display of "voting number" shown at the lower right of the voting card insertion waiting screen shown in FIG. 32 is 0. After the confirmation of the zero votes, the vote manager has to start voting.
Insert the operation card 405. When the voting program 404 detects that an operation card has been inserted into the card R / W 2032, the voting program 404 sends the card authentication key 403 to the card R / W 2032. When the return value from the IC card for the card authentication key 403 received by the card R / W 2032 is access permission, the voting program 404 reads the card type ID. When the card type is the operation card 405, the following clock adjustment processing is performed.

That is, the voting program 404 stored in the RAM 435 sends a command to the radio wave receiving unit 458 to prompt reception of the standard radio wave. The radio wave receiving unit 458 amplifies the amplitude-modulated radio wave received by the antenna,
After filtering, demodulation (detection) is performed and a time code (time code) including standard time information is output. The time code returns to the voting program 404. The voting program 404 calculates the standard time by performing decoding by identifying 0 and 1 from the pulse width of the received time code. The voting program 404 corrects the internal clock 457 according to the obtained standard time. After these clock adjustment processes, the voting program 404 reads the time of the built-in clock set to the standard time, and when time data is acquired from the built-in clock, the time stamp is used to start recording the log. That is, for the original recording medium 408 and the duplicate recording medium 409,
Record the time adjustment log. By performing such time adjustment processing with respect to all the electronic voting devices 203 that are not connected to the network, the time is synchronized with the standard time, and the accurate voting log 4075 can be created.

Next, the data recorded on the operation card 405 is read, and the polling place ID 4055 is stored in the RAM 435. When the polling place ID 4055 is stored, the log is written to the original recording medium 408 and the duplicate recording medium 409 after referring to the time of the internal clock. When the writing is completed, the operation card 405 is ejected, and when it is detected that the operation card 405 is taken out by the voting manager, the original recording medium 408 and the duplicate recording medium 4 are recorded.
The log is written to 09.

Further, although the sequence in which the voting manager receives the standard radio wave when the operation card 405 is inserted has been described, this can also be configured so that the voter can use the voting card 406 in the same manner. Is. Voting card 40
By configuring the time adjustment every time 6 is inserted, more accurate time adjustment can be performed. However, when it takes time to receive the radio wave depending on the type of radio wave used and the reception state, there is an operation mode in which the operation card 405 is used only once immediately after the voting start time as described above. preferable. Or voting card 4
The reception request may be issued each time 06 is inserted, and the time may be adjusted only when reception is possible.

The present invention uses 40 kH in the above embodiment.
It is not limited to standard radio waves of z or 60 kHz,
It goes without saying that it may be a time signal carried by FM radio waves known as "visible radio" or radio waves by GPS (Global Positioning System) or the like.

[0178]

As described above in detail, according to the present invention, in an electronic voting device having a function of storing the operation record of the device, the standard time signal is received to correct the built-in clock before starting the voting, and the devices are offline with each other. By synchronizing the built-in clock of the electronic voting device in the state with the standard time, the time of the operation record recorded by each electronic voting device can be consistent, and the correct analysis of the failure factor becomes possible, and the electronic voting system This has the effect of improving reliability.

Further, according to the present invention, when the voting manager inserts the operation card and shifts the electronic voting device to the voting enabled state, the built-in clock is automatically corrected using the standard radio wave, and after the start of the voting, the standard clock is standardized. By configuring to record the time stamp of the log by the built-in clock synchronized with the time,
It is possible to reduce the work load of the time adjustment performed by the voting manager on the plurality of electronic voting devices at the polling place, and it is possible to dramatically improve the accuracy of time adjustment.

Further, according to the present invention, a general-purpose quartz watch and a low-priced radio wave receiving device are combined to correct the time of the general-purpose quartz watch without using an expensive high-quality quartz watch. As a result, the manufacturing cost of the electronic voting device can be reduced, the price of the electronic voting device can be reduced, and the spread of electronic voting can be promoted.

[Brief description of drawings]

FIG. 1 is a diagram showing a schematic configuration of a preferred embodiment of an electronic voting system using an electronic voting device of the present invention.

FIG. 2 is a perspective view showing an example of the exterior of an electronic voting device applied to this embodiment.

FIG. 3 is a perspective view showing an example of the exterior of the electronic voting device applied to this embodiment.

FIG. 4 is a top view showing an example of the exterior of the electronic voting device applied to this embodiment.

FIG. 5 is a front view showing an example of the exterior of the electronic voting device applied to the present embodiment.

