JP3864913B2 - Electronic voting system, secret key delegation method, and secret key delegation program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic voting system capable of voting using a computer and obtaining a result of voting immediately after the end of voting, and in particular, in this electronic voting system, a receiving device for verifying the validity of a voting card and voting The present invention relates to a secret key delegation method capable of securely delegating the authority of a secret key of a device from a vote manager who is responsible for a polling place to an accepting person using an IC card.
[0002]
[Prior art]
In recent years, an electronic voting system has been developed that has the feature that “voting can be performed using a computer and the result of counting votes can be obtained immediately after the voting is completed”. According to this electronic voting system, voting sentences voted by a voting device are recorded on a recording medium and counted by a counting device, so that counting errors can be prevented without human intervention.
[0003]
Here, a voting procedure in the conventional electronic voting system will be described.
Conventionally, in electronic voting, a voter presents a voting postcard at a reception, and then issues a voting card instead of a conventional ballot. The voter inserts the voting card into the voting apparatus and performs voting, and then returns the voted voting card to the reception.
[0004]
When the voting card is issued, the reception device records the signature of the reception device on the voting card together with the reception information such as the voter ID and the reception time. In the voting device, based on the signature of the receiving device, the voting card inserted when the voter voted is a voting card issued by a valid receiving device and that the contents of the voting card have not been tampered with. Validate.
[0005]
In addition, Patent Documents 1 to 6 shown below as inventions that disclose the technology for confirming the legitimacy of the voter who voted from the voting device and preventing the illegal vote by eliminating the padding operation at the time of counting. The disclosed invention is known.
[0006]
[Patent Document 1]
Japanese Patent Laid-Open No. 7-028915
[Patent Document 2]
JP-A-8-016680
[Patent Document 3]
JP-A-11-296607
[Patent Document 4]
Japanese Patent Laid-Open No. 2001-216101
[Patent Document 5]
JP 2001-273468 A
[Patent Document 6]
JP 2001-306788 A
[0007]
The invention disclosed in Japanese Patent Application Laid-Open No. 7-028915 as Patent Document 1 is that in order to realize safe anonymous voting, the number of votes is not increased while ensuring the anonymousness of voting. The purpose is to provide an electronic voting method that can be confirmed. For this reason, in the invention described in Patent Document 1, an elector owns an IC card, a polling place has a reception terminal and a voting terminal, a center has a counting device and a voter list, Receives the identity confirmation at the reception terminal, sends the voter signature created with the IC card to the reception terminal, the reception terminal sends the voter signature to the center, and the counting device of the center has all voter names and voters It is characterized by publishing a list of voters who registered voter signatures for.
[0008]
The invention disclosed in JP-A-8-016680 as Patent Document 2 is an electronic voting system in which reception and voting are performed by individual terminals, only for legitimate electors having regular voting rights and voting rights. The goal is to provide a system that allows voting. For this reason, in the invention described in Patent Document 2, the voter ID is registered before the voting operation by the operation of the voting terminal by interposing the registration process of the voting permission ID after the individual authentication of the elector by the operation of the reception terminal. And an ID check process, the voting permission ID set at the time of reception is not used, so that voting is not possible.
[0009]
An object of the invention disclosed in Japanese Patent Application Laid-Open No. 11-296607 as Patent Document 3 is to provide an electronic voting system using public key cryptography that can accurately realize secrecy of voting contents and multiple voting refusal. It is said. For this reason, the invention described in Patent Document 3 encrypts the contents of the vote with the public key of the totalizer in the encryption unit for the totalizer of the encryption / signature device, and encrypts the voter's signature with the voter's private key. The voter signature verification unit of the voter management device verifies the voter's signature with the public key of the voter to determine multiple votes, encrypts the administrator's signature with the administrator's private key, and counts the votes Sent to the device, and the vote counting device verifies the administrator's signature with the administrator's public key to determine whether or not it is an invalid vote. Accumulate as a summary list.
[0010]
An object of the invention disclosed in Japanese Patent Laid-Open No. 2001-216101 as Patent Document 4 is to provide a data output device that does not require a password to be exchanged between a confidential data sender and a confidential person. For this reason, when receiving the confidential data from the host computer or the like, the data output device disclosed in the invention described in Patent Document 4 serves as notification data to the confidential person (the confidential person computer) that is the destination of the confidential data. Send an email. The confidential person returns a password and output control parameters from the confidential person computer to the data output device. In the data output device, these data are stored in the hard disk in association with confidential data. Thereafter, when the confidential person inputs a password from the operation display unit, it is determined whether or not the password matches that stored in the hard disk. If the password matches, the printer unit prints out the password.
[0011]
The invention disclosed in Japanese Patent Application Laid-Open No. 2001-273468 as Patent Document 5 is intended to allow the generated key information to be built in the IC card without being read and to issue the IC card in a short time. Yes. For this reason, the invention described in Patent Document 5 includes a means for generating key information, a means for setting an IC card, a means for writing the key information in the set IC card, And a means for preventing tampering.
[0012]
The invention disclosed in Japanese Patent Application Laid-Open No. 2001-306788 as Patent Document 6 is intended to notify / acquire an update status related to information without exchanging update information or the like. For this reason, in the invention described in Patent Document 6, when the information to be updated is held by the information provider and is provided with the electronic signature, the update related to the information of the information provider is performed. It is characterized in that the verification key for verifying the electronic signature is controlled to be valid or invalid depending on the situation.
[0013]
[Problems to be solved by the invention]
However, none of the inventions disclosed in Patent Documents 1 to 6 described above have solved the problems described below.
Since the authority of the private key for generating the signature of the receiving device was not delegated from the vote manager who is responsible for the polling place, the reliability of the signature was dependent on the person in charge of the reception. For this reason, it was possible to conduct an illegal vote when the receptionist and the voter collide.
