WO2025039447A1 - Electronic voting method and apparatus, and storage medium and electronic device - Google Patents

Abstract

Provided in the present disclosure are an electronic voting method and apparatus, and a storage medium and an electronic device. The method comprises: on the basis of masked voting results published by voting parties and received initial tag values, counting masked voting results on the basis of a pre-built vote counting tree, and determining a masked counting result, and first results and intermediate tag values which are outputted by operation nodes; on the basis of a homomorphic commitment function and the intermediate tag values, generating tag commitment values, and publishing the tag commitment values, such that the voting parties publicly verify the masked counting result; and when the verification of the masked counting result is successful, decrypting the masked counting result on the basis of mask bit shares published by the voting parties, determining a final voting result, and publishing the final voting result. By means of verifying a masked counting result, the accuracy of the process of counting voting results is ensured, and when the verification of the masked counting result is successful, the masked counting result is decrypted by using mask bit shares, thereby ensuring the accuracy of a final voting result.

Description

Electronic voting method, device, storage medium and electronic equipment Technical Field

The present disclosure relates to the field of computer technology, and in particular to an electronic voting method, device, storage medium and electronic device.

Background Art

With the continuous development of science and technology, electronic voting is becoming more and more widely used. At present, during the voting process, the voter can determine the selected option as the voting result based on the voting options and send it to the counting party. The counting party determines the final voting result based on the voting results of each voter. For example, during the election process, the voting options can be agree or disagree, so the voting result determined by the voter based on the voting options can be one of agree and disagree, and the final voting result determined by the counting party based on the voting results of each voter can be the number of agrees and the number of disagrees.

In addition, in order to protect the privacy of the voters and ensure that they can vote according to their true intentions, the privacy of each voter's voting results must be guaranteed, that is, other voters and vote counting parties other than the voter cannot know the voting results of the voter. In addition, it is also necessary to ensure that the final voting results are in line with the wishes of each voter, that is, to ensure the accuracy of the final voting results determined by the vote counting party. Therefore, how to conduct electronic voting is an important issue.

Based on this, the present disclosure provides a method for electronic voting.

Summary of the invention

The present disclosure provides an electronic voting method, device, storage medium and electronic device.

The present disclosure adopts the following technical solutions:

The present disclosure provides an electronic voting method, which is applied to a vote counting party, and comprises:

Determine the masked voting results published by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results of the voting party processing the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function;

According to each masked voting result and each initial label value, based on a pre-constructed counting tree, the masked voting results are counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each computing node in the plurality of computing nodes included in the counting tree are determined;

Based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result announced by the vote counting party;

When the mask statistical result is verified, determining the mask bit shares corresponding to the mask statistical result published by each voting party;

The masked statistical results are decrypted according to the bit shares of each mask, and the final voting results are determined and announced.

Optionally, the computing node includes a plurality of AND computing units;

The tag commitment value and each first result are published, specifically including:

For each AND operation unit, determine the mask voting result of the input AND operation unit, and determine the verifiable mask bit share of the input AND operation unit and the AND operation unit based on the secure multi-party computing preprocessing function. The share of verifiably masked bits of the meta-output;

Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result;

Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function;

The sum of the verification code commitment values is determined to be the verification code aggregate commitment value, and the verification code aggregate commitment value, the label commitment value and the first results are published.

Optionally, decrypting the mask statistical result according to each mask bit share to determine the final voting result specifically includes:

Determining the mask commitment value corresponding to the mask bit share announced by each voting party;

Publicly verifying each mask bit share according to each mask commitment value;

When the verification of each mask bit share is passed, the mask statistical result is decrypted according to each mask bit share to determine the final voting result.

