JP2001243395A - Electronic voting system using polling place method - Google Patents

Abstract

(57) [Summary] [Problem] The present invention can be applied to the current election, and is a basic requirement for the election, which is prevention of unfair competition, guarantee of anonymity, guarantee of fairness, deletion / falsification. / To provide an electronic voting system that satisfies the prevention and inflation of inflated water. An electronic voting system based on a polling place system according to the present invention provides a voting ticket server that prepares a voting card storing a voting ticket for voters prior to a voting day, and a voting ticket server that matches a voting person with a voter list. After confirmation, the reception terminal generates a signature of the reception terminal for the voting ticket and stores it on the voting card, and displays the candidate's name etc. to the voter to encourage voting, and votes the voting information obtained by the voting act The voting terminal stored in the card, the voting information read out from the voting card, and the exit terminal transmitting the voting information to the tallying server online, and the voting information sent from the voting terminal at each voting place for each voting, It is characterized by comprising a totaling server that totals the voting information after the time ends and outputs the number of votes of each candidate.

Description

DETAILED DESCRIPTION OF THE INVENTION TECHNICAL FIELD OF THE INVENTION

[0001] The present invention relates to an electronic voting system.

[0002]

2. Description of the Related Art Various researches have been conducted on electronic voting from the viewpoint of security technology, but an electronic voting system which is being developed as a system is an offline electronic voting. There is no other online system development that reflects security measures, such as the present invention.

By the way, when the electronic voting system is applied to the current election, voting information can be collected online and the ballot can be processed by a computer. It is possible to reduce the number of counting operations and greatly reduce the counting time.
In addition, since the candidate name can be selected on the terminal screen during voting, invalid votes that are likely to occur in the current election due to clerical errors, indecipherability, and the like can be eliminated.

[0004] The method of realizing the electronic voting system is as follows: (A) Network method: Voters vote via a network from PCs such as homes. (B) Polling place method: Voters go to polling places and polling places. Voting with a voting terminal installed in the country.

[0005] In the above-mentioned network system, acquisition and intimidation are possible in an invisible place, and a number of problems such as a method of confirming a person's intention are solved before the network system is accepted as a public office election law. There must be. On the other hand, in the polling place method, voting is performed under the supervision of a voting manager or a witness, so that acquisition, intimidation, and the like can be prevented. (At least, by assuring anonymity, it is not possible to prove to the acquirer or threatening party that the person acquired or threatened has voted for the indicated candidate.) Although the election law must be revised, the present invention employs a polling place method on the premise that the law can be easily revised.

[0006]

SUMMARY OF THE INVENTION An object of the present invention is to provide an electronic voting system applicable to current elections.

[0007] In addition, the basic requirements for election, the prevention of unfair voting, the assurance of anonymity, the assurance of fairness,
It is an object of the present invention to provide an electronic voting system that satisfies deletion, falsification, and prevention of inflating.

In addition, by collecting voting information online and processing the votes by a computer, the transport of voting papers and manual counting in the current election can be eliminated, thereby reducing the number of times of voting and greatly reducing the time required for voting. Making it possible,
In addition, the voting is intended to make it possible to select a candidate name on the terminal screen and to eliminate invalid votes that are likely to occur in the current election due to clerical errors, indecipherability, and the like.

[0009]

In order to solve the above-mentioned problems, an electronic voting system based on a polling place system according to the present invention provides a voting ticket server for creating a voting card storing a voting ticket for voters before a voting date. And a receiving terminal that generates a receiving terminal signature for the voting ticket and stores the signature in the voting card based on the confirmation of the voter by collation with the electoral list, and the receiving terminal signature from the voting card. Voting to read and verify the candidate, display the candidate's name and the like on the terminal screen to prompt voting, and store voting information obtained by voting and a voting terminal signature for the voting information in the voting card. Terminal, reads the voting information and the voting terminal signature from the voting card, verifies the voting terminal signature, and transmits the voting information online The voting information transmitted to the tallying server, and the voting information sent to the tallying server, an exit terminal storing the tallying server signature sent from the tallying server in the first database, and voting from the exit terminal of each polling place The voting information sent each time is received and stored in the second database, the tallying server signature is transmitted to the exit terminal, and after the voting time, the voting information on the second database is totaled. It is characterized by comprising the above-mentioned totaling server which outputs the number of votes of each candidate.

Thus, an electronic voting system applicable to the current election can be provided.

The number of voting ticket servers, reception terminals, voting terminals, exit terminals, and tallying servers may be one or more. Further, “before the voting day” in claim 1 means before the notification day in the case of absentee voting.