[0014]
As a means for protecting the secret key in the apparatus, a method of setting a password for access to the secret key is generally used. The user can use the private key only after entering the password and activating the private key. However, if the secret key in the reception device is stolen, anyone who knows the secret key password can activate the secret key and use the secret key. By tampering with the contents and signing, it was possible to add more votes by double voting.
[0015]
The present invention has been made in view of the above circumstances, and the authority of the polling place is the authority of the reception device for verifying the validity of the voting card using the IC card and the secret key of the voting device. It is an object of the present invention to provide an electronic voting system, a secret key delegation method, and a secret key delegation program that can be securely delegated from a vote manager to a receptionist.
[0016]
[Means for Solving the Problems]
In order to achieve such an object, the invention described in claim 1 includes a receiving device that issues a voting card, a voting device that inputs a voting card and performs voting, and a voting manager that manages the receiving device and the voting device. An electronic voting system comprising a voting manager card in which a secret key is written, and voting a signature character string signed with the voting manager's secret key on the password of the accepting apparatus for starting the accepting apparatus. A secret key password for activating the secret key of the apparatus is set.
[0017]
The invention according to claim 2 is the invention according to claim 1, wherein the accepting device activated by inputting the password of the accepting device receives the secret of the vote manager from the vote manager card when the password of the vote manager is entered. When the key is read and the signature character string signed with the secret key of the voting manager is set as the secret key password for activating the secret key of the accepting device and the voting device, the secret key password and the acceptance Write the public / private key pair of the accepting device generated in the device and the public / private key pair of the voting device to the voting manager card, and the voting device inputs the voting manager's password The secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card, and the secret key password is used to activate the secret key of the voting device. And setting the over-de.
[0018]
The invention according to claim 3 is the invention according to claim 2, wherein the accepting device reads the secret key password, the secret key of the accepting device, and the public key of the voting device each time the device is activated. The voting device reads the secret key password, the public key of the accepting device, and the secret key of the voting device from the voting manager card each time the device is activated, and the accepting device and the voting device read with the stop of power supply. It is characterized by deleting the key and secret password.
[0019]
The invention according to claim 4 is the invention according to claim 2 or 3, comprising a plurality of accepting devices, a secret key password, a public key and a secret key of the accepting device, a public key and a secret key of the voting device, The reception device that has generated the secret key password, the public key of the reception device and the private key key pair, the public key of the voting device and the key pair of the private key, and the other reception device Reads the secret key password, the secret key of the accepting device, and the public key of the voting device from the vote administrator card, and sets the secret key password as a password for activating the secret key of the accepting device. And
[0020]
The invention described in claim 5 is a receiving device that issues a voting card, a voting device that inputs the voting card for voting, and a voting in which a secret key of a voting manager who manages the receiving device and the voting device is written. A secret key delegation method in an electronic voting system comprising an administrator card, wherein a signature character string signed with the vote manager's secret key is used as a password of the accepting device for starting the accepting device. A secret key password for activating the secret key is set.
[0021]
The invention according to claim 6 is the invention according to claim 5, wherein in the accepting device activated by inputting the password of the accepting device, when the password of the vote manager is entered, the secret of the vote administrator from the vote admin card When the key is read and the signature character string signed with the secret key of the voting manager is set as the secret key password for activating the secret key of the accepting device and the voting device, the secret key password and the acceptance Write the public / private key pair of the accepting device generated in the device, and the public / private key pair of the voting device to the voting manager card, and the voting device's password is entered in the voting device Reads the secret key password, the public key of the accepting device, and the secret key of the voting device from the voting manager card, and activates the secret key password of the voting device. Characterized in that it set the order of the password.
[0022]
The invention according to claim 7 is the invention according to claim 6, wherein the accepting device reads the secret key password, the secret key of the accepting device, and the public key of the voting device every time the device is activated. The voting device reads the secret key password, the public key of the accepting device, and the secret key of the voting device from the voting manager card every time the device is activated. It is characterized by deleting the key and secret password.
[0023]
The invention according to claim 8 is the invention according to claim 6 or 7, wherein the electronic voting system has a plurality of accepting devices, and a secret key password, a public key and a secret key of the accepting device, and disclosure of the voting device. In the accepting device that generated the key and the secret key, the secret key password, the public key and the secret key of the accepting device, and the public key and the secret key of the voting device are written in the vote manager card in the other accepting device. Reading the secret key password, the secret key of the accepting device, and the public key of the voting device from the vote manager card, and setting the secret key password as a password for activating the secret key of the accepting device, To do.
[0024]
The invention described in claim 9 is a voting device for issuing a voting card, a voting device for inputting a voting card and performing voting, and a voting manager's secret key for managing the receiving device and the voting device. A secret key delegation program in an electronic voting system comprising an administrator card, wherein a signature character string signed with the vote manager's private key is added to the password of the accepting device for starting the accepting device. A secret key password for activating the secret key is set.
[0025]
The invention according to claim 10 is the invention according to claim 9, wherein in the accepting device activated by inputting the password of the accepting device, when the password of the vote manager is entered, the secret of the vote manager is received from the vote administrator card. When the key is read and the signature character string signed with the secret key of the voting manager is set as the secret key password for activating the secret key of the accepting device and the voting device, the secret key password and the acceptance Execute a process of writing the public / private key pair of the accepting device generated in the device and the public / private key pair of the voting device to the voting manager card. If the password is entered, the secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card, and the secret key password is the secret of the voting device. The and executes the processing of setting the password to activate.
[0026]
The invention according to claim 11 is the invention according to claim 10, wherein the accepting device reads the secret key password, the secret key of the accepting device, and the public key of the voting device each time the device is activated. The voting device reads the secret key password, the public key of the accepting device, and the secret key of the voting device from the voting manager card every time the device is activated. It is characterized by deleting the key and secret password.
