NL1021632C2 - Electronic voting system, involves removing selected candidate from plus list and sending resulting minus list to computer for identity removal before minus lists are deducted from plus lists - Google Patents

Abstract

The voter uses a voting card to compile a plus-list with a desired number of candidates, including the candidate they have voted for. A first computer digitally authenticates the candidates on the voting card and a second computer is then used to digitally authenticate the candidates on the plus-list. The vote removes the authenticated candidates to be voted for from the plus-list and sends this minus-list to the first computer. The two computers check and remove the identity of the voter before sending the minus-list to a third computer and optionally a fourth computer which count the votes by subtracting the minus-lists from the votes cast via the plus-lists.

Description

-1-5

Remote dialing system with voice masking.

The invention relates to a system for remote selection in which the votes cast are masked in such a way that it is impossible to establish a connection between the voter and the vote or votes cast by this voter. The election system according to the invention can be used for, for example, national, provincial or municipal elections, whereby the remote votes can therefore be cast, for example via the internet, via a point to point modem connection, via a telephone line or with the aid of voting columns at public locations.

One of the most important demands placed on election systems is the safeguarding of voting secrecy.

20 This means that it must be impossible to make a connection between the voter and a vote cast. When choosing remotely via, for example, the internet, this is a difficult problem because, together with the vote cast, the identity of the voter in question must also be transferred in order to be able to determine that this voter is entitled and that only one vote by this voter is released. The latter is also called uniqueness. Furthermore, the election system must be ethical, whereby the result cannot be influenced by the managers of the various subsystems 30 and is only determined by votes cast by voters. The entire system must also be controllable without compromising voting secrecy. Finally, the voter must be able to understand and trust the voting process.

The present invention satisfies all these requirements and will be elucidated hereinbelow on the basis of five figures of process and data diagrams.

10? 1 R 3? -2-

Figure 1 shows globally the total process and data flow diagram of the election system according to the invention.

Figure 2 shows the process and data flow diagram 5 concerning the information from and to the voter and the processing of this information by the computer (PC) of the voter.

Figure 3 shows the process and data flow diagram and the processing of the information by a first central computer 1.

Figure 4 shows the process and data flow diagram and the processing of the information by a second central computer 2.

Figure 5 shows the process and data flow diagram and the processing of the information by a third and optionally a fourth computer 3 and 4.

Since the voting information sent via a network, such as, for example, the Internet, must be linked for the sake of uniqueness to information concerning the identity of the voter, the election system according to the invention has opted for the use of at least three independent central computers (servers). 1-3, optionally supplemented with a fourth computer 4 to check the count, whereby, as indicated in figure 1, computer 1 and computer 2 are connected to the voter's computer via the aforementioned network (internet) and all central computers are interconnected via a protected network such as, for example, the intranet. The description will in future be based on four 30 central computers, because this offers the best protection against fraud.

In the election system according to the invention, the four central computers are managed by four independent parties, who will not communicate with each other about the information in the computers managed by these parties. For example, one or a few of these parties could be supplemented by an international observer group. The system is further arranged such that, using all information that is available per computer, with the exception of the computer (PC) of the voter, it is impossible to determine to whom a random voter 5 has voted. Malversations by both the voter and one of the parties who manage the computers are also noticed by one or more of the other parties.

An important feature of the system according to the invention is that encryption techniques are applied to secure the communication lines and to affix digital authentication to the information between the voter and the four computers. The transmitted information, however, remains legible in both cases for both the sending and the receiving party, which increases controllability and transparency.

Another important feature of the invention is that the vote cast by each voter is masked by a relatively large number of votes for candidates who are not elected by the voter in question but who do appear on the ballot paper of the voter concerned. The voter submits two lists of random candidates, one list containing one more candidate than the other. These lists are completely identical except for the one additional candidate chosen by the relevant voter.