FIG. 6 is a front view (when the front door is open) showing an example of the exterior of the electronic voting device applied to the present embodiment.

FIG. 7 is a rear view showing an example of the exterior of the electronic voting device applied to the present embodiment.

FIG. 8 is a diagram showing an example of a hardware configuration inside an electronic voting device applied to the present embodiment.

FIG. 9 is an RA inside an electronic voting device applied to this embodiment.
It is a figure which shows an example of the data structure of M.

FIG. 10 is a diagram showing an example of a data structure inside a silicon disk applied to this embodiment.

FIG. 11 is a diagram showing an example of the structure of a voting program applied to the present embodiment.

FIG. 12 is a diagram showing an example of a structure of candidate data applied to the present embodiment.

FIG. 13 is a diagram showing an example of a candidate table (for election ID = 1) that constitutes candidate data applied to the present embodiment.

FIG. 14 is a diagram showing an example of a political party table that constitutes candidate data applied to the present embodiment.

FIG. 15 is a diagram showing an example of a polling place group table constituting candidate data applied to this embodiment.

FIG. 16 is a diagram showing an example of a fixed screen layout table constituting candidate data applied to this embodiment.

FIG. 17 is a diagram showing an example of a voting screen layout table (for election ID = 1) that constitutes the candidate data applied to the present embodiment.

FIG. 18 is a diagram showing an example of a display message table constituting candidate data applied to this embodiment.

FIG. 19 is a diagram showing an example of a data structure of an original recording medium stored in the electronic voting device applied to the present embodiment.

FIG. 20 is a diagram showing an example of a data structure of a duplicate recording medium stored inside the electronic voting device applied to the present embodiment.

FIG. 21 is a diagram showing an example of the data structure of a voting card or an operation card inserted in the electronic voting device applied to this embodiment.

FIG. 22 is a diagram showing an example of a data structure of a voting flag recorded in a voting card applied to this embodiment.

FIG. 23 is a flowchart showing an example of the processing flow of the card reading unit which constitutes the voting program applied to this embodiment.

FIG. 24 is a flowchart showing an example of a processing flow of a voting data recording unit which constitutes a voting program applied to this embodiment.

FIG. 25 is a diagram showing an example of a hardware configuration of a card issuing machine that issues an operation card applied to this embodiment.

FIG. 26 is a diagram showing an example of a software configuration of a card issuing machine which issues an operation card applied to this embodiment.

FIG. 27 is a diagram showing an example of a data structure of a ticket issuing machine medium applied to the present embodiment.

FIG. 28 is a diagram showing types of open elections stored in a ticket issuing machine medium applied to the present embodiment.

FIG. 29 is a flowchart showing an example of a polling place ID generation unit which constitutes a ticket issuing program applied to the present embodiment.

FIG. 30 is a first half flow chart showing a flow of a method of operating an electronic voting system using an operation card and a voting card applied to this embodiment.

FIG. 31 is a second half flow chart showing the flow of the method for operating an electronic voting system using an operation card and a voting card applied to this embodiment.

FIG. 32 is an LCD of an electronic voting device applied to this embodiment.
It is a figure which shows an example of the voting card input waiting screen displayed in FIG.

FIG. 33 is an LCD of an electronic voting device applied to this embodiment.
It is a figure which shows an example of the voting card extraction waiting screen displayed in FIG.

FIG. 34 is a diagram showing an example of a candidate selection screen of the electronic voting device applied to this embodiment.

FIG. 35 is a diagram showing an example of a candidate selection screen (when a button is pressed) of the electronic voting device applied to this embodiment.

FIG. 36 is a diagram showing an example of a voting intention confirmation screen of the electronic voting device applied to the present embodiment.

FIG. 37 is a diagram showing an example of a voting intention confirmation screen (when a button is pressed) of the electronic voting device applied to this embodiment.

FIG. 38 is a diagram showing an example of a card authentication key applied to this embodiment.

FIG. 39 is a diagram illustrating an example of an electoral characteristic ID that defines a voting mode applied to the present embodiment.

FIG. 40 is a flowchart showing the flow of preparations for voting by the electronic voting device applied to this embodiment.

FIG. 41 is a flow chart showing an example of the flow of voting for a single election (single note type) by the electronic voting system applied to this embodiment.

FIG. 42 is a flowchart showing a termination flow of the electronic voting device by the electronic voting system applied to this embodiment.

FIG. 43 is a flowchart showing an example of the flow of processing when a recoverable error occurs in the electronic voting system applied to this embodiment.