Further, the voting ticket is characterized by comprising an encrypted sequence number and a voting ticket server signature. As a result, forgery of the voting card can be prevented, and the voting information can be strictly identified (the voting information is managed in association with the sequence number).

The voting terminal may generate a first random number used as information for identifying the voting information. Thereby, unauthorized voting can be prevented without impairing anonymity.

The exit terminal generates a second random number to create a session key, encrypts the voting information using the session key, encrypts the session key using an encryption key, and encrypts the session key. The voting information is transmitted together with the converted voting information to the tallying server. The tallying server decrypts the session key using a decryption key, and decrypts the voting information using the decrypted session key. And

Further, a common key of the exit terminal and the tallying server is used for encrypting and decrypting the session key, or a public key of the tallying server is used for encrypting the session key and a secret key of the tallying server is used for decryption. Keys can be used. When employing a common key method for encrypting and decrypting the session key, a security card for securely storing the common key is used. This can guarantee the fairness of the election.

Further, the exit terminal generates an exit terminal signature for the voting information and transmits the generated exit terminal signature to the counting server together with the voting information. The counting server verifies the received exit terminal signature. And This makes it possible to authenticate the exit terminal and prevent falsification of the message.

Further, the exit terminal deletes the voting information transmitted to the totaling server using the first database with respect to the voting list information published by the totalizing server,
It checks for alterations or inflated voting, and if detected, raises an objection to the counting server. This will delete / falsify /
Padding can be prevented.

[0018]

FIG. 1 shows the configuration of an electronic voting system according to the present invention.

In the figure, 1 is a voting ticket server, 2
Is a reception terminal, 3 is a voting terminal, 4 is an exit terminal, 5 is a totaling server, 6 is a voting card, 7 is a security card, 8 is a first database, and 9 is a second database.
Hereinafter, the voting ticket server 1, the reception terminal 2, the voting terminal 3, the exit terminal 4, and the tallying server 5, which are components of the electronic voting system, will be sequentially described.

(1) Voting Ticket Server One or a plurality of voting ticket servers 1 are installed in the constituencies according to the number of voters. The voting ticket server 1
A voting card 6 (an IC card can be used) storing a voting ticket is created by the voters before the voting date (before the notification date when considering absentee voting, etc.). Voting card 6
Is equivalent to a ballot in the current election. A voting ticket is composed of a ticket server signature and a sequence number. The purpose is to prove that the voting card has been issued by the Election Commission or the like, prevent forgery of the voting card, and enable strict identification of voting information.

(2) Reception Terminal One reception terminal 2 is installed at the polling place. The reception terminal 2 generates a reception terminal signature for the voting ticket and stores the signature on the voting card 6 based on the confirmation of the voter by collation with the electoral list. The signature of the reception terminal proves that the voting card 6 was issued by the voting manager at the polling place reception. Ensure that they are eligible to vote and that this is the first vote.

(3) Voting Terminal A plurality of voting terminals 3 are installed at the polling place. Voting terminal 3
Reads out and verifies the signature of the reception terminal stored on the voting card, and then displays the candidate's name and the like on the terminal screen to prompt the voting to vote. The voting terminal signature is stored in the voting card 6. The voter's voting operation is simple, such as selection by a finger on a screen using a touch panel, in consideration of a person who is unfamiliar with a computer such as an elderly person or a housewife or a person with a physical disability. In addition, for example, in a lower house member election, a “white vote” is provided as a voting option in addition to a candidate name in consideration of a case where a member of the small constituency wants to vote but a member of the proportional representative wants to abstain. Further, in consideration of the possibility of an erroneous operation in selecting a candidate, a confirmation screen for the selected candidate is displayed, and the erroneous operation can be corrected.

(4) Exit Terminal One exit terminal 4 is installed at the polling place. Exit terminal 4
After reading the voting information and the voting terminal signature from the voting card 6 and verifying the voting terminal signature, the voting information is transmitted to the totaling server 5 online. Exit terminal 4 and total server 5
In addition to preventing the eavesdropping on the network by encrypting the communication message between the communication terminal and the e-mail terminal, by attaching the signature of the exit terminal 4 to the communication message, the authentication of the exit terminal 4 and the falsification of the communication message can be prevented. The exit terminal 4 stores the voting information sent to the tallying server 5 and the tallying server signature sent from the tallying server 5 in the first database 8. At that time, the voting card 6 is collected near the exit terminal 4. The collected voting card 6 is sealed and stored from the viewpoint of preserving evidence for a complaint action against the result of counting votes at a later date.