25 The list with the additional candidate is hereinafter referred to as the plus list and the other list as the minus list. By subtracting all minus lists from all plus lists during processing, the selected candidates remain. The plus lists are processed by computer 2 together with the identities of the voters, the minus lists are processed by computer 1 together with the identities of the voters and the computers 3 and 4 perform the counting without having the identity of the voters and independently generate the same final result of the election, which is also verifiable in this way.

In the system according to the invention, the voter has a secret code which consists of two parts, that is to say, one personal part that the voter has generated and announced to the election body prior to election day and a second part in the form of a voting code that is sent to the voter and is known only to the voter concerned. This voting code can, for example, be invisibly applied to the calling card under a scratch varnish, whereby the voter can request a different voting code if this lacquer layer is damaged.

10 The first step the voter must take to be able to vote via the internet is to load the election application that can run on the voter's PC. All information from and to the voter is exchanged via a standard SSL (Secure Sockets Layer) protocol connection 15 which guarantees the authenticity of the connections via the internet. The election application can for instance consist of a so-called JAVA applet that can run under standard internet browser software, but can also be an application that is downloaded via the internet or that is provided to the voter in advance via a digital medium.

After the voter has started the aforementioned application, this voter is requested to disclose his or her personal identity, for example on the basis of name and address data or on the basis of a call number and the two parts of the secret code. Together this forms the information (ID) about the identity and authenticity of the voter.

With the aid of this information, as indicated in Figure 2, a ballot paper is retrieved from computer 1. This ballot paper contains the list of digitally authenticated candidates that apply to the voting district of the voter concerned, all candidates being provided with a unique candidate number, which appears only once for the entire 35 election. The aforementioned digital mark (W1) is generated in a known manner using an asymmetric encryption algorithm with a public key and a secret key whereby the public key is sent along with the information and offers the possibility of reading this information, but preventing it from occurring. that this information could also be generated by the receiving party.

Before computer 1 issues the requested certified ballot (W1 [L]), it is checked, as indicated in Figure 3, on the basis of the identity (ID) whether the voter in question appears in the electoral register, or whether the voter concerned has previously voted. , has received a ballot and whether the secret personal code is correct.

If the voter concerned has already voted, this voter will be notified and the process will be terminated. If a certified ballot paper 15 (Wl [L]) has already been issued, the same ticket will be issued again.

After the voter has received the certified ballot, together with the public key of hallmark (W1), as indicated in figure 2, one candidate (s) is selected by the voter with the help of the election application.

The user interface of this application can for instance be embodied as indicated in the applicant's Dutch patent application no. 1019945 (Dynamic user interface for voting systems).

Of all remaining candidates (W1 [L-s-s]), approximately half are randomly removed at random from the list, after which the selected candidate (s) is added to the remaining list (W1 [L-R-s]). The list (W1 [L-R]) that remains in this way is the plus list of the relevant voter, in which the chosen candidate (s) appears.

This plus-list (W1 [L-R]) is then sent by the application to computer 2 together with the identity information (ID) of the voter, in which also the secret personal code is processed. In the same way as computer 1, as indicated in figure 4, computer 2 checks on the basis of the voting register whether the '/ / /' I concerned has previously voted, has received a security I plus list and whether the secret personal I code is correct.

If the voter concerned has already voted, then this voter will be informed and the process I will be terminated. If a certified plus list I has already been provided, the same certified plus list I will be provided again.

The digitally authenticating of the plus lists by computer 2 also takes place in a known manner with an asymmetric encryption algorithm, whereby the public key I is sent along with the list, so that this list remains legible for the receiving party (s) but I cannot be produced by these receiving party (ies).

Computer 2 stores the received plus-list (W1 [L-IR] + ID) in a temporary memory and applies two digital I marks (W2) and (W3), whereby the mark (W2) is applied over the plus list (W1 [LR]) and I mark (W3) for the plus list I (W2 [W1 [LR]] certified (W2) including the identity information (ID) I of the voter (W3 [W2 [W1 [LR]] + ID]). Subsequently, this I-certified information (W3 [W2 [W1 [L-R]] + ID]) is sent back to the voter together with the public keys of the I (W2) and (W3) authenticators.