[0027]
The invention according to claim 12 is the invention according to claim 10 or 11, wherein the electronic voting system has a plurality of accepting devices, and includes a secret key password, a public key and a secret key of the accepting device, and disclosure of the voting device. In the accepting device that generated the key and the private key, execute a process of writing the secret key password, the public key and secret key of the accepting device, and the public key and secret key of the voting device to the vote manager card, etc. Read the private key password, the private key of the accepting device, and the public key of the voting device from the voting manager card, and set the secret key password as a password for activating the private key of the accepting device. A process is executed.
[0028]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the electronic voting system, secret key delegation method, and secret key delegation program of the present invention will be described in detail with reference to the accompanying drawings. 1 to 14 show an embodiment of an electronic voting system, a secret key delegation method, and a secret key delegation program of the present invention.
[0029]
First, the configuration of the present embodiment will be described by dividing it into means functioning at the time of initial setting, means functioning at the time of activation of the reception / voting device, and means functioning at the time of voting reception. FIG. 1 shows the configuration of a receiving device 100, a vote manager card 200, and a voting device 300 that function during initial setting.
As shown in FIG. 1, the accepting device 100 at the time of initial setting includes accepting device password input means 101, accepting device password authentication means 102, vote manager password input means 103, secret key password storage unit 104, accepting A device key pair generation unit 105, a reception device private key / public key storage unit 106, a voting device key pair generation unit 107, a voting device private key / public key storage unit 108, a voting manager card writing unit 109, To work.
[0030]
Further, as shown in FIG. 1, the voting manager card 200 at the time of initial setting includes a voting manager password authenticating unit 201, a voting manager secret key storage unit 202, a signature data generating unit 203, and a secret key password storage. The unit 204, the accepting device private key / public key storage unit 205, and the voting device private key / public key storage unit 206 are caused to function.
[0031]
The accepting device password input unit 101 inputs a “accepting device password” for starting the accepting device 100 that is set in advance by the accepting person. The input “reception device password” is notified to the reception device password authentication means 102. The accepting device password authentication unit 102 authenticates the “accepting device password” input by the accepting device password input unit 101.
[0032]
The vote manager secret key storage unit 202 in the vote manager card 200 stores the secret key of the vote manager. The “vote manager password” is input by the vote manager password input unit 103 and is authenticated by the vote manager password authentication unit 201 in the vote manager card 200 inserted in the receiving apparatus 100. If the “administrator password” is correct, it is possible to obtain the secret key of the vote manager stored in the vote manager secret key storage unit 202.
[0033]
The signature data generation unit 203 is a unit for signing the password of the reception device input by the reception device password input unit 101 with the secret key of the vote manager, and the generated signature text is received as the private key password. It is stored in the private key password storage unit 104 in 100. Note that the secret key password written in the secret key password storage unit 104 is deleted from the secret key password storage unit 104 when the operation of the receiving apparatus 100 ends.
[0034]
The accepting device key pair generating unit 105 is a unit that generates a secret key and a public key of the accepting device 100, and the generated secret key is stored in the accepting device secret key / public key storage unit 106. The secret key and public key of the accepting device are written into the accepting device private key / public key storage unit 205 in the vote manager card 200 by the voting card writing means 109. The accepting apparatus 100 erases the secret key and public key of the accepting apparatus from the accepting apparatus private key / public key storage unit 106 when the operation of the accepting apparatus ends.
[0035]
The voting device key pair generation unit 107 is a unit that generates a secret key and a public key of the voting device 300, and the generated public key is stored in the voting device private key / public key storage unit 108. The secret key and public key of the voting device are written into the voting device private key / public key storage unit 206 in the voting manager card 200 by the voting manager card writing unit 109. The accepting device 100 deletes the secret key and public key of the voting device from the voting device private key / public key storage unit 108 upon completion of the operation of the accepting device.
[0036]
The voting manager card writing unit 109 stores the secret key and public key of the receiving device generated by the receiving device key pair generating unit 105 in the receiving device private key / public key storage unit 205 in the voting manager card 200. The secret key password stored in the secret key password storage unit 104 is stored in the voting device secret key / public key storage unit 206 in the vote manager card 200 with the secret key and public key of the voting device generated by the key pair generation unit 107. Is written in the secret key password storage unit 204 in the vote manager card 200.
[0037]
Here, the configuration of the vote manager card will be described with reference to FIG.
The vote manager card 200 is written with the secret key of the vote manager, the key pair of the accepting device secret key and the public key generated by the accepting device 100, and the secret key and public key pair of the vote device. It is.
[0038]
The voting device 300 includes a voting manager password input authentication unit 301, a voting manager card reading unit 302, a voting device private key storage unit 303, a receiving device public key storage unit 304, and a private key password storage unit 305. And have.
[0039]
The voting device 300 inputs and authenticates the above-mentioned voting manager password by the voting manager password input means 301, and reads the secret key of the voting device from the voting manager card 200 inserted into the voting device 300 when the authentication is successful. Then, the public key of the accepting device is read into the voting device private key storage unit 303, the private key password is read into the accepting device public key storage unit 304, and is written into the private key password storage unit 305. In addition, the voting device 300 erases the public key of the receiving device, the secret key of the voting device, and the secret key password when the operation of the voting device ends.
[0040]
Next, means functioning when the reception / voting apparatus is activated will be described with reference to FIG.
As shown in FIG. 3, the accepting device 100 at the time of activation includes accepting device password input means 101, accepting device password confirmation means 102, vote manager password input means 103, secret key password storage unit 104, and vote management. The person card reading means 110, the accepting device private key storage unit 111, and the voting device public key storage unit 112 are caused to function.
[0041]
Further, the vote manager card 200 causes the vote manager password authenticating means 201 and the secret key password storage unit 204 to function as shown in FIG.
[0042]
The accepting device password input unit 101 inputs an accepting device password that is input by the accepting person when the accepting device is activated. The accepting device password authentication unit 102 authenticates the accepting device password input by the accepting device password input unit 101.
