EA048492B1 - VOTING SOFTWARE SYSTEM - Google Patents

Description

Field of technology to which the invention relates

The central goals of the Accountable Democracy core software are to provide assurances to voters (and vote processors) that 1) individual voters' votes are counted and accurately tallied, 2) the votes of all participating voters are counted and accurately tallied, and 3) unauthorized votes are not included and 4) unauthorized votes are excluded from the election authority's tallies. Secondary goals include providing convenience in voting well in advance of election day, the ability or abilities for a voter to change their mind within a specified time interval after their vote, notification to the voter that a vote or votes have been accepted, an optional receipt showing who the person voted for, the ability to view one's vote online from the time the voter enters their vote until a selectable time after the election, ease of recounts, and significantly increased security and reliability. The above goals are achieved by providing vote tabulation software that is both transparent and secure. While transparency may seem to conflict with security, this unique system design achieves both goals simultaneously.

State of the art

There are many new software system applications currently available and/or being developed and tested that relate to elections, including voter registration, the voting process, and various monitoring functions. Several important aspects of voting are addressed by such software that will encourage and support participation in the voting process by the voting public. The present application programming interface (API) is used by such applications to perform ballot storage and counting, while providing a seamless, ergonomic user interface to facilitate many aspects of the voting process. In the present invention, the role of the system and method of use is to provide back-end support for such applications that is transparent, immutable, unhackable (i.e., not editable), and auditable, while providing continuous voter access to the submitted ballots.

Invote, provided by Scytl, describes the current state of the art of implemented voting systems and the security issues addressed by each. Scytl's system is a notable addition to the voting software industry in terms of privacy and security. However, it is significantly less transparent and therefore provides less benefit than the presented Accountable Democracy project.

In the Scytl system, the public cannot directly verify the integrity of the Scytl system (i.e. that the system is secure and not hacked) once ballots are accepted by the counting server. While the Scytl system can verify that voters' ballots have been accepted, once a voter's ballot has been transmitted to the counting server, the digital (verifying) signatures are removed and the ballot's association with the voter and the voter registration system is irreversibly lost when all data is encrypted and placed in a digital ballot box. This ballot box is mixed and shuffled so that individual voters cannot be linked to a ballot. Obviously, additional (counterfeit) ballots can be entered into the system undetected, thereby diluting or overwhelming legitimate votes, thereby creating an electronic stuffing of the ballot box with counterfeit ballots, where there is no continuous record-keeping between the ballot submission and the voters. Also, if attackers obtain the decryption keys, the ballots can be modified and the election results can be changed - all due to the lack of continuous ability to trace the path from individual voters to their ballots, making the system unauditable. While the present invention effectively involves individual voters in the process of monitoring the system, the Scytl system contains a fatal flaw in that it does not have the ability or capability to provide the electorate with the authority to continuously track and monitor their own votes.

The essence of the invention

The current Accountable Democracy project is an order of magnitude more transparent than existing systems in that 1) the voter never loses direct access to their ballot and 2) the current system uses a different cryptographic method to protect the ballots, allowing them to remain unencrypted and readable by vote-counting entities. The ballot file can be made public after election day, and the actual votes are easily read and counted by any competent computer scientist. This public record-keeping occurs in addition to individual citizen verification of ballots, and serves as an additional layer of accountability, transparency, and

- 1 048492 integrity verification in the system. In short, the present system and invention provide the ability for security (1) from the voter upstream (via 1:1 ballot binding and seamless voter/ballot linkage) and (2) from the top down (tax tabulation system) via open source availability with transparent, end-to-end election monitoring.

In addition, in the system currently described, voters have the ability to access their ballots for correction while remaining anonymous to the system as a whole. The software can be submitted to peer review, and programs 'in use' can be publicly monitored and observed throughout the voting process through the use of special encryption technology in addition to public and private access to hash values.

There are obviously many factors involved in using online voting systems. One resource that covers these factors in depth is The Electoral Knowledge Network. This resource discusses several types of security issues and many, if not all, of the issues that apply to allowing citizens to vote and observe online. However, many of the issues addressed in this discussion simply do not exist in an Accountable Democracy system. For example, there are no vote tallies stored anywhere in the system, so there are no tallies to manipulate or forge. And, because the link between the ballot and the actual voters and voter registrations is maintained, the addition of fraudulent ballots or any removal of ballots is easily observed, verified, and detectable. What is also important to note is that in a real system, the voting process is extensive and takes place at a more measured pace well in advance of Election Day, which distributes the data in more consumable quantities for observation and security. This encourages voter participation and provides the ability to detect and correct any anomalies in a timely, unhurried manner, creating integrity in the system, trust in the voting system and, more importantly, increased voter/consumer satisfaction - all of which translates into greater voter participation and an accurate representation of the entire population.

Last but not least, Microsoft® has created a suite of open source software that implements many of the features in the Scytl system. This provides a comprehensive approach to using electronic ballots alongside paper ballots, representing a monumental step forward in vote counting technology. Unfortunately, many existing voting vulnerabilities remain. These vulnerabilities are addressed in this paper.

Additionally, Election Guard® uses a sophisticated method of encrypting ballots, allowing them to be counted while remaining in encrypted form. Unfortunately, again, this is a significant step backwards when it comes to voter trust. Making ballots unreadable except for a select few is precisely the kind of area where people do not trust any form of electronic vote processing, and is ripe for manipulation and fraud.

Unlike the Accountable Democracy approach, in Election Guard®:

1. If a hacker were to implement an implementation of software that acts like the unmodified version, but selectively modifies ballots during the registration process, this action would occur undetected. In effect, it would act as an impostor. Furthermore, since Election Guard® is open source, it would be relatively easy to create such a program. There is no way in Election Guard® to continually ensure that the software is actually being used unmodified.

2. The voter has no way to allow the system to subsequently inform the voter who he or she voted for. So again, similar to encryption (above), the technology says just trust me.

3. Since (1) ballots are not tracked continuously against voter registration data, (2) many registered voters do not vote, and (3) all ballots are encrypted, it would not be difficult for an attacker to add ballots to the mix of the legitimate voting pool without detection or auditability, when the system would see these ballots as simply additional votes cast.