After the voter's computer has received the plus-list double-marked by computer 2 (W3 [W2 [W1 [LR]] + ID]), it generates, as indicated in Figure 2, the I-min list for the relevant voter (W3 [W2 [Wl [LRs]] + ID]), I by removing the vote (s) cast from the authenticated I 30 plus list received. This double-authenticated min-I list (W3 [W2 [W1 [L-R-s]] + ID]) is then sent, together with I, the public keys of the authentication marks (W2) and (W3) to I computer 1. Since the candidates are each separately I-certified, a certified I-35 candidate can simply be deleted from the list but no new I-candidates can be added.

I Computer 1 receives the min-7-certified min-list (W3 [W2 [W1 [LRs]] + ID]), checks whether the min-list received is authentic, removes the authentication ( W3) and, as indicated in Figure 3, stores the remainder (W2 [W1 [LRs]] + ID) in a temporary memory.

This remainder of the minus list (W2 [W1 [LRs]] + ID) is provided by computer 1 with a digital mark (W4), so as (W4 [W2 [W1 [LRs]] + ID]), returned to the voter's computer to confirm receipt of this minus list. The voter now has certified proof of the vote cast, which can be stored via the application on the voter's PC, for example, using encryption to be devised by the voter, as shown in Figure 2.

Computer 1 then informs computer 2 via the mutual network that a minus list of (n-1) candidates has been received from a voter with the identity data (ID) and receives a confirmation with the number of candidates in the plus list of the voter with the same identity data (ID) from computer 2. After receiving the aforementioned confirmation, the data is processed by computer 1 and the minus-list votes (W2 [W1 [LRs]) as shown in figure 3 without identity of the selector added to the min-list memory and erased from the aforementioned temporary memory.

In the same way, computer 2 as indicated in Figure 4, after receiving the notification from computer 1 concerning the relevant voter, processes the plus list from the temporary memory and also places these votes without the identity of the voter in the plus memory list.

After receiving a minimum number of votes to be determined, computer 2, as indicated in Figure 4, "randomly" sends a number of (W1) -claimed votes from the plus-list memory, i.e. without identity data from the voters to the computers 3 and 4. Similarly, as shown in Figure 3, computer 1 transmits "at iaiiuuiu ecu wiiieiveui. Xy aaiiuax with \ W6 / eu \ vvx / ^^ nuuAu", ie voices from the min-list memory, so without identity data from voters to computers 3 and 4.

This data is stored by both computers 3 and 4 in 5 respectively a plus-list memory and in a min-list memory.

All candidates with the same unique candidate number that appear in both the plus-list memory and the min-list memory are deleted against each other and removed from the respective memories.

The plus-list memory in this way contains a global intermediate result that may or may not be announced depending on the type of election.

After the period for casting votes has elapsed, the remaining remnants of the plus-list memory in computer 2 and the minus-list memory in computer 1 are also sent to computers 3 and 4, after which these computers can both determine the final result by deleting the remaining candidates with the same unique candidate number 20 in their plus-list memory and in their min-list memory against each other, after which the min-list memories must be empty and the plus-list memory contains the final result.

After the computers 3 and 4 have compared the final result and found it to be the same, it can be announced.

Giving each candidate a unique candidate number is done to prevent copies from being made of the records of the certified candidates.

An additional advantage of this is that the same election system can also be applied for a dual election or for an election with very few candidates, whereby the voter receives a certified ballot on which the same candidates appear several times, each with a different unique candidate number. The application on the voter's computer in this case of course only gives a choice between the different candidates, '/ n.? ? -9- where each candidate only appears once.

Because all the candidates selected in the final result have a unique candidate number, it is possible to set up a control procedure in which the voter can have an independent appeal committee check whether the vote cast by the relevant voter has counted in the final result. To do this, the voter initially gives the candidate number chosen by this voter to the appeals committee, who can use computer 3 or 4 to check whether this candidate number has counted in the final result without having to disclose the name of the candidate concerned. If this is not the case, the voter can prove via the certified plus list and the certified minus list that the vote in question was cast by this voter, whereby this vote must be made known to the appeals committee.