[0043]
The secret key password storage unit 204 in the vote manager card 200 stores a secret key password that is a password for activating the secret keys of the accepting device 100 and the voting device 300. As a result of inputting the password of the voting manager from the voting manager password input means 103 and authenticating by the voting manager password authenticating means 201 in the voting manager card 200 inserted in the receiving apparatus 100, the password of the voting manager is correct. In this case, the private key password stored in the private key password storage unit 204 can be acquired.
[0044]
If the result of authentication by the voting manager password authenticating means 201 is correct, the secret key password, the secret key of the accepting apparatus, and the public key of the voting apparatus are stored in the accepting apparatus 100 by the voting manager card reading means 110. Is read. The read secret key password is stored in the secret key password storage unit 104, the secret key of the accepting device is stored in the accepting device secret key storage unit 111, and the public key of the voting device is stored in the voting device public key storage unit 112. . Note that the secret key password, the secret key of the accepting device, and the public key of the voting device are erased from the secret key password storage unit 104 (memory) when the operation of the accepting device ends.
[0045]
Further, as shown in FIG. 3, the voting device 300 at the time of activation includes a voting manager password input authentication unit 301, a voting manager card reading unit 302, a receiving device public key storage unit 304, and a voting device secret key storage. The unit 303 and the secret key password storage unit 305 are caused to function.
[0046]
In the voting device 300, when the voting device is activated, the voting manager password input authenticating unit 301 inputs the password of the voting manager for authentication. When the validity of the password is authenticated by the vote manager password input authentication means 301, the secret key password stored in the vote manager card 200, the secret key of the voting device, and the public key of the accepting device are the voting manager. It is read into the voting apparatus 300 by the card reading means 302. The read private key password is stored in the private key password storage unit 305 on the memory of the voting device 300, the private key of the voting device is stored in the voting device private key storage unit 303, and the public key of the receiving device is the receiving device public key. Each is stored in the storage unit 304. The secret key password, the secret key of the voting device, and the public key of the accepting device are deleted from the secret key password storage unit 305 (memory) when the operation of the voting device ends.
[0047]
Next, means functioning at the time of voting reception will be described with reference to FIG.
As illustrated in FIG. 4, the reception device 100 at the time of receiving a vote causes a signature verification unit 130 and a signature generation unit 140 provided in the reception device 100 to function. In the signature verification unit 130, the voting card reading unit 110, the voting device signature storage unit 113, the voting information storage unit 114, the voting device public key storage unit 112, and the voting device signature verification unit 115 function when a vote is accepted. . The signature generation unit 140 includes a secret key password storage unit 104, a reception device private key storage unit 111, a reception information generation unit 116, a reception device private key activation unit 117, a reception device signature generation unit 118, The voting card writing means 119 functions at the time of voting acceptance.
[0048]
When the voting card 400 is inserted into the accepting device 100, the voting card reading means 110 reads the voting information from the voting card 400 and the “voting device signature” obtained by signing this voting information with the secret key of the voting device, It is stored in the voting information storage unit 114 and the voting device signature storage unit 113.
[0049]
The voting device signature verification means 115 verifies the “signature of voting information” using the public key of the voting device stored in the voting device public key storage unit 112.
[0050]
Next, the reception information generation unit 116 of the signature generation unit 140 generates reception information such as a reception device number and reception time for identifying the reception device.
[0051]
The accepting device private key activating means 117 activates the accepting device private key stored in the accepting device private key storage unit 111 using the private key password stored in the private key password storage unit 104.
[0052]
The reception device signature generation unit 118 generates a “reception device signature” obtained by signing the reception information generated by the reception information generation unit 116 with a “reception device private key”.
[0053]
The voting card writing unit 119 writes the generated reception information and “signature of the reception device” on the voting card 400.
[0054]
The voting card 400 is provided with a voting information storage unit 401, a voting device signature storage unit 402, a reception information storage unit 403, and a reception device signature storage unit 404.
Here, the configuration of the voting card 400 will be described with reference to FIG.
As shown in FIG.
1. Polling place code (ID assigned to each polling place)
2. Reception device number (reception device number)
3. Entry number (a unique number in each receiving device)
4). Reception time (reception time)
5). Number of effective elections (number of election codes)
6). Election type classification (determining the presence or absence of voice guidance on the voting device)
7). Signature of accepting device {Signature for 1 to 6 described above (using private key of accepting device)}
8). Voting status (to be voted when voting ends)
9. Voting status update time (voting status update time)
10. Voting receipt (receipt sentence for encrypted vote sentence)
11. Voting device signature {Signature for 1 to 10 (using voting device private key)}
Is recorded. Note that 1 to 6 described above are called reception information and 1 to 10 are voting information. The voting information storage unit 401 records the above-described 1 to 10 voting information. The voting device signature storage unit 402 records “voting device signature” obtained by signing the above-described voting information 1 to 10 with the secret key of the voting device. The reception information storage unit 403 records the reception information 1 to 6 described above. The reception device signature storage unit 404 records “signature of reception device” obtained by signing the reception information items 1 to 6 with the private key of the reception device.
[0055]
Next, means of the voting apparatus 300 that functions at the time of voting reception will be described with reference to FIG.
As illustrated in FIG. 4, the voting apparatus 300 causes the signature verification unit 320 and the signature generation unit 330 to function when receiving a vote. The signature verification unit 320 causes the voting card reading unit 310, the reception device signature storage unit 311, the reception information storage unit 312, the reception device signature verification unit 313, and the reception device public key storage unit 304 to function when a vote is received. . In addition, the signature generation unit 330 includes a voting device secret key storage unit 303, a secret key password storage unit 305, a voting device signature generation unit 306, a voting card writing unit 307, a voting information generation unit 308, and a voting device secret. The key activating means 309 is caused to function when receiving a vote.
[0056]
When the voting card 400 is inserted into the voting device 300, the voting card reading means 310 reads the reception information from the voting card 400 and the “signature of the reception device” obtained by signing the reception information with the private key of the reception device. The received information storage unit 312 and the received information signature storage unit 311 store the received information.