4. The most important vulnerability of Election Guard® is that it is designed to support paper ballots, apparently to reassure voters that recounts are possible. But in reality, this opens the door to several security vulnerabilities. By geographically decentralizing paper ballot voting that all happens on the same day (i.e., the way voting is done today), it is impossible to

- 2 048492 prevent significant fraudulent activity in multiple locations or irregularities at specific counting sites (or even polling booths within sites).

The Accountable Democracy project addresses many existing vulnerabilities rather than attempting to control them, regulate them, or improve or neutralize their implementation.

Incidentally, if the electoral body wants to print a hard copy (paper ballot) as a backup to the electronic system on election day, this option may also be provided initially to build confidence in the system and comfort for those who do not fully trust computer technology. This option may remain as a legacy feature or be eliminated altogether.

At its core, Accountable Democracy is a server-side system that fundamentally changes the way votes are entered, received, managed, monitored, secured, stored, counted, and verified. It strictly enforces anonymity and security while still allowing voters access to their own ballots for security and verification purposes, as well as for the purpose of making edits.

Existing voting applications assist with vote registration, but the ballots are separated from the voters (via paper ballot deposits), leaving the door open to undetected vote alteration and fraud, as well as vote subtractions and additions. Additionally, there is the potential for counting errors, both intentional and unintentional, whereby anomalies and inconsistencies can arise from the use of paper ballots, through human error or intent. Hundreds, and in some cases thousands, of individual tallies are used by traditional voting systems. Voting machines, voting centers, counties, states, and federal polling agencies all accumulate and tally votes (e.g., election returns). Accountable Democracy eliminates fraud and abuse by NOT relying on the way votes are counted, nor on the election returns themselves. It focuses on the integrity of the ballot file and the voting software used, among other things.

Previous patents and electronic voting systems, both foreign and domestic, focus on legacy systems that select certain historically defined features (e.g., untraceability of paper ballots or their digital representations) throughout electronic data transactions that provide convenience, voter authentication, voter security, and voter anonymity protected through modern use of data collection, data processing, data storage, secure communications, and cryptographic technology. While the inventor acknowledges the utility of such applications, these legacy systems suffer from numerous shortcomings, fundamentally characterized by ballot processing machines separating ballots (i.e., data) from their voter creators, and reliance on votes being collected and tabulated in multiple, dispersed locations. They obviously make efforts to ensure voter anonymity, but at the cost of loss of transparency, continued weaknesses in authentication, security, and integrity - all cornerstones of a healthy democracy. The prior art still does not explicitly focus on:

1. transparency of software source code in a verifiable manner before, during and after the election process;

2. continuous ballot monitoring and verifiability, providing voters with the ability to view or change their ballots over time;

3. voter notification, which independently notifies voters that they have voted, thereby preventing others from interfering with the voter's right to vote;

4. methods for detecting and recovering from a failure of the environment or from deliberate alteration or forgery of the bulletin;

5. public inspection of the final file of the bulletin.

As shown above, prior inventors focus more on one-time authentication, which, while justifiable and legitimate, only serves to complement the novel features of the present invention. The fact remains that voter authentication and verification must be strongly supported as a natural consequence of the present invention, so that once voting occurs, access remains open to every voter.

Currently, voters are not provided with a notice confirming votes, and ballots are no longer accessible to voters. As a result, a voter must be verified at the time the voter accesses the ballot and immediately before casting a vote or votes, rather than at any other time in the ongoing process. In stark contrast, the present invention provides the ability to authenticate and verify throughout the voting process, or rather well after a vote is cast.

- 3 048492

The focus of the present invention is, in particular, on what happens to the ballot paper after the voter has expressed their preferences (voted), and from that time forward until well after the election. The present invention allows voters to not only authenticate their identity and right to vote (by verifying their registration), but also to verify that their vote was received and recorded correctly (e.g., not omitted, altered, fabricated, or duplicated), all with the ability to change their mind and recast a vote that may be different from their previous vote or votes. The present system also eliminates the ability to change the voting results, since the results are not stored in the present system except temporarily and momentarily. And the calculated voting results can be verified externally by uploading a file of the ballot papers for public use for monitoring, verification, accuracy, and security purposes. Thus, the present invention provides voter anonymity from public scrutiny while simultaneously providing continuous visibility of the ballot and availability of individual votes for ballot counting, primaries, runoffs, referenda, special elections, and general elections, among others.

However, a more detailed understanding of the invention will be obtained from the following description, which should be considered together with the accompanying tables throughout this document. Furthermore, these embodiments should not be construed as limitations of the scope of any embodiment, but rather as examples of various embodiments thereof. The invention itself is configurable and modifiable in many other variations possible in this application and provided by teachings of various embodiments that will be obvious to those skilled in the art. Therefore, the scope should be determined by the appended claims and their equivalents, which are interpreted in the light of the present description and not merely by the examples given.

Brief description of the drawings

While the novel features and method of using the invention have been set forth above, the invention itself, as well as the preferred mode of use and advantages thereof, will be better understood by reference to the following detailed description when read in conjunction with the accompanying drawings and taking into account the appended claims, wherein:

Fig. 1 shows a general representation of the current process for conducting voting;

Fig. 2 shows a general representation of the new process for conducting voting;

Fig. 3 illustrates the present invention Accountable Democracy Core;

Fig. 4 is the present invention providing a basis for protecting the identity of a voter;

Fig. 5 illustrates one preferred embodiment representing the operations of the Main Server.

And while the invention itself and the method of use are susceptible to various modifications and alternative configurations, specific embodiments thereof have been shown by way of example in the drawings and are described herein in sufficient detail to teach those skilled in the art how to make and practice the same. It should be understood, however, that the foregoing description and preferred disclosed embodiments are not intended to limit the invention to the particular disclosed embodiment, but on the contrary, the disclosure of the invention is intended to cover all modifications, alternatives and equivalents falling within the spirit and scope of the invention, which are defined in the broadest reasonable interpretation of the claims consistent with this description.