(5) Tally Server One tally server 5 is installed in the constituency. Total server 5
Receives the voting information sent from the exit terminal 4 of each polling place every time voting is performed, stores the voting information in the second database 9, and transmits the tallying server signature to the exit terminal. After the voting time is over, the voting information on the second database 9 is totaled, and the number of votes of each candidate is output.

Table 1 summarizes the function of each component. The security card 7 is used for all the voting ticket servers 1, the reception terminal 2, the voting terminal 3, the exit terminal 4, and the tallying server 5 in order to prevent secret leakage of a key used for encrypting and signing voting information. Is done.

(Method for Satisfying Election Requirements) The basic requirements for the election are Fujisaki, Ota, and Okamoto, "Practical electronic voting method assuming a polling place", IEICE Tech. -24, 1993,
It is as follows. (1) Prevention of illegal voting: A voter can only vote once. (2) Guarantee of anonymity: It is secret who and who voted. (3) Guarantee of fairness: Until the voting is completed, no one can know the progress of the voting. (4) Prevention of deletion / falsification / inflation: The result of voting by a voter is not deleted, falsified, or inflated.

The above requirements are summarized in Table 2.

In the following, a method of realizing each of the above requirements in the present electronic voting system will be sequentially described. Note that the following items (A) to (D) are assumed in this examination. (A) In order to protect privacy, a voter is susceptible to fraud because no one monitors the voting activity. (B) Since the election manager at the polling place is under the watch of witnesses and voters, cheating cannot be performed. (C) The election manager of the tallying server is under the supervision of the witness and cannot perform fraud. However, since the voter cannot see the situation, there is a concern that the election manager may be distrusted. (D) The electronic voting system itself such as software does not operate illegally.

(1) Prevention of Unauthorized Voting A person who intends to vote is entitled to vote at this polling place and confirms that it is the first vote, as in the current election, by confirming with the polling place receptionist. The ballot manager will ask for a ballot ticket printed and mailed to the postcard, and the ballot administrator will fill out the electoral list assigned to the polling place to indicate that the vote has been completed.

Thereafter, in the present electronic voting system, the voting manager issues a voting card 6 in which the signature of the reception terminal is written at the reception terminal 2 to the voter whose confirmation is completed. Since the reception terminal signature is checked in the voting terminal 2, even if a forged voting card 6 is copied to the polling place by copying a voting ticket in advance, the voting terminal 3 is not written because the reception terminal signature is not written. Cannot be voted on because forgery is detected.

However, if the voting terminal 3 detects that there is no signature of the receiving terminal, it is operationally difficult to discriminate the defective voting card 6 or the malfunction of the system from the forged card on the spot. Therefore, the voting card 6 must be reissued while respecting the right to vote. In this way, the voting card 6 that has been first legally issued at the reception terminal 2
There is a risk that double voting will be performed using the second legitimate voting card 6 reissued instead of the forged card. In this system, the voting manager receives one voting card 6 from the voter at the exit of the polling place, inserts the voting card 6 into the exit terminal 4 and transmits the voting information to the counting server 5, so that two Voting card 6 can be used to prevent double voting.

(2) Guarantee of Anonymity In order to guarantee anonymity, the voting card 6 does not store any information that can identify a voter.

However, information for identifying individual voting information is necessary in order to realize the prevention of deletion / falsification / inflation described later. In order to realize this without impairing anonymity, the first random number generated by the voting terminal 4 is
Used as information for identifying voting information.

By making the number of digits of the first random number sufficiently large with respect to the number of voters in the constituency, the probability that the same random number is generated by a plurality of voting terminals in the same constituency becomes extremely small. However, considering the weight of one vote, no matter how small the probability, the same random number was generated,
Certain voting information is not allowed to be invalidated. Therefore, a sequence number is included in the voting ticket, and this sequence number is used as auxiliary information for further identifying voting information in which the first random number matches.

However, if the operator of the reception terminal 2 can see the sequence number in the voting ticket, the voter can be mapped to the sequence number, the sequence number and the voting information, and the anonymity may be lost. The sequence number in the voting ticket is encrypted so that it cannot be seen by the voting manager at the polling place reception, and is decrypted only by the voting terminal 3.

(3) Guarantee of fairness The reception terminal 2, the voting terminal 3, and the exit terminal 4 in the polling place are placed under the supervision of a voting manager and a witness, and the counting server 5 is monitored by a counting manager and a witness. Is placed below. Therefore, only the communication between the exit terminal 4 and the tallying server 5 may cause the progress of the voting to leak to the outside during the voting time.