[0057]
The reception information signature verification unit 313 verifies the “signature of the reception device” using the public key of the reception device 100 stored in the reception device public key storage unit 314.
[0058]
The voting information generation means 308 generates voting information such as voting status and voting time.
[0059]
The voting device private key activating means 309 activates the voting device private key stored in the voting device private key storage unit 303 using the private key password stored in the private key password storage unit 305. .
[0060]
The voting device signature generation unit 306 generates a “voting device signature” in which the voting information generated by the voting information generation unit 308 is signed with the “voting device private key”.
[0061]
The voting card writing means 307 writes the generated voting information and “voting device signature” on the voting card 400.
[0062]
The present embodiment having the above-described configuration is intended to securely delegate the authority of the voting manager, who is responsible for the polling place, to the person in charge of receiving the reception device.
For this reason, in the present embodiment, the “acceptance” for starting the accepting device, which is preset by the accepting person in the password for activating the secret key for signature generation registered in the accepting device and the voting device. Use the device password "and the voting manager's private key. This makes it possible to verify the validity of the voting card issued by the person in charge of reception in a form in which the authority of the voting manager is securely delegated. Also, a character string obtained by signing the “accepting device password” for starting the accepting device with the secret key of the voting manager is used as the secret key password for activating the secret key of the accepting / voting device. This makes it possible to set a secret key password that is long and highly random that is difficult for human memory.
[0063]
Also, the present embodiment provides a secret key password for activating the secret key of the accepting device and the voting device, a key pair of the secret key and public key of the accepting device, and a public key and secret key of the voting device. The pair is read from the voting manager card to the reception / voting device when the reception / voting device is activated, and is deleted when the power supply to the reception / voting device is stopped. Thus, in order to use the secret keys of the reception device and the voting device, the voting manager card and the voting manager password must be input. Therefore, it is possible to prevent theft of the secret key and to prevent illegal acts such as inflating the vote due to falsification of the voting card.
[0064]
Here, the role of the secret key of the vote manager, the secret key of the reception / voting device, and the public key will be described with reference to FIG.
The secret key of the voting manager is held in the voting manager card 200, and is used to generate a secret key password for the reception / voting device, signature information for the reception / voting device, and log.
[0065]
The accepting device 100 holds a secret key of the accepting device and a public key of the voting device. The voting device 300 holds the secret key of the voting device and the public key of the receiving device.
The contents of the voting card issued at the reception are signed with the private key of the reception device and verified by using the public key of the reception device at the voting device when voting. It is possible to verify whether the contents of the file have been tampered with. Also, after the voting ends, the contents of the voting card are signed with the secret key of the voting device and verified with the public key of the voting device when returned to the reception, until the voting card is returned to the reception after the voting ends It is possible to verify whether or not the contents of the voting card have been tampered with.
[0066]
Next, the operation procedure at the time of initial setting according to the present embodiment will be described with reference to the flowchart shown in FIG. 7 and the diagram showing the operation procedure shown in FIG.
When the accepting device 100 is activated, it requests the input of the password of the accepting device 100 (step A1 and S1 in FIG. 8). The accepting device 100 authenticates the password of the accepting device 100 input by the accepting person using the accepting device password authenticating means 102 (step A2). As a result of the authentication, if the password input by the receptionist is correct (step A2 / YES), a request is made to insert the voting manager card 200 into the card insertion slot of the reception device 100 (step A3). When the voting manager card 200 is inserted into the card insertion slot, the accepting device 100 requests input of the voting manager's password (step A4). The input password of the voting manager is authenticated by the voting manager password authenticating means 201 in the voting manager card (step A5), and if the authentication is successful (step A5 / YES), it is accepted by the accepting device key pair generating means 105. A key pair of the public key and the secret key of the device 100 is generated (step A6 and S2 in FIG. 8). The voting device key pair generation unit 107 generates a public / private key pair of the voting device 300 (step A7 and S2 in FIG. 8). The generated private key / public key pair of the receiving device is stored in the receiving device private key / public key storage unit 106, and the private key / public key pair of the voting device is stored in the voting device private key / public key storage unit 108. Is stored respectively. As a result of authentication, if the password of the reception device 100 and the password of the vote manager are different from the regular one (step A2 / NO or step A5 / NO), a warning message is displayed on the screen of the reception device ( Step A12).
[0067]
Next, the signature data generating means 203 in the vote manager card 200 signs the password of the accepting device 100 input by the accepting person with the secret key of the vote manager (step A8). The signed character string is set as a secret key password for activating the secret keys of the accepting device and the voting device (S3 in FIG. 8), and stored in the secret key password storage unit 104 (step A9).
[0068]
Next, the receiving apparatus 100 uses the voting manager card writing unit 109 to transfer the private key / public key pair of the voting apparatus 300 to the voting apparatus private key / public key storage unit 206 of the voting manager card 200. The private key / public key pair is written in the accepting device private key / public key storage unit 205 of the vote manager card 200 and the private key password is written in the private key password storage unit 204 of the vote manager card 200 (step A10 and S4 in FIG. When the writing of these pieces of information to the voting manager card 200 is completed, the voting manager card 200 is discharged from the insertion slot of the receiving apparatus 100 (step A11). The accepting device erases the private key and public key pair of the accepting device, the private key and public key pair of the voting device, and the secret key password that are generated when the operation ends (power OFF) from the memory. To do.
[0069]
Next, when activated, the voting device 300 requests insertion of the voting manager card 200 into the card insertion slot (step B1). When the voting manager card 200 is inserted into the card insertion slot (step B1), the voting device 300 next requests input of the voting manager's password (step B2). When the vote manager inputs the password of the vote manager (step B2), authentication of the entered password is performed by the vote manager password input authentication means 301 (step B3). When it is verified that the input password of the voting manager is authentic (step B3 / YES), the voting manager card reading means 302 makes the secret key of the voting device 300, the secret key password, and the disclosure of the accepting device. The key is read from the vote manager card 200 (step B4). The read private key of the voting device 300 is stored in the voting device private key storage unit 303, the public key of the receiving device is stored in the receiving device public key storage unit 304, and the private key password is stored in the private key password storage unit 305 (FIG. 8 S5). The voting device 300 sets the read signature character string (secret key password) as a secret key password for activating the secret key of the voting device (step B5).