Detailed description of the invention

For a more complete understanding of the present disclosure, reference is made to the following detailed description. Although the present disclosure is described in detail with reference to exemplary embodiments, the present disclosure is not intended to be limited to the specific embodiments set forth herein. It is understood that various omissions and substitutions of equivalents are contemplated by the inventor as circumstances may suggest or seem expedient, and such modifications, corrections and variations are intended to cover the application or implementation thereof without departing from the spirit or scope of the present disclosure.

Additionally, it is to be understood that no limitation to the scope of the disclosure is intended, and additional applications of the principles of the disclosure as illustrated herein are expected to occur to one skilled in the art to which the disclosure pertains. It is also to be understood that the phraseology and terminology employed herein are for the purpose of description and are not to be construed as limiting. Furthermore, the appearances of such phrases and terms in various places provided herein are not necessarily all referring to the same embodiment. The designation of a term in

- 4 048492 singular in this document does not mean a limitation of quantity, but rather means the presence of at least one of the mentioned elements. Finally, the optimal mode or modes of implementation and application in practice of the present invention are disclosed herein, and such details necessary for the implementation of the presented voting system are provided that will allow a person skilled in the art to create and implement them in practice.

The present disclosure provides a means and method for conducting a voting process that provides robustness, reliability and verifiability to the system, whereby voters and auditors can interact with the voting system and the electoral body to simultaneously ensure accuracy, transparency and security. In addition, the present system provides ease of voter identification and recording of a vote preference and casting a vote (i.e., freezing) in an efficient and modifiable voting construct that remains modifiable by the voter (for a designated period before the vote is counted) and verifiable by a verification entity (for designated periods after the vote is cast or on election day). Finally, the present system provides a unique means of ensuring system integrity for the system by communicating hash values and maintaining separate mechanisms and servers for duplicated operations for verification and observation purposes. As provided below, this process begins with the election process itself.

Election procedure.

Current election procedures require voters to register with the voter registration system of their state, region, district, principality, precinct (or other electoral body). This will remain a mandatory requirement.

Each voter is assigned (1) a public voter number (PVN) and (2) a secret voter number (SVN). Secret voter numbers are not disclosed or made public to anyone. SVNs are also unknown to their assignees (voters), while PVNs are publicly available and are used to eliminate ambiguities and potential discrepancies between and among names. This idea is proven and explained in more detail below (see especially the Secret Number Obscurity section).

For purposes of this invention, voting takes place before election day. Election day is defined as the day on which all ballots are required to be received and collected by the election authority. The counting may be conducted and the results made available either on election day or on the following day. The election authority, in accordance with state and local laws and officials, determines when the election will begin and when the ballots will be counted. Typically, the allotted time is six weeks, but may be less or more depending on the laws of each state and the type of election (e.g., primary, runoff, etc.).

When an individual vote is performed, the voter is informed that a receipt, either digital or paper, is made available to each voter. If the voter chooses to receive a receipt, a digital or printed receipt is issued electronically or in paper form, confirming who the voter has voted for, as well as the voter's individual public number (PVN). In addition, each receipt does not contain the voter's identifying information (e.g. name, address, etc.) or the date on which the ballot was cast. Only the voter's PVN is verified to prevent misuse of voter information or use of the contents of the completed ballot. In this example, voting is performed at a government-provided voting center or, alternatively, via the Internet. Printed receipts also identify the voter's interaction mechanism (e.g., through a voting center, via a phone application, or on a computer) used to register the vote.

When a vote or votes are processed by the present invention, each vote or votes (of a single voter) creates a ballot record in the Accountable Democracy (ADE) core with the same information as that presented on the receipt, except that instead of a public voter number (PVN), it contains an encrypted secret voter number (SVN) (see also Secret Number Obscurity below).

The Accountable Democracy Core will provide an application programming interface (API) for online voting applications and election authority voting machines used to authorize and record votes. The ADE voter authorization will use the election authority system to obtain registered IDs (driver's license or state ID, etc.) and authorization codes, and will pass them on to third-party end-user voting applications to verify the voter's identity. The ADE will remember and store confidential (encrypted) voter secret numbers while it authorizes the voting process for the public voter number. The core will also include an API (API 2) for use by election authorities to query.

- 5 048492

The third party end user application will query the ADE by providing voter identification information, and the ADE will retrieve the applicable voter registration and act as an arbitrator in the voter identification process. Once the voter is correctly matched to the voter registration, the ADE will provide the ballot structure and VAT to the application in the form of a ballot template that must be filled out and returned.

The user interface (client) software that provides the actual voting process (and optionally provides the receipt) may or may not be connected to the Internet at the time the vote is cast. Vote authorization may be obtained offline by storing a local copy of the public voter registration file (excluding secret voter numbers). A temporary ballot may then be created offline and later submitted by the application to the Accountable Democracy (ADE) core. If the voter has not yet voted when the ballot is later submitted to the core, it goes through the same process of verification by the electoral authority and notification to the electoral authority that would have occurred had the user voted online. If the voter has previously voted and someone attempts to register a vote or votes in the ADE, the vote is blocked and the actual authorized user is notified that an unsuccessful attempt to vote has been made using their credentials. The time and place or mechanism of the unauthorized attempt will be documented.

When the Accountable Democracy core processes a ballot, it creates a ballot record internally, and the voter is notified that the voter has voted (via text, email, recorded phone message, and/or postal mail). At this time, the voter's registration record at the electoral authority is updated to show the date, time, and polling center used to register the vote. The core, of course, knows whether the voter has voted, since said core has access to all ballots.

Once a ballot record has been created, the voter is free to monitor and query his or her own ballot record online (a service offered by the electoral authority via the ADE API 2) to ensure that each vote or votes have been correctly recorded. If there is a discrepancy between the vote or votes cast and/or the original printed receipt, the voter in question may lodge an objection with the electoral authority. At any time thereafter, during and after the election, and for as long as the electoral authority deems it appropriate, or for as long as the law allows, the voter may print another ballot receipt with the full ballot information but not the date or details of the mechanism used to cast the vote.