Optionally, the masked commitment value includes an original commitment value and other commitment values;

Determining the mask commitment value corresponding to the mask bit share announced by each voting party specifically includes:

For each voting party, determine the original commitment value and other commitment values corresponding to the mask bit share announced by the voting party, wherein the original commitment value is the commitment value determined by the voting party based on the mask bit share corresponding to the voting party, and the other commitment values are the commitment values determined by the voting party based on the mask bit shares announced by other voting parties;

According to each mask commitment value, each mask bit share is publicly verified, specifically including:

Determining a sum of the original commitment values as a first value, and determining a sum of the other commitment values as a second value;

When the first value is consistent with the second value, it is determined that the verification of each mask bit share is passed.

The present disclosure also provides an electronic voting method, which is applied to a voting party and includes:

Determine the voting result according to the voting options, and generate the mask bit share using the secure multi-party computing pre-processing function based on the topology of the counting tree pre-built by the counting party;

The voting results are processed according to the mask bit shares to determine the masked voting results and publish them, and an initial label value corresponding to the masked voting results is generated and sent to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received initial label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result;

Determine the label commitment value and each first result published by the vote counting party;

Determine the label value output by each computing node in the vote counting tree according to each of the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value;

Publicly verifying the mask statistical result according to the label commitment value and the verification commitment value;

When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit shares announced by each voting party, determines and announces the final voting result.

Optionally, the mask statistics result is made public according to the label commitment value and the verification commitment value. Verification, including:

Determine the verification commitment values announced by other voting parties as other verification commitment values;

Aggregating the other verification commitment values and the verification commitment value;

The mask statistics result is publicly verified according to the aggregated commitment value and the label commitment value.

Optionally, the computing node includes a plurality of AND computing units;

According to the aggregated commitment value and the label commitment value, the mask statistics result is publicly verified, specifically including:

When the aggregated commitment value is consistent with the label commitment value, determining the masked voting results announced by the other voting parties;

For each AND operation unit, determine the mask voting result input to the AND operation unit according to each mask voting result and each first result, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit;

Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result;

Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function;

Determine the sum of the verification code commitment values as the verification aggregate commitment value, and publish the verification aggregate commitment value;

Determine the verification code aggregate commitment value announced by the vote counting party, and publicly verify the mask statistical result based on the verification code aggregate commitment value and the verification aggregate commitment value.

Optionally, determining a mask bit share corresponding to the mask statistical result and announcing it specifically includes:

Determining a mask bit share corresponding to the mask statistical result;

Based on the homomorphic commitment function, the mask commitment value corresponding to the mask bit share is determined and announced, so that the vote counting party can publicly verify the mask bit shares according to the mask commitment value corresponding to the mask bit share announced by each voting party.

Optionally, the masked commitment value includes an original commitment value and other commitment values;

Based on the homomorphic commitment function, determining a mask commitment value corresponding to the mask bit share and announcing it, specifically including:

Based on the homomorphic commitment function, determining that the commitment value corresponding to the masked bit share is an original commitment value;

Determine the mask bit shares corresponding to the mask statistical results published by other voting parties, and determine other commitment values based on the mask bit shares published by other voting parties and the homomorphic commitment function, and publish the mask bit shares, the original commitment value and the other commitment values.

The present disclosure provides an electronic voting device, which is applied to a vote counting party, and includes:

A first determination module is used to determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function;

A vote counting module is used to count the masked voting results and the initial label values based on a pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and the intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree;

A publishing module, used to generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the mask statistical result according to the label commitment value and each first result published by the vote counting party;

A second determination module is used to determine the mask bit shares corresponding to the mask statistical result published by each voting party when the mask statistical result is verified;

The decryption module is used to decrypt the mask statistical results according to the bit shares of each mask, and determine and publish the final voting results.

The present disclosure also provides an electronic voting device, which is applied to a voting party and includes:

A generation module is used to determine the voting result according to the voting options, and generate the mask bit share according to the topological structure of the counting tree pre-built by the counting party by using a secure multi-party computing pre-processing function;

A sending module, used to process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate a label value corresponding to the masked voting results, and send the label value to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result;

A determination module, used to determine the label commitment value and each first result published by the vote counting party;

A commitment module, used to determine the label value output by each operation unit in the vote counting tree according to the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value;

A verification module, used for publicly verifying the mask statistical result according to the label commitment value and the verification commitment value;

The mask module is used to determine and announce the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party decrypts the mask statistical result according to the mask bit share announced by each voting party, determines and announces the final voting result.