[0070]
When the setting is completed, the voting device 300 discharges the voting manager card from the card insertion slot of the voting device 300 (step B6). Note that the read secret key password, the secret key of the voting device, and the public key of the accepting device are deleted from the secret key password storage unit 305 (memory) when the operation of the voting device ends (power off).
[0071]
Next, an operation procedure when the acceptance / voting device is activated will be described with reference to the flowchart shown in FIG.
When the accepting device 100 is activated, it requests input of a password for the accepting device 100 (step A20). The accepting device 100 authenticates the password of the accepting device 100 input by the accepting person using the accepting device password authenticating means 102 (step A21). If the password input by the receptionist is correct as a result of the authentication (step A21 / YES), a request is made to insert the voting manager card 200 into the card insertion slot of the reception device 100 (step A22). When the voting manager card 200 is inserted into the card insertion slot, the accepting device 100 requests input of the voting manager's password (step A23). The entered voting manager password is authenticated by the voting manager password authenticating means 201 in the voting manager card (step A24), and if the authentication is successful (step A24 / YES), the voting manager card reading means 110 votes. The private key password, the private key of the accepting device, and the public key of the voting device are read from the administrator card 200. The read private key password is written in the private key password storage unit 104, the receiving device private key is written in the receiving device private key storage unit 111, and the voting device public key is written in the voting device public key storage unit 112. (Step A25). When the reading of these pieces of information is completed, the voting manager card 200 is discharged from the receiving device 100 (step A26).
[0072]
Next, when activated, the voting apparatus 300 requests insertion of the voting manager card 200 into the card insertion slot (step B20). When the voting manager card 200 is inserted into the card insertion slot (step B20), the voting device 300 next requests input of the voting manager's password (step B21). When the password of the vote manager is input by the vote manager (step B21), authentication of the input password is performed by the vote manager password input authentication means 201 (step B22). If the input password of the vote manager is authenticated (step B22 / YES), the vote manager card reading means 302 causes the secret manager password and the reception device's password to be received from the vote manager card 200. Read the public key and the secret key of the voting device. The read private key password is stored in the private key password storage unit 305 of the voting device 300, the public key of the receiving device is stored in the receiving device public key storage unit 304, and the private key of the voting device is stored in the voting device private key storage unit 303. (Step B23).
[0073]
When the reading of these pieces of information is completed, the voting manager card 200 is discharged from the voting device 300 (step B24). If the input password of the vote manager is not correct (step B22 / NO), a warning message is displayed on the voting device 300 (step B25).
[0074]
Next, the operation procedure at the time of voting acceptance will be described with reference to the flowchart shown in FIG. 10 and the diagram showing the operation procedure shown in FIG.
First, the person in charge of reception inserts the voting card 400 into the reception apparatus 100 (step A30). Next, the voting card reading unit 110 reads the voting information and the “voting device signature” from the voting card 400 (step A 31), and writes them in the voting information storage unit 114 and the voting device signature storage unit 113. Each time the voting is completed, the voting card 400 is collected from the hand of the voter, is transferred to the hand of a new voter, and reception information and voting information are written therein. Therefore, the voting card 400 is written with the reception information and the voting information except when it is given to the first voter. This step is omitted for the first voter.
[0075]
Next, the voting device signature verification means 115 verifies the “voting device signature” using the public key of the voting device stored in the voting device public key storage unit 112 (step A32). This makes it possible to verify whether or not the contents of the voting card have been tampered with after the voting by the previous voter and before the voting card 400 is handed to the current voter. If the signature content is not correct (step A33 / NO), a warning message is displayed.
[0076]
If it is verified that the signature content is correct (step A33 / YES), the reception device 100 then generates reception information such as a reception device number and reception time by the reception information generation means 116 (step A34 and FIG. 11 T1).
[0077]
Next, the reception device private key activation means 117 activates the private key of the reception device stored in the reception device private key storage unit 111 with the private key password (step A35 and T2 in FIG. 11), and the reception device. The signature generation means 118 signs the generated reception information with the private key of the reception device (step A36 and T3 in FIG. 11). Then, the voting card writing means 119 writes the reception information and the “signature of the reception device” on the voting card 400 (step A37 and T4 in FIG. 11). After the writing of these information is completed, the voting card is ejected from the accepting device 100 and handed to the voter (step A38).
[0078]
Next, the voter inserts the voting card 400 issued by the receiving device 100 into the card insertion slot of the voting device 300 (step B30). When the voting card 400 is inserted (step B30), the voting device 300 reads the reception information and the “signature of the reception device” from the voting card 400 by the voting card reading means 310 (step B31 and T5 in FIG. 11). The read reception information is written in the reception information storage unit 312 and “signature of the reception device” is written in the reception device signature storage unit 311.
[0079]
Next, the voting device 300 verifies the “signature of the receiving device” using the public key of the receiving device stored in the receiving device public key storage unit 304 (step B32, T6 in FIG. 11). As a result, it is possible to verify whether or not the contents of the voting card have been tampered between the time when the voting card is issued by the receiving apparatus 100 and the time when the voting is performed. If the signature content is not correct (step B33 / NO), a warning message is displayed (step B39).
[0080]
If it is verified that the signature content is correct (step B33 / YES), the voting apparatus 300 then generates voting information such as voting status and voting time by the voting information generating means 308 (step B34 and FIG. 11). T7 and T8).
[0081]
Next, the voting device private key activation means 309 activates the voting device private key stored in the voting device private key storage unit 303 with the private key password (step B35 and T9 in FIG. 11), and the voting device. The signature generation means 306 signs the generated voting information with the secret key of the voting device (step B36 and T10 in FIG. 11). Then, the voting card writing means 307 writes the voting information and the “voting device signature” on the voting card 400 (step B37 and T11 in FIG. 11). After the writing of these information is completed, the voting card is ejected from the voting device 300 and returned to the reception (step B38).