Once a vote has been cast and a record of the ballot paper created, the voter has a set time (determined by the electoral authority - typically at least 72 hours) to cancel their vote if they so wish. There will be a deadline in each vote (typically 24 hours before election day) after which no cancellations are permitted. If a voter cancels their vote or votes, they are free to vote again. A limit may be placed on the number of repeat votes allowed.

Fig. 1 shows a general representation of the current voting process and procedure by which elections are currently conducted, whereby selective potential security vulnerabilities in the data stream are identified. As illustrated, a voter 110 may vote by means of a state-provided voting machine 114, which generates a paper ballot 116. Obviously, an intermediate, physical or manual approval 113 is necessary, whereby state printed voter registers are used to register the voter. After the vote is cast, the voter 110 thus generates a paper ballot 116, which is collected in addition to the paper ballots 118 of other voters, the collective ballots 120 of the voting center are then tabulated by means of a machine 122 for processing (tabulating) ballots of the voting center. The paper ballot 116 of the voter 110 is then stored for later inspection in a separate storage facility 117. The voting center ballot processing machines 122 may consist of any number (n) necessary to service each voting center. The cast votes may then be collected in the county 125, region 130, and national 145 ballot processing machine 122 for final tabulation to determine the outcome of the election or selection. Potential points of manipulation, tampering, or error (high-consequence tipping points) shown in the shaded areas exist most clearly at the manual endorsement 113, the individual voter paper ballot 116, the vault 117, the vote center ballot processing machines 122, the county ballot processing machines 125, the region ballot processing machines 130, and potentially the national ballot processing machines 145, where external tampering or internal manipulation of the vote counting system is most sensitive.

- 6 048492

Alternatively, in Fig. 2, the data flow is depicted using the present invention through a new and previously non-existent voting procedure described herein. The voter 110 may cast his vote as traditionally done through a government-provided voting terminal 215 or through another computerized input device, such as a home computer 215, which, in the present disclosure, may also be done through a smartphone or other input device 220. If the voter 110 uses a voting center or home computer 215, the voter 110 may select a paper ballot 222 as evidence of the vote or votes cast. Voters may also receive a digital image of their receipt. Regardless of the method, however, the vote passes through the present Accountable Democracy (ADE) core 225, described in detail herein, to ensure that the vote is correctly verified in the secure voting system that is the present invention. Accordingly, the ADE 225 shall inform the voter 110 of the receipt of the ballot by providing the voter 110 with a notice or notices via telephone, text, email, U.S. mail, or other means 230 of such notification, or a combination thereof. Upon completion of all voting, the ADE 225 shall provide the collective voter ballots cast in the form of tabulated city results 240, county results 250, region results 260, and state totals for national results 270, or a combination thereof.

Note that multiple ADEs 225 representing multiple regions will collaborate (not shown) to share regional totals to report national results 270. Since adding regional totals across multiple regions is relatively trivial, there is no need to provide a separate national data aggregation center. However, communication between regional ADEs occurs over the Internet. Published bulletin files are not merged across regions. National reports will be the same for each regional ADE in the network.

Accumulation of ballot records.

Fig. 3 further illustrates the above-mentioned ADE in more detail, wherein the voting procedures can take place on any computerized means for casting votes, at a voting center, via a home computer or an application 300 on a smartphone, wherein the ballot records are assigned a serial number as part of their structure, which can be used for subsequent access to the records. As noted, voters 110 voting using a computer or smartphone 300 must cast votes directly to the main or primary ADE server 350. Also, the voter 110 can receive notifications, as described with reference to 230 in Fig. 2. The ballot records are frozen, referred to herein as frozen ballots 310, after 72 hours (or another precisely specified period, as defined above) from the time of their creation. As frozen 310 ballots accumulate, they are collected into 320 batches. Lists of ballot numbers (320 batches) are stored in a batch file, the batch size can be set during system setup, and each batch is issued a 256-byte SHA or other hash value and a batch number. The hash value belongs to all the ballot data in the batch, including SVN encrypted ones.

Contents of the pack entry:

Bulletin number A;

bulletin number B;

Bulletin number C;

bulletin number [(N) _n ];

hash value of the ballot data;

pack number.

The ballot data itself (other than the SVN set) is stored in an unencrypted state. Votes for competing candidates are expressed using a binary candidate numbering system. For example, if four people are running for a particular position, they would be numbered internally as 1, 2, 4, and 8. Instead of having a dedicated checkbox internally, they would have one candidate number for each open position. This ensures that if any of the ballots change, there will be a drastic change in the batch hash value. Possible alternatives to this are 1) expressing the candidate numbers per seat using alphabetic values, or 2) expressing the numbers using alphabetic characters.

The 320 batches themselves are grouped (listed) in batch group records (330 batch groups) which are stored in a batch group file, and each 330 batch group is issued a sequence number and a hash value which belongs to all the batch records in the group. There are two types of group records: 1) records which belong to 320 batches, and 2) records which belong to 330 batch groups. The 330 batch group records are assigned level numbers so that the groups can be formed (i.e., composed) hierarchically. The first level (level 1) which lists the batch records. Level 2 and above write a list (and hash) of the group records at the level immediately below them.

- 7 048492

Ballots stored in the 360 unfrozen ballot file are protected by individual ballot hash values stored in a separate unfrozen hash value file (not shown).

In general, there is a voter registration file 112 managed by the electoral authority, a file of unfrozen ballots 360, a file of frozen ballots 310, a file of a batch 320, a file of a group of batches 330 and a file of deleted ballots 370. In addition, the software can exist on two mirror servers operating in tandem, whereby the secondary server 380 verifies the processing of the primary or main server 350, providing redundancy and assistance in monitoring and verification activities. Moreover, this second server 380 can operate in parallel or in tandem with the main server 350, but in a different or different cloud service or data center. In addition, each server or a plurality of servers can function to create one or more reports 390, which can be used for monitoring, verification, system security or a combination thereof. In addition, voters 110, when voting using a computer or smartphone 300, may optionally communicate with both the main server 350 and the second server 380 via a secondary communication channel 395 in addition to the communication occurring between the main server 350 and the second server 380, which is shown by communication 399.