The present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the electronic voting method is implemented.

The present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned electronic voting method when executing the program.

At least one of the above technical solutions adopted in the present disclosure can achieve the following beneficial effects:

The electronic voting method provided by the present disclosure determines the masked voting results announced by each voting party, and receives the initial label value corresponding to the masked voting results sent by each voting party. Afterwards, according to each masked voting result and each initial label value, based on the pre-constructed counting tree, each masked voting result is counted, the masked statistical results output by the counting tree are determined, and the first result and the intermediate label value output by each computing node in the multiple computing nodes included in the counting tree are determined. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical results according to the label commitment value and each first result announced by the counting party. Afterwards, when the masked statistical results are verified, the masked bit share corresponding to the masked statistical results announced by each voting party is determined, and the masked statistical results are decrypted according to each masked bit share, and the final voting results are determined and announced.

It can be seen from the above method that when conducting electronic voting, the present disclosure determines the masked voting results announced by each voting party, and receives the initial label value corresponding to the masked voting results sent by each voting party. The masked voting result is the result after the voting party processes the voting result according to the mask bit share, so that the votes of each voting party can be protected. The privacy contained in the result. Afterwards, according to each masked voting result and each initial label value, based on the pre-constructed counting tree, each masked voting result is counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each computing node in the multiple computing nodes included in the counting tree are determined. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result announced by the counting party. Afterwards, when the masked statistical result is verified, the masked bit share corresponding to the masked statistical result announced by each voting party is determined, and the masked statistical result is decrypted according to each masked bit share, and the final voting result is determined and announced, so that the voting party can verify the accuracy of the masked statistical result, thereby ensuring the accuracy of the process of the counting party counting the voting results. When the masked statistical result is verified, each masked bit share is used to decrypt the masked statistical result to ensure the accuracy of the final voting result.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

FIG1 is a flow chart of an electronic voting method provided in an embodiment of the present disclosure.

FIG2 is a schematic diagram of a vote counting tree provided in an embodiment of the present disclosure.

FIG3 is a flow chart of another electronic voting method provided in an embodiment of the present disclosure.

FIG4 is a schematic diagram of the structure of an electronic voting device provided in an embodiment of the present disclosure.

FIG5 is a schematic diagram of the structure of another electronic voting device provided in an embodiment of the present disclosure.

FIG. 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure will be clearly and completely described below in combination with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

The technical solutions provided by various embodiments of the present disclosure are described in detail below in conjunction with the accompanying drawings.

The present disclosure provides an electronic voting method, which is applied to a vote counter, as shown in FIG1 . FIG1 is a flow chart of an electronic voting method provided by an embodiment of the present disclosure, including the following steps S100 to S108 .

S100: Determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function.

In the voting scenario, the voting party determines the selected option as the voting result according to the voting options, and informs the counting party of the voting results. The counting party determines and announces the final voting result according to the voting results of each voting party, and each voting party can know the final voting result. The voting scenario can be a scenario of voting for the candidate or a scenario of voting for the object to be elected, which is not specifically limited in this disclosure. In different voting scenarios, the voting party, the counting party, the voting options and the voting results may be different. In the election scenario, the voting party can be a voter or a voting device used by the voter, the counting party can be a vote counter for counting the votes of the voters or a counting device used by the counting party, and the voting options can be two options of agreeing to the election of the candidate and disagreeing to the election of the candidate. The voting party can choose one of the two options as the voting result and inform the counting party. The counting party determines and announces the final voting result according to the voting results of each voting party. The final voting result can be one of agreeing or disagreeing, and can also be the number of agreeing and disagreeing. It can be determined whether the candidate is elected according to the final voting result.