[0082]
Next, a second embodiment according to the present invention will be described.
If there are multiple accepting devices at the polling place, generating a private key / public key pair separately for each accepting device can only verify the signature with a voting device having a public key paired with the private key in the accepting device, For example, the signature verification of the reception information in the voting card issued by the reception device A can be performed only by the voting device A.
[0083]
Therefore, in the present embodiment, as shown in FIG. 12, instead of generating a separate private key / public key pair for each accepting device, the secret key generated by the accepting device A and the secret key are activated. Since the receiving devices all have the same secret key by copying the password to the receiving device B or the receiving device C via the voting manager card, the voter must use the voting card issued by the receiving device. Any voting device can vote.
[0084]
The operation procedure of the second embodiment will be described with reference to the flowchart of FIG. 13 and the configuration diagram of FIG.
The accepting device A that has generated the public key and private key pair of the accepting device and the public key and private key pair of the voting device writes these key pair and secret key password to the voting manager card 200 (step A109), the vote manager card 200 is discharged (step A110).
[0085]
When the accepting device 100B is activated, it requests input of the password of the accepting device (step B100). The accepting device 100B authenticates the accepting device password input by the accepting person using the accepting device password authenticating means 102B (step B101). As a result of the authentication, if the password entered by the receptionist is correct (step B101 / YES), a request is made to insert the voting manager card 200 into the card insertion slot of the reception device 100B (step B102). When the vote manager card 200 is inserted into the card insertion slot, the accepting device 100B requests the input of the vote manager password (step B103). The input voting manager password is authenticated by the voting manager password authenticating means 201 in the voting manager card (step A24), and if the authentication is successful (step B104 / YES), the voting manager card reading means 110B makes a secret. The private key password stored in the key password storage unit 204, the private key of the receiving device stored in the receiving device private key / public key storage unit 205, and the voting stored in the voting device private key / public key storage unit 206 The public key of the device is read (step B105). The read reception device private key is stored in the reception device private key storage unit 111B, the voting device public key is stored in the voting device private key storage unit 112B, and the private key password is stored in the private key password storage unit 104B. The person card 200 is discharged (step B106).
[0086]
The embodiment described above is a preferred embodiment of the present invention. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.
[0087]
【The invention's effect】
As is apparent from the above description, the present invention activates the accepting device preset by the accepting person in the password for activating the secret key for signature generation registered in the accepting device and the voting device. To use the password of the accepting device and the secret key of the vote manager. This makes it possible to verify the validity of the voting card issued by the person in charge of reception in a form in which the authority of the voting manager is securely delegated. In addition, a character string obtained by signing the password of the accepting device for starting the accepting device with the secret key of the voting manager is used as the secret key password for activating the secret key of the accepting / voting device. This makes it possible to set a secret key password that is long and highly random that is difficult for humans to remember.
[0088]
In addition, a secret key password for activating the secret key of the accepting device and the voting device, a key pair of the secret key and the public key of the accepting device, and a key pair of the public key and the secret key of the voting device are accepted. -When the voting device is activated, it is read from the voting manager card into the reception / voting device and deleted when the power supply to the reception / voting device is stopped. Thus, in order to use the secret keys of the reception device and the voting device, the voting manager card and the voting manager password must be input. Therefore, it is possible to prevent theft of the secret key and to prevent illegal acts such as inflating the vote due to falsification of the voting card.
[Brief description of the drawings]
FIG. 1 is a diagram showing each means of a reception device, a voting device, and a voting manager card that function during initial setting.
FIG. 2 is a diagram showing a configuration of a vote manager card.
FIG. 3 is a diagram showing each means of a reception device, a voting device, and a voting manager card that function when the reception voting device is activated.
FIG. 4 is a diagram showing each means of a reception device, a voting device, and a voting manager card that function when a vote is received.
FIG. 5 is a diagram showing a configuration of a voting card.
FIG. 6 is a diagram for explaining a method of using an encryption key.
FIG. 7 is a flowchart showing an operation procedure at the time of initial setting.
FIG. 8 is a diagram showing an operation procedure at the time of initial setting.
FIG. 9 is a flowchart showing an operation procedure when the acceptance voting apparatus is activated.
FIG. 10 is a flowchart showing an operation procedure when a vote is accepted.
FIG. 11 is a diagram showing an operation procedure when a vote is accepted.
FIG. 12 is a diagram for explaining a second embodiment.
FIG. 13 is a flowchart showing an operation procedure of the second embodiment.
FIG. 14 is a diagram showing a configuration of a second exemplary embodiment.