Additionally, the inventor contemplates that the third ADE server (not shown), operating in tandem or parallel with the existing server or servers, may be another system operated by an entity other than the state or federally operated entity (e.g., a privately operated, publicly operated, or other non-government sponsored entity), or through a partnership between a state/federal operated system and a private entity, wherein a system of checks and balances is created to add oversight, surveillance, and/or legitimacy to the present system.

Security and transparency.

Definition of terms.

A hash value is a value that is an accumulation of bits from a data stream in a way that uses a mathematical algorithm, such as SHA-256, to provide a result of a fixed length. It is also called a checksum or simply a hash.

Asymmetric encryption is a type of encryption that uses two different keys. Each key can decrypt what the other key encrypts. These are often called public and private keys. However, with the present invention, no keys are made publicly available. Each communication channel uses transport layer security, which creates unique key pairs for each connection.

The intention of the inventor is to make the source code of the main server for the Accountable Democracy (ADE) core, including the operating system, available for public inspection and licensing of said system for use in elections. It describes how the public is assured that the software used is the exact software that is released to the public.

The ADE 225 is designed to run simultaneously on two to multiple dedicated 350, 380 servers (typically provided by competing cloud services), and the kernel includes its own operating system (OS). Initially, this may be a scaled-down Linux or BSD-type OS. During boot, the running program sets all unused memory to zero, and after boot completes, it sets a hash value for the OS executable code and another hash value for the application executables.

At random intervals, the system recalculates and compares these software hashes with the hashes set at boot time to ensure that the programs have not changed. It also periodically revalidates (verifies) the hashes of all files (tables) to ensure data integrity. The memory allocators used by the software zero out memory when it is freed.

The software, also upon request or instruction, recalculates the hash value of all executable modules that process the records of the ballot 310, batches 320 and batch groups 330, and makes them available to client and government applications via an API. All source code in the main ADE 225 server 350 is available for independent inspection and compilation for the purpose of verifying the hash of the executable code (thus providing government control and public oversight). This includes the source and object code for calculating the hash values. This will provide increased verification of the correctness of the election results through open verification of the methods and processes, but will not reveal the identity of the voter or the actual results of the ballots during the election.

It is expected that during the election, the 8 lowest order characters of these critical hash values will be published in the media and/or made available on a publicly accessible website, and these

- 8 048492 values will be dynamically retrieved from the core and displayed on client UIs when voting.

Functionality of the second server.

The second server 380 operates in a slave mode and essentially duplicates all the ballot accounting processes performed by the main server 350. The main server 350 forwards a copy of all incoming data traffic to the second server 380. The second server 380 may also accept input data directly from client applications for verification purposes (see path 395). Periodically, the top group hashes created by the two servers 350, 380 are compared to ensure that both are functioning similarly. An optional third server (not shown), or multiple servers (not shown), may be added to the configuration for greater security and to identify the correct ballot information in the event of a discrepancy between the main 350 and the second 380 servers. And the third server (not shown) may be anywhere on the Internet, such as in an audit center.

In the event that the primary server 350 is compromised or goes offline, a change of roles may occur by 1) placing the primary server 350 in a two-way forwarding-only mode or rerouting network traffic to and from the second server, and 2) switching the second server 380 to an offline mode. After the primary server 350 is either protected or restored, that server may be used as a secondary server or reclassified as a primary server, as conditions dictate, acting as a mirror server or an acknowledgment server.

Several support functions of the main 350 server are not provided in offline mode, but it includes all ballot processing and group record processing, voter notification, and voter query support. Files created and saved by the second server in offline mode are identical to those on the main server.

Since ballots are grouped hierarchically, all levels can be compared between servers by comparing a single hash value at the top level of each group file. If a discrepancy occurs, the software can quickly identify groups of ballots and the actual ballots that differ between two servers 350, 380, or multiple servers by examining the group hashes down to the lowest hash discrepancy, and then comparing the actual ballot records in each group whose keys do not match. The second server therefore provides a monitoring function to detect and pinpoint discrepancies that exist in the group hashes down to the individual batch level. Once the faulty batch has been identified, another means is used to identify discrepancies within the batch (e.g., comparison with backups and mirror data).

The software can therefore quickly identify any erroneously recorded ballots (i.e., ballots that differ between duplicate sets of ballot data) and report specific discrepancies in such ballots. By creating progressive sets of backup copies in a third location, it is quite easy to see what the original values were in such ballots. Of course, with the amount of protection these ballots have, the ballots will very rarely change, but environmental errors cannot be ruled out, as they occur randomly.

Exception handling.

At precisely specified or random intervals, the inspector program is downloaded to the live system from the Accountable Democracy server (or election auditor) (not shown), which then uses a dynamic algorithm to modify its own hash after it has run. The program does not know what its own hash is or will be, but the external Accountable Democracy server has access to this information. The inspector program examines the environment and reports its own hash value along with its findings, with a link to all the hashes of the executable code and a map of dynamically allocated memory.

As in Fig. 3 and 4, upon request from the electoral authority or other monitoring institution, a full audit of the ballot files 400 (i.e., the frozen ballot 310 in Fig. 3) can be performed by sending the electoral authority a list of all (encrypted) secret voter numbers 420 of those voters who voted to the ADE 225. The ADE 225 will then find and track all ballots associated with the provided list. Any abnormalities, missing or extra ballots, or a combination of these will then be reported.

Periodically, the system will check the 310/400 ballot file, 320 batch, and 330 batch group files, recalculating all hash values in the 320 batch and 330 batch group files and matching the results with the stored values, checking to ensure that each 410 ballot number appears in one and only one 320 batch, and checking to ensure that duplicate 475 voter secret numbers do not exist in the 400 ballot data.

- 9 048492

Before the final file of 400 ballots is published, the secret numbers of 475 voters are re-encrypted with new keys, just in case the internal encryption key has been maliciously obtained. At this time, all hash values are re-calculated in ascending order.

At the time the final ballot file is issued, the corresponding batch file will accompany it.