The eavesdropping prevention of the voting information transmitted from the exit terminal 4 to the totaling server 5 is realized as follows. Exit terminal 4
Then, a second random number is generated to create a session key, and the voting information is encrypted using the session key. further,
The session key is encrypted using the encryption key, and transmitted to the tallying server 5 together with the encrypted voting information. The tallying server 5 decrypts the session key using the decryption key, and uses the decrypted session key. To decrypt the voting information. Also,
Using the common key between the exit terminal 4 and the tallying server 5 for encrypting and decrypting the session key, or using the public key of the tallying server 5 for encrypting the session key and using the secret key of the tallying server 5 for decryption. it can. The common key between the exit terminal 4 and the tallying server 5 is the security card 7 (IC
(The card can be used), and is installed when the exit terminal 4 and the counting server 5 are started up.

(4) Prevention of deletion / falsification / inflation The reception terminal 2, voting terminal 3, and exit terminal 4 in the polling place are within the reach of the voters. However, since the tallying server 5 is installed in a place where it cannot be seen, the voter is worried about the tampering of the tallying server 5. In the current election, it is possible to have a witness to monitor fraud at the time of counting votes, and to observe other people. In this electronic voting system,
It is assumed that counting is performed under the watch of a witness, but it is not possible to visually check whether there is any improper processing in the counting server 5. For this reason, the exit terminal 4 that can be monitored by the voter implements a mechanism for monitoring the deletion / falsification / inflation of the voting information by the aggregation server 5.

Specifically, the exit terminal 4 generates an exit terminal signature for the voting information and transmits it to the totaling server 5 together with the voting information. The totaling server 5 verifies the received exit terminal signature. Also, the exit terminal 4 is a tallying server 5
Checks the deletion, alteration, or inflated voting information of the voting information transmitted to the tallying server 5 using the first database 8 with respect to the voting list information published by the voting list information. File an objection to 5.

(Affinity with Current Elections) In the present electronic voting system, with a view to smoothly transitioning to the digitization of the current elections, measures for various system items in the current elections were examined. Hereinafter, description will be made sequentially.

(1) Simultaneous Multiple Elections Small constituencies and proportional representatives in the lower house election and the upper house election, chief and congressional elections in local public body elections, or prefectural and municipal elections, and the lower house In many cases, multiple elections are held on the same voting day, such as the Supreme Court Justice National Examination, which is held at the same time as the member election. In the current elections, ballot papers, ballot entries, and ballot postings are repeated as many times as the number of elections.

In the present electronic voting system, voting for a plurality of elections can be performed by one voting terminal 3 using one voting card 6 in consideration of the convenience of the voter. The main items for achieving this are described below. (A) One voting ticket stored in one voting card is made to correspond not to the individual elections to be held on the same day but to a plurality of elections to be held on the same day. (B) The voting terminal displays candidate information corresponding to the voting type and accepts the voting. The display of candidates and the act of voting are repeated for all elections held on the same day, and all voting information is stored on a single voting card. In addition, multiple names can be selected for one election, as in the case of the National Judge of the Supreme Court. (C) The counting server stores all the voting information in the second database 9 and counts the number of votes obtained for each candidate for each election at the time of counting votes.

(2) Voting description means In the current election, it is stipulated that the names of the candidates are self-written (handwritten, symbolic voting is possible in local government elections) on a ballot paper. And proxy voting is allowed.

In the present electronic voting system, on the premise that the Public Office Election Law is amended, the names of candidates and the like are displayed on the screen of the voting terminal, and the names of the candidates to be voted are selected by panel touch, so that the voting form can be used. Instead of writing the candidate's name on his own. In addition, instead of the assistant in the current election writing the candidate name designated by the voter on the ballot paper, the assistant can perform proxy voting by panel-touching the candidate name designated by the voter. It is considered that the request for proxy voting decreases in electronic voting by simplifying the self-writing on the voting paper by touching the panel. However, Braille cannot be displayed on a touch panel to be used in the present electronic voting system, so Braille voting must be excluded from the present system. When developing a dedicated voting terminal in the future, one of the issues to consider is to deal with braille voting.

(3) Absentee Voting Absentee voting is permitted for voting at the municipal election management committee for registering lists or working places, voting at designated facilities such as designated hospitals, and voting by mail. The absentee vote can be handled by any of the following methods. (A) The reception terminal 2, the voting terminal 3, and the exit terminal 4 are installed at the place where the absentee voting is performed, and the voting information is stored in the second database 9 of the tallying server 5 in the same manner as a normal voting. (B) The reception terminal 2 and the voting terminal 3 are installed at the place where the absentee voting is performed, the voting card storing the voting information is stored in an absentee voting envelope, and the voting card for the absentee voting is stored on the voting day. The voting information in the voting card 6 is transmitted to the tallying server 5 using the exit terminal. However, absentee voting by mail cannot be handled by this system.