[Explanation of symbols]
100 Reception device
101 Accepting device password input means
102 Accepting device password authentication means
103 Voting manager password input means
104 Private key password storage
105 Accepting device key pair generation means 105
106 Accepting device private key / public key storage unit
107 Voting device key pair generation means
108 Voting device private key / public key storage unit
109 Voting manager card writing means
110 Voting manager card reading means
111 Accepting device private key storage unit
112 Voting device public key storage unit
113 Voting device signature storage unit
114 Voting information storage unit
115 Voting device signature verification unit
116 Reception information generation means
117 Accepting device private key activation means
118 Accepting device signature generating means
119 Voting card writing means
200 Vote manager card
201 Voting manager password authentication means
202 Voting manager private key storage unit
203 Signature data generation means
204 Private key password storage
205 Accepting device private key / public key storage unit
206 Voting Device Secret Key / Public Key Storage Unit
300 Voting device
301 Voting manager password input authentication means
302 Voting manager card reading means
303 Voting device private key storage unit
304 Accepting device public key storage unit
305 Secret key password storage
306 Voting device signature generation means
307 Voting card writing means
308 Voting information generation means
309 Voting device secret key activation means
310 Voting card reading means
311 Accepting device signature storage unit
312 Reception information storage unit
313 Accepting device signature verification means
314 Accepting device public key storage unit
400 voting cards
401. Voting information storage unit
402 Voting device signature storage unit
403 Reception information storage unit
404 Accepting device signature storage unit

Claims (12)

A receiving device that issues a voting card, a voting device that inputs the voting card and performs voting, and a voting manager card in which a secret key of a voting manager who manages the receiving device and the voting device is written An electronic voting system,
The signature character string signed with the secret key of the vote manager is set as the secret key password for activating the secret key of the accepting device and the voting device in the password of the accepting device for starting the accepting device An electronic voting system characterized by that. The accepting device activated by inputting the password of the accepting device reads the secret key of the vote administrator from the vote administrator card when the password of the vote administrator is input, and the password of the accepting device is When the signature character string signed with the secret key of the voting manager is set as a secret key password for activating the secret key of the accepting device and the voting device, the secret key password is generated in the accepting device. Write the public key and private key pair of the accepting device, and the public key and private key pair of the voting device to the voting manager card,
The voting device reads the secret key password, the public key of the accepting device, and the secret key of the voting device from the voting manager card when the password of the voting manager is input, and the secret key password 2. The electronic voting system according to claim 1, wherein a password for activating a secret key of the voting device is set. The accepting device reads the secret key password, the secret key of the accepting device, and the public key of the voting device each time the device is activated,
The voting device reads a secret key password, a public key of the accepting device, and a secret key of the voting device each time the device is activated,
3. The electronic voting system according to claim 2, wherein the receiving device and the voting device erase the key and the secret password read together with the stop of power supply. Having a plurality of receiving devices,
The accepting device that has generated the secret key password, the public key and the secret key of the accepting device, and the public key and the secret key of the voting device includes the secret key password and the accepting device on the vote manager card. Write the public and private key pair of the voting device, and the public and private key pair of the voting device,
The other accepting device reads the secret key password, the secret key of the accepting device, and the public key of the voting device from the vote manager card, and activates the secret key password and the secret key of the accepting device. 4. The electronic voting system according to claim 2, wherein the electronic voting system is set to a password for making the password. A receiving device that issues a voting card, a voting device that inputs the voting card and performs voting, and a voting manager card in which a secret key of a voting manager who manages the receiving device and the voting device is written A secret key delegation method in an electronic voting system,
The signature character string signed with the secret key of the vote manager is set as the secret key password for activating the secret key of the accepting device and the voting device in the password of the accepting device for starting the accepting device A secret key delegation method characterized by the above. In the accepting device activated by inputting the password of the accepting device, when the password of the vote manager is inputted, the secret key of the vote administrator is read from the vote administrator card, and the password of the accepting device is When the signature character string signed with the secret key of the voting manager is set as a secret key password for activating the secret key of the accepting device and the voting device, the secret key password is generated in the accepting device. Write the public key and private key pair of the accepting device, and the public key and private key pair of the voting device to the voting manager card,
In the voting device, when the password of the voting manager is input, the secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card, and the secret key 6. The secret key delegation method according to claim 5, wherein the password is set to a password for activating the secret key of the voting device. In the receiving device, every time the device is activated, the secret key password, the secret key of the receiving device, and the public key of the voting device are read from the vote administrator card,
In the voting device, each time the device is activated, the secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card,
7. The secret key delegation method according to claim 6, wherein the receiving device and the voting device erase the key and the secret password read together with the stop of power supply. The electronic voting system has a plurality of receiving devices,
In the receiving device that generates the secret key password, the public key and the secret key of the receiving device, and the public key and the secret key of the voting device, the secret key password and the receiving device in the voting manager card Write the public key and secret key of the voting device, and the public key and secret key of the voting device,
In another accepting device, the secret key password, the secret key of the accepting device, and the public key of the voting device are read from the voting manager card, and the secret key password is activated for the secret key of the accepting device. The secret key delegation method according to claim 6, wherein the secret key is set to a password for making the password to be used. A receiving device that issues a voting card, a voting device that inputs the voting card and performs voting, and a voting manager card in which a secret key of a voting manager who manages the receiving device and the voting device is written A secret key delegation program in an electronic voting system,
The signature character string signed with the secret key of the vote manager is set as the secret key password for activating the secret key of the accepting device and the voting device in the password of the accepting device for starting the accepting device A secret key delegation program. In the accepting device activated by inputting the password of the accepting device, when the password of the vote manager is inputted, the secret key of the vote administrator is read from the vote administrator card, and the password of the accepting device is When the signature character string signed with the secret key of the voting manager is set as a secret key password for activating the secret key of the accepting device and the voting device, the secret key password is generated in the accepting device. Executing a process of writing the public key and private key pair of the accepting device and the public key and private key pair of the voting device to the voting manager card;
In the voting device, when the password of the voting manager is input, the secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card, and the secret key password 10. The secret key delegation program according to claim 9, wherein a process for setting a password for activating the secret key of the voting device is executed. In the receiving device, every time the device is activated, the secret key password, the secret key of the receiving device, and the public key of the voting device are read from the vote administrator card,
In the voting device, each time the device is activated, the secret key password, the public key of the accepting device, and the secret key of the voting device are read from the voting manager card,
11. The secret key delegation program according to claim 10, wherein the receiving device and the voting device erase the read key and the secret password when power supply is stopped. The electronic voting system has a plurality of receiving devices,
In the receiving device that generates the secret key password, the public key and the secret key of the receiving device, and the public key and the secret key of the voting device, the secret key password and the receiving device in the voting manager card A process of writing the public key and secret key of the voting device, and the public key and secret key of the voting device,
In another accepting device, the secret key password, the secret key of the accepting device, and the public key of the voting device are read from the voting manager card, and the secret key password is activated for the secret key of the accepting device. 12. The secret key delegation program according to claim 10 or 11, wherein a process for setting a password to be executed is executed.

Images