If all central computers keep the communicated information until after the expiry of the appeal period, a complete audit of the election process is possible and recounts can be made.

• ·: 9 ~

Claims (17)

1. An electoral system for remote voting, characterized in that voting secrecy is guaranteed by masking a cast vote, because voter 5 compiles a plus list of any number of candidates, including the candidate to be chosen, from one for this voter valid ballot paper with candidates digitally authenticated by a first computer and then having the candidates on this plus list digitally authenticated by a second computer, after which the voter removes the certified candidate to be chosen from this plus list and the resulting min -send list to the first computer, after which both computers, after checking and removing the identity of the voter, forward the received lists to a third and possibly a fourth computer, each of which can calculate the result by the number of votes cast per candidate subtract the number of votes cast via the plus lists via the minus lists. 20 2. A remote election system according to claim 1, characterized in that it is impossible to make use of all information, except for the voter's computer, per computer for the party managing the computer in question. determine who a voter voted for. A remote election system according to one or both of the preceding claims, characterized in that, although encryption techniques are used to secure the communication lines and to affix digital authentication to the information between the voter's computer and the three or four central computers, but that in all cases the information sent remains legible for both the sending and the receiving party, which increases controllability and transparency. 1021632 -11- A remote election system according to one or more preceding claims, characterized in that at least one of the other parties manages malpractices at both the voter and at one of the parties that manage the central computers. 5. A remote election system according to one or more preceding claim (s), characterized in that the voter has a secret code consisting of two parts, namely one personal part that the voter precedes has generated on the election day and announced it to the election authority and a second part in the form of a voting code 15 which is sent to the voter and is known only to the voter concerned. 6. An electoral system for remote selection according to claim 5, characterized in that this voting code is applied to the calling card invisibly under a scratch varnish, wherein the voter can possibly request another voting code if this lacquer layer is damaged. 7. An election system for remote selection according to one or more previous claims, characterized in that all information is exchanged from and to the voter via a standard "Secure Sockets Layer" protocol connection, with which the authenticity of the connections is guaranteed via the internet. A remote election system according to one or more previous claims, characterized in that the election application consists of a so-called JAVA applet that can run under standard internet browser software. -12- 9. An election system for remote selection according to one or more preceding claims, characterized in that the election application is downloaded by the voter via the internet. 10. An election system for remote selection according to one or more preceding claims, characterized in that the election application is provided in advance to the voter 10 via a digital medium. 11. A remote election system according to one or more preceding claim (s), characterized in that all certified candidates on the voting ballot are provided with a unique candidate number, which occurs only once for the entire election with which copies of the records of the certified candidates can be overcome. 12. An election system for remote selection according to one or more previous claim (s), characterized in that this election system can also be used for a dual election or for an election with very few candidates, in which the voter has 25 receives a certified ballot on which the same candidates appear several times, each with a different unique candidate number. 13. An electoral system for remote selection according to one or more previous claim (s) with the characteristic that the voter has certified proof of the vote cast, which can be obtained by means of a When encryption can be stored, an appeal procedure is possible. -13- A remote election system according to one or more preceding claims, characterized in that the first and the second computer receive a random number of processed certified votes after receiving a minimum number of votes to be determined "at 5 random" send from their memories, without identity data of the voters, to the third party and possibly a fourth computer to perform the count and possibly to determine a global intermediate result. 10 15. An election system for remote selection (one or more previous claims), characterized in that after the time limit for voting has elapsed, the remaining remnants of the min-list memory of the first computer and the remaining remnants of the plus-list memory are sent from the second computer to the third and possibly to the fourth computer, after which the third and fourth computers can both determine the final result. 20 A remote election system according to one or more previous claims, characterized in that the third and fourth computers compare the final result as before announcing it. 25 17. An election system for remote selection (one or more previous claims), characterized in that a complete audit of the system is possible.