FIG. 44 is a diagram showing an example of a voting log recording an operation history of the electronic voting device applied to the present embodiment.

FIG. 45 is a sequence diagram showing an example of the flow from voting to termination by the electronic voting device applied to this embodiment.

FIG. 46 is a sequence diagram showing an example of the flow of clock adjustment of the built-in clock of the electronic voting device applied to this embodiment.

[Explanation of symbols]

100 Election Data Creation System 101 Election Data Management Creation Machine 102 Election Data Media Copier 200 Voting Place System 201 Voting Card Ticketing Machine (Card Issuing Machine) 202 Ticketing Machine Media 203 Electronic Voting Device 300 Voting Place System 301 Voting Data Collection and Aggregation Machine 400 Election data master 401 Candidate data 401a1 Candidate table 401b Political party table 401c Polling place group table 401d Fixed screen layout table 401e1 Voting screen layout table 401f Display message table 402 Type of election (election type data) 403 Card authentication key ( Authentication Key) 404 Electronic Voting Program (Voting Program) 405 Operation Card (Administrator Card) 406 Voting Card 407 Voting Data 408 Original Recording Medium (Original ) 409 Duplicate recording medium (duplicate, duplicate) 411 Operating system (OS) 412 Serial I / O control unit 413 Window control unit 414 File control unit 415 Card control unit 416 Touch panel control program 417 Printer control program 418 Junction box control program 431 Card reading unit 432 Election data reading unit 433 Voting screen creation unit 434 Voting data recording unit 435 Voting control unit 436 Loading program (program loader) 450 Motherboard 451 CPU 452 ROM 453 RAM (RAM disk) 454 Silicon disk (system disk) 454b Local Disk area 455 Junction board 456 VRAM (video RAM) 457 Built-in clock (RTC) 458 Radio wave reception 504 Ticket issuing program 531 Ticket issuing machine media reading section 532 Card reading section 533 Polling place ID generating section 534 Ticket issuing data recording section 535 Ticket issuing control section 2011 Ticket issuing machine display 2012 Ticket issuing card reader / writer 2021 Electoral characteristic ID (physical disability characteristic) 2022 Voting flag 2030 Front door 2030a Padlock 2030b Lock bracket 2031 Display unit 2031a Stylus pen 2031b Pen holder 2032 Card recording / reading means (card reader / writer,
Card R / W 2032a Card guide LED (Card insertion guide L
ED) 2033 Speaker 2033a Volume 2034 Voting confirmation LED (voting confirmation confirmation LED) 2035 Slide cover 2036 LCD angle adjusting arm 2037 Motor function impairment push switch terminal 2038 Visually impaired dedicated keyboard terminal 2039 Headphone terminal 4055 Polling place ID (management) ID, management identification ID, management identification code, random number 4075 Voting log 20117 CPU (ticketing machine) 20118 RAM (ticketing machine) 20119 HDD (ticketing machine) 20120 Random number generator 20301 Status display lamp 20301a Power indicator 20301b Operation indicator 20301c Pole 20301d Status indicator light cable 20302 External display terminal 20303 Original recording medium slot 20304 Duplicate recording medium slot 20305 Informer 20306 Input means 20307 Silicon disk storage unit 20308 Power supply LED (LED for AC power supply monitoring) 20310 Front door open / close sensor 20311 LCD (liquid crystal display) 20312 Inverter 20313 Touch panel 20314 Built-in battery (internal battery) 20315 DC power supply (DC power supply) 20316 AC Power supply (AC power supply) 20371 Push switch 20381 for motor function disorders Special keyboard 20391 for visually impaired persons Headphones with volume adjustment (headphones)

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Tadashi Aizawa             3-12 Moriya-cho, Kanagawa-ku, Yokohama-shi, Kanagawa             Local Victor Company of Japan, Ltd. F-term (reference) 3E038 AA03 BA09 BB01 KA01

Claims (3)

[Claims] 1. An electronic voting device having means for recording a history of voting operations performed by an elector before selecting and confirming a desired candidate at the time of voting by electronic voting, the standard including Japanese standard time information. Radio wave receiving means, decoding means for decoding standard time from the standard radio wave, control means for correcting an internal clock based on the decoded standard time, and recording means for recording the corrected time together with a history of voting operations And an electronic voting device. 2. The electronic voting device according to claim 1, further comprising means for confirming zero votes prior to the start of voting. 3. The method further comprising means for reading an operation card inserted by a voting manager prior to the start of voting, and means for receiving the standard radio wave when the operation card is normally read. The electronic voting device according to claim 1.