Tabular electronic structure of bulletins.

A wide range of possible ballot definitions and voting methods are supported, including primaries, elections, campaigns, legal actions, referendums, bills, etc. Furthermore, the system is designed to be multilingual and is designed to support a variety of visual cues and optical aids.

Electoral Authority Dashboard.

The ADE 225 can provide election officials with geographic statistics regarding the number of voters who voted in each geographic area. This information will also be available to election officials through their own records of who voted. No other ballot information will be provided to election officials before the final count is issued.

Unknown secret number (protection of voter identity).

On the state servers (of the electoral authority), when a voter registers, he or she is provided with an account and is assigned (1) a public voter number 430 and (2) a secret voter number 420. The secret voter number 420 is provided to the electoral authority (the state server in the state authority 440) via ADE 350 in an asymmetrically encrypted form, and the unencrypted specific voter number 420 is not disclosed to anyone. Definitely, the electoral authority is not provided with the encryption keys 445, 450, or the decryption keys 460, 465, 470. The unencrypted secret voter number may contain characters other than numbers, including but not limited to: upper and lower case letters and printed special characters.

When the ADE 350 receives the encrypted voter secret number 420 from the election authority server 440, the ADE 350 immediately decrypts this number and re-encrypts it, using a different key, for storage in the ballot. The decryption keys for the voter secret numbers 460 of the ballot and the encrypted voter numbers 465 of the election authority are stored only on the external (usually Accountable Democracy) server (in encrypted form - not shown) and in the memory of the ADE 350.

In summary, the election authorities 440 do not have access to the encryption key 450 or the decryption keys 465 of the voter's secret number, and the ADE 350 does not have access to the decryption keys 460 and 465 of the voter's secret number on the ballot, except when they are provided from an external source to process the voter's number on the ballot. When voting occurs, the public voter numbers 430 are used to coordinate between the third party user application, the ADE 350, and the election authority's servers 440. Later, when the voter accesses his ballot through the election authority's system, his encrypted secret number 420 is sent to the ADE 350, which converts it to a second encrypted version 475 and retrieves the associated ballot record. Electoral authorities may use a file 490 of intermediate conversion of voter numbers, as opposed to direct access to the secret numbers 420 of voters. The passwords 425 of voters are encrypted, see encryption key #3 455, while decryption key #3 470 is destroyed (does not exist).

Technical considerations.

Today's computer software has a very broad base. There are many ways to implement this project. From a technical point of view, the key points for implementing this system are:

1. open source operating systems;

2. publicly available programming language compilers and source code libraries;

3. publicly available cryptographic methods for both hashing and using asymmetric keys;

4. the ability of the software to self-check;

5. the ability of software to perform expert evaluation and observation during elections through dynamic computation of software-executable hash values.

In the event of an alert, due to inconsistencies between or among server(s), data, or through concerns expressed by voters, a simple solution is to download fresh verification software that will confirm the status of each server. Since all ballot processing is centralized for each election authority, there is only one point of data or software corruption to monitor, and it can be easily accessed.

- 10 048492

Fig. 5 represents one possible software structure for implementing these described methods. The presented preferred embodiment serves as an example, and it is expected that over time, improvements in technology will become available for better implementations. Significant aspects of the design are shown in Fig. 5, and this example is presented to describe one of a variety of possible software structures that (a) observe and perform events 600 including, but not limited to, (1) ballot freeze time, (2) outgoing message ready, (3) outgoing channel available, (4) time to recalculate file hashes, (5) time to check memory, (6) time to be ready to hash, (7) time to compare hashes between a main server and a second server (or multiple servers), (8) time to process a test suite, (9) time to back up files, or a combination thereof, and/or (b) perform specific processes 700 including, but not limited to, (1) registering ballot samples, (2) retrieving public voter data, (3) retrieving current hashes in memory, (4) retrieving voter ballot totals, (5) retrieving samples voter ballots, (6) initiating and executing EOD functions, among other things. As an example, at program initial startup 500, the bootstrap of the current program sets all unused memory to zero 503, and ADE 350 loads 506 the application, the memory is checked, and hash values are calculated 509. Next, the main ADE 225 server 350, the second server 380, or both, actively monitor for a message 512 (here for a 3-second period of time). If the message is received 515 (indicated as YES) 518, said message is added to the incoming queue 520. If the message is not received 515, but there is an event to be processed 522, that event 525 is processed (followed by YES 527), and the system checks for another event. Incoming messages 530 are processed by message broker 540 to perform processes 1, 2, 3, n 550 resulting in outgoing messages in the form of (1) query results 555, (2) hash values 557, (3) reports 559, (4) second server data 562, (5) voter notifications 565, (6) government notifications 567, etc. It should be noted that only messages are processed through brokering, since events require less processing time, thus they are processed through an event loop.

Blockchain (chain of blocks) - alternatives.

Block chains are widely recognized as secure and immutable. Therefore, they provide a good mechanism for storing ballots. However, the present invention does not use block chains and is superior to block chains in the following ways:

1. Ballots are simultaneously traceable, anonymous, publicly visible, and immutable. In a blockchain, ballots are essentially invisible to voters in a form that can be understood. The present invention maximizes transparency, which is a central aspect of trustworthiness. Using a blockchain, if decryption keys are intentionally or surreptitiously released to the public, then the identities of voters also become visible.

2. With the blockchain, sophisticated software is required to count the votes, and this presents a point of vulnerability for tampering. Anything that cannot be done in a visible, verifiable manner is subject to tampering and questioning. In a real system, the ballot file can be released to the public for inspection, verification of integrity, and recounts.

3. The present invention uses a significantly more efficient storage format compared to the block chain. Only by encrypting the secret numbers of voters, it minimizes the storage requirements, and by properly using cryptographic technology for protection without encryption, the present system makes storage simple, efficient and fast to identify and isolate data corruption, whereas the block chain must use extensive redundancy, complex forms of dispute resolution and significant computing power and natural energy resources.

4. The use of block chains is unsuitable for voters changing their minds or canceling votes that are disputed. Once a block in a chain is stored in the chain, it is irremovable.