(4) Overseas voting This system is the same as the absentee voting described above, and can be performed by this system except for postal voting. (A) The reception terminal 2, the voting terminal 3, and the exit terminal 4 are installed at the place where the absentee voting is performed, and the voting information is stored in the second database 9 of the tallying server 5 in the same manner as a normal voting. (B) The reception terminal 2 and the voting terminal 3 are installed at the place where the absentee voting is performed, the voting card storing the voting information is stored in an absentee voting envelope, and the voting card for the absentee voting is stored on the voting day. The voting information in the voting card 6 is transmitted to the tallying server 5 using the exit terminal.

Table 3 summarizes the range of the present electronic voting system corresponding to the current election system.

[0048]

As described above, according to the present invention,
An electronic voting system applicable to the current election can be provided.

In addition, the basic requirements for election, such as prevention of unfair voting, assurance of anonymity, assurance of fairness,
An electronic voting system that satisfies deletion / falsification / prevention of inflating can be provided.

Also, by applying the present electronic voting system to the current election, voting information can be collected online,
Since the counting of votes can be processed by a computer, there is no need to transport voting papers in the current election or to manually count them, thereby making it possible to reduce the number of counting operations and greatly reduce the counting time. In addition, since a candidate can select a candidate name on the terminal screen for voting, an effect of eliminating invalid votes due to erroneous writing or indecipherability that is likely to occur in the current election can be expected.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an electronic voting system according to the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Voting ticket server 2 Reception terminal 3 Voting terminal 4 Exit terminal 5 Total server 6 Voting card 7 Security card 8 First database 9 Second database

[Table 1]

[Table 2]

[Table 3]

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Toshiyoshi Tanaka 2-1-1, Nishi-Shinjuku, Shinjuku-ku, Tokyo NTT Advanced Technology Co., Ltd. F-term (reference) 3E038 AA01 GA02 KA03 5B049 AA05 AA06 BB39 DD01 EE02 FF09 GG10

Claims (7)

[Claims] 1. A voting ticket server that prepares a voting card storing voting tickets for voters before a voting date, and that the voting ticket is verified based on the fact that the voting person has been confirmed by collation with an electoral list. A reception terminal that generates a reception terminal signature for the reception terminal and stores the reception terminal signature in the voting card, and reads and verifies the reception terminal signature from the voting card and displays the candidate's name and the like on the terminal screen to the voter to vote. A voting terminal that prompts and stores voting information obtained by a voting action and a voting terminal signature for the voting information in the voting card, reads the voting information and the voting terminal signature from the voting card, and verifies the voting terminal signature. Transmitting the voting information online to the tallying server, and the voting information sent to the tallying server;
An exit terminal for storing the tally server signature sent from the tally server in the first database, and receiving the voting information sent from the exit terminal of each polling place every time voting is performed and storing it in the second database. Transmitting the tallying server signature to the exit terminal, collecting the voting information on the second database after the voting time is over, and outputting the number of votes of each candidate. An electronic voting system using a polling place method. 2. The electronic voting system according to claim 1, wherein said voting ticket is composed of an encrypted sequence number and a voting ticket server signature. 3. The electronic voting system according to claim 1, wherein the voting terminal generates a first random number used as information for identifying the voting information. 4. The exit terminal generates a second random number to create a session key, encrypts the voting information using the session key, encrypts the session key using an encryption key, and performs encryption. The voting information is transmitted to the totaling server together with the converted voting information, wherein the totaling server decrypts the session key using a decryption key, and decrypts the voting information using the decrypted session key. An electronic voting system using a polling place method according to claim 1. 5. An electronic device according to claim 4, wherein a security card for securely storing the common key is used when the common key system is used for encrypting and decrypting the session key. Voting system. 6. The exit terminal generates an exit terminal signature for the voting information, transmits the exit terminal signature to the tallying server together with the voting information, and the tallying server verifies the received exit terminal signature. Claim 1,
An electronic voting system according to the polling place method described in 4 or 5. 7. The exit terminal checks, with respect to the voting list information published by the tallying server, whether the voting information transmitted to the tallying server has been deleted, altered, or inflated by using the first database. 7. The electronic voting system according to claim 1, 4, 5, or 6, wherein an objection is filed with the totaling server if these are detected.