Key operations.

The keys to success (from a voter privacy and governance perspective) for this type of vote counting and accounting are:

1. the ability of voters to re-examine their ballots, thus providing the power to the end user to ensure the required security that ballots are not altered.

2. The ability of software to self-check, whereby the software has control over its entire operating environment (both OS and applications) and can check and monitor its computing environment (as well as itself), and, using hashing methods, quickly identify any distortions or deviations.

- 11 048492

3. The ability to quickly determine if there is a discrepancy between copies of ballot files and quickly identify differences.

4. By not storing the counting results and storing only the ballots, the system uses the least amount of data that requires protection. This key aspect, together with sufficient progressive backups, maximizes efficiency while minimizing vulnerability.

5. Concealing voter secret numbers provides the foundation upon which point 1 above rests. Voter verifiability of ballots, coupled with anonymity, is fundamental to any voting process, but is not provided by previous voting methodologies. A true voter identity protection allows the export of the ballot file (e.g. for public inspection, backup, and recounts) without compromising the identity and security of voters.

6. The possibility of periodically checking the one-to-one correspondence between the number of voters who voted and the number of ballots counted during elections.

It is clear that the present system exhibits and is adapted to implement the following methods and techniques through some preferred embodiments: the ability to securely conduct elections for an extended and extendable period of time, much longer than a single day (e.g. six weeks) ending before election day, in a manner that provides for fast, secure and transparent (publicly observable) tabulation of results on and after election day, the ability to electronically connect the voter authentication process to the voter registration database of the electoral authority, the ability to forward authentication information from the electoral authority database to end-user (third party) voting applications, the ability to immediately notify the electoral authority database server electronically when the voter has voted, the ability for a voter to anonymously view his or her ballot online at all times as long as the electoral authority allows, both during and after the election, the ability to prevent any backtracking from the digital ballot to the voter who created it, while simultaneously allowing the voter to view his or her ballot, the ability independently notify each voter that their vote has been accepted, through a variety of means such as audio, text, email and postal mail, and the ability for the voter to cancel or change their vote (which restores their eligibility to vote) within a specified period of time (72 hours is suggested) after they have voted, before their vote becomes frozen (unchangeable). While other systems may provide a printed receipt at the time of voting (which this system encourages and promotes), the present invention supports the ability for the voter to receive a paper receipt (through the election authority's system) at any time after voting, both before and after the ballots are counted, as long as the election authority allows, showing who or what they have voted for. This receipt must be undated and show the voter's public number, but not their name.

In addition, the present invention and system promote the ability to NOT encrypt digital ballots (except for voter ID numbers) that will ultimately be placed in the public domain, while protecting the ballots from being altered by storing batch hash values in a separate file, the ability to support dynamic display of all or a portion of the hash values of the kernel operating system program for counting totals on end-user voting devices, the ability to support dynamic display of all or a portion of the hash values of the kernel application program for counting totals on end-user voting devices, and the ability to re-encrypt all voter secret numbers stored in the ballots before publishing the ballot file publicly.

In addition, the present invention provides the ability for ADE to operate on multiple coordinated servers on the same or separate cloud platforms and to use decryption keys stored only externally and in the dynamic memory of the ADE for the purpose of decrypting voter secret numbers for:

The present invention also exhibits the ability to individually hash the final ballots stored in the unfrozen ballot file and store such hash values in a separate file, the ability to hierarchically group the hash values of batches of ballots, providing a top-level summary hash value for all ballots frozen during an election, the ability to use a plurality of asymmetric encryption keys to obscure the identities of voters such that the encrypted voter numbers stored on the election authority's servers are different from the encrypted form of the same numbers stored in the ballots, the ability to periodically hash all the program bits that comprise the operating system of the tabulation kernel, the ability for the ADE to zero out all unused computer memory during an election, as well as the ability to receive data from an application

-

Claims (12)

voter user interface independently on more than one server and compare such receipts for verification purposes. In addition, the system and method of use of the present invention have the ability to control the process of tabulating the voting results, wherein the voting results are not stored in the ballot processing machine (tabulator) except during the reporting process (as a result, the votes are recounted directly from the frozen ballots each time they are reported), the ability to randomly send an inspector program from an external center to check the memory content of the ADE servers, the ability to provide a dashboard for the election authorities, which must run on the election authorities' servers, to report how many voters have voted in each partial area (e.g., district), and the ability to check the ballot file by finding all the ballots associated with the voters who voted, according to the voter registration database and reporting any missing or extra ballots. This process uses two voter numbers, one of which is secret, to protect the voter's identity, label votes and link them to voters, while maintaining voter anonymity. Additionally, the present invention conceals the ability to set the size of a batch of ballots and the size of a group of batches for any given election, to periodically recalculate all hash values of the ballots and batches to confirm the stored hash values, and the ability to quickly identify which batch or batches have been/have been modified via a hierarchical hash tree in the event of tampering or media failure. While the above description and drawings represent examples and preferred embodiments of the present invention, it should be understood that various additions, arrangements, combinations and/or substitutions, sequentially or in parallel, can be made herein without departing from the spirit and scope of the present invention, which are defined in the appended claims. In particular, it will be clear to those skilled in the art that the present invention can be implemented in other specific designs, configurations, by dissimilar structures, arrangements, proportions and by other elements, materials and components, without departing from the spirit or its essential characteristics. A person skilled in the art will recognize that the invention can be used with many modifications in design, arrangement, proportions, materials and components and otherwise used in the practice of the invention, which are particularly adapted to specific requirements and operating environments without departing from the principles of the present invention. In addition, the features described herein can be used alone or in combination with other features. The examples now disclosed are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims and not strictly limited by the foregoing description. It will be apparent to those skilled in the art that changes may be made in the examples provided above without departing from the broad inventive concept described. CLAUSE OF INVENTION 1. A computer-implemented method for providing transparent security for a voting system, comprising the steps of: assist the center in registering voters with the electoral authority and monitoring; implement the primary software core for voter authorization, vote registration, vote counting and reporting, running on the first server; assist third party voter application for end user; said software core provides a first application programming interface (API) to be accessed by said end user application; the first mentioned API is used as a resource and storage for authorization and registration of votes; the first API mentioned is used to obtain voter identification information and documents that should be used to authenticate the voter; the first mentioned API is used to obtain the current hash values of the program's executable code and the operating system for public display; the said software core provides a second API to which the said electoral body centre must have access; the said second API is used by the said core to request and receive voter credentials that are to be used to authenticate the voter; said second API is used to provide unassigned encrypted secret voter numbers (SVN) of said electoral authority centre for assignment to voters; the said second API is used to notify the said electoral authority centre that the voter has voted; the second API mentioned is used to allow the voter to view and print the contents of his ballot; the second API mentioned is used to allow a voter to cancel their ballot before it is frozen; the said second API is used to periodically or at random intervals verify that the number of ballots being counted matches the number of voters who voted, and to report any discrepancies; the said software core provides a third API to which the said electoral authority centre and authorised third parties must have access; the third API mentioned is used to provide election results on election results day; the third API mentioned is used to provide backup copies of mandatory files for verification purposes and, in the event of a catastrophic failure of the voting center, to restore them elsewhere in order to resume the election process; The third API mentioned is used to support various monitoring and status reporting during and after elections; provide a secondary core running on a second server, in tandem and independently of said first core, while said primary core has no dependency on information coming from the secondary core; the mentioned secondary core performs duplicate processing of ballots and hash; the said secondary core receives encrypted SVNs from the main server along with the corresponding unencrypted Public Voter Numbers (PVNs) and ballot data for independent duplicate hashing, verification and storage; the said primary core runs on the said first server; assign each voter a unique PVN and a unique SVN; the said VAT is assigned to an individual voter and is identifiable by him; the mentioned SVN is identified by the mentioned first kernel; the said SVNs are encrypted using two pairs of asymmetric encryption keys, and the encrypted SVNs on the servers of the electoral body differ from the encrypted form of the same numbers stored on the ballots; store the encryption and decryption keys externally on a separate key server and do not provide them to the electoral body or do not store them in the said core, but allow them to temporarily reside in the memory of the said core; said primary core on the first server performs all encryption and decryption of SVNs and provides encrypted SVNs to said electoral body for subsequent assignment to voters; provide the said voters with the opportunity to vote at intervals and at times preceding the day of counting the ballot papers in the election; provide to the said end user voting application a record of the ballot for each individual set of votes cast by the voter; receiving from said end user voting application a record of the completed ballot paper for each individual set of votes cast by the voter; provide the said received ballot record with a time stamp, date stamp and centre indicator; notify said voter from said primary core of said accepted ballot entry by means of audio, text, email and/or postal mail; assign the status of unfrozen ballots that are modifiable; provide the user with the ability to check and request their ballot at any time during and after the election, and to cancel their ballot before it is frozen; after a predetermined period, assign a frozen status to the ballots, which become unmodifiable; and count the frozen ballots. 2. The method of claim 1, wherein the plurality of cores exist on two or more separate servers, each operating in separate environments that operate in tandem to verify mutual functionality. 3. The method according to paragraph 1, wherein the data of the mentioned first and second API can be displayed on personal devices, including tablets, smartphones and computers, voting center devices or a combination thereof. - 14 048492 4. The method according to claim 3, wherein said first API can be used bi-directionally through said primary core to transmit data from voters to said electoral body and from said electoral body to said voters. 5. The method according to paragraph 3, wherein said received data may consist of voter identification information, voice identification information, votes or a combination thereof, and said transmitted data may consist of a plurality of VATs, notification of received votes, recorded votes, deleted votes, reports, statistical data and voice identification information. 6. The method of claim 2, wherein said third API can be used by the checking entity object to query said first, second or plurality of cores to determine discrepancies between and among cores. 7. The method according to item 1, further comprising the steps of: each received ballot is assigned a unique number, supplemented by its encrypted SVN, hashed, counted and stored in a queue designated as unfrozen; place the hash values of unfrozen ballots in a separate file along with their ballot numbers; provide voters with the ability to cancel (remove) their ballots from the unfrozen ballot queue; after a pre-specified period, unfrozen ballots are moved to the frozen ballots file; After the ballots have been added to the frozen ballot file, a batch record is created in a separate batch file consisting of a unique batch number, a list of all the ballot numbers in the batch, and a hash value of all the listed contents of the ballots; after the batch records have been added to the batch file, a batch group record is created, saved in a separate batch group file, consisting of a unique batch group number, a batch group level number, a list of batch records in the group, and a hash value of all listed batch records; After the batch group numbers have been created, another batch group record is created that references the batch group records (instead of the batch records) and is assigned a level number one higher than the level of the listed groups in ascending hierarchical order; continuously maintain a top-level hash value as batches are accumulated and grouped; and deliberately leave ballots unencrypted except for their SVN. 8. The method of paragraph 6, wherein, after the discrepancy or discrepancies are identified, such discrepancies may then be reported to or requested by the electoral body, the audit body, the public, or a combination thereof. 9. The method of claim 1, wherein at precisely specified or random intervals an inspector program may be unloaded into said primary core, using a dynamic algorithm to modify its own hash values after startup and report its findings and its own recalculated hash value to the external server. 10. The method according to paragraph 2, wherein each core on each server can take security measures comprising: periodic uploading of each ballot file to a separate backup storage facility that can retain all backup copies until well after the election; clearing all unused memory; recalculating the hash values of the operating system and the executable code of the application program at random intervals to verify consistency between servers; recalculating, at random intervals or at specified intervals, all hash values of the ballots; and downloading a verification program located in said core from a remote server to check the core memory, dynamically modify said program memory, report audit results, recalculate the hash values, or a combination thereof. 11. The method of claim 1, wherein said core re-encrypts all SVN and all hash values of the ballots and sends the resulting ballot file and the batch summary file to a list of independent recipients for verification. 12. The method of claim 1, wherein the plurality of ADEs at the regional level cooperate via the Internet (or other network medium) to accumulate results at the regional level for the purpose of reporting the results of the national elections. -