In addition, in the scenario of program evaluation, the voting party can be a member of a department or group or a voting device used by each member, the counting party can be any member other than the department or group or a device used to count votes, and the voting options can be whether the candidate program is passed or not. The candidate program is a program proposed by a department or group member for a certain business, such as a business plan for a commodity. The voting party can choose one of the two options as the voting result and inform the counting party. The counting party determines and announces the final voting result based on the voting results of each voting party. The final voting result can be one of passing or not passing, or the number of passing and not passing. Subsequently, whether the candidate program is passed is determined based on the final voting result. If the candidate program is passed, the business can be executed according to the candidate program. If the candidate program is not passed, the members of the group or department need to re-propose a plan.

However, in the voting scenario, it is necessary to ensure the privacy of the voting party and the accuracy of the final voting results determined by the vote counting party. Based on this, in electronic voting, the device used to count the number of votes (i.e., the voting results of each voting party), i.e., the vote counting party, can determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the vote counting party can be a system, a server, or an electronic device such as a desktop computer or a laptop computer. For the convenience of description, the method of electronic voting provided by the present disclosure is described below with the vote counting party as the execution subject. The voting party can be the voting device used by the voter, and the voting device can be a terminal, a server, a system, etc., which is not specifically limited in the present disclosure. The masked voting result is the result after the voting party processes the voting result according to the masked bit share, and the masked bit share is generated by the voting party based on the secure multi-party computation (MPC) preprocessing function. The initial label value corresponding to the masked voting result is a bit string randomly generated by the voting party based on the masked voting result. The secure multi-party computing preprocessing function is a function in the existing secure multi-party computing library. The secure multi-party computing preprocessing function can generate the global keys of each voting party and the vote counting party based on the vote counting tree, the mask bit shares of the data input to each operation node in the vote counting tree, the mask bit shares of the data output by each operation node in the vote counting tree, the message verification code of each mask bit share that needs to be verified, and the key corresponding to each message verification code.

In order to ensure the privacy of the voter, that is, to ensure that the voting results of the voter are not disclosed, the voter can determine the voting results according to the voting options, and use the secure multi-party computing preprocessing function to generate the mask bit share according to the topological structure of the counting tree pre-constructed by the counting party. The voting result is then encrypted using the mask bit share to obtain the masked voting result and publish it. The voter can also generate an initial label value corresponding to the masked voting result and send the initial label value to the counting party. The counting party can subsequently determine the masked voting results published by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party. Among them, the counting party can pre-publish the pre-constructed counting tree, so that the voter can determine the mask bit share according to the topological structure of the counting tree published by the counting party. The initial label value can be a bit string randomly generated by the voting party based on the masked voting result. When the bit value of the masked voting result is 0, the voting party can randomly generate a K-bit bit string as the initial label value. When the bit value of the masked voting result is 1, the voting party can perform an XOR operation on the bit string generated when the bit value is 0 and the pre-stored global key, and use the result of the XOR operation as the initial label value. K is a natural number and can be pre-set. The global key can be generated by the voting party in advance based on the secure multi-party computing preprocessing function.

S102: According to each masked voting result and each initial label value, based on a pre-constructed counting tree, the masked voting results are counted to determine the masked statistical results output by the counting tree, and the first result and intermediate label value output by each of the multiple computing nodes included in the counting tree.

S104: Generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the mask statistical result according to the label commitment value and each first result published by the counting party.

The counting party counts the masked voting results and the initial label values based on the pre-built counting tree, determines the masked statistical results output by the counting tree, and determines the first result and the intermediate label value output by each operation node. Afterwards, based on the homomorphic commitment function and the intermediate label values, the label commitment value is generated, and the label commitment value and the first results are announced, so that each voting party can publicly verify the masked statistical results based on the label commitment value and the first results announced by the counting party.

Among them, publishing the label commitment value and each first result is to publish the label commitment value and each first result to each voting party and a third party. The third party is a person or device other than the voting party and the vote counting party. For example, in an election scenario, the third party can be a person or device other than the candidate, the voter or the voting device, and the vote counter or the vote counting device. Since the label commitment value and each first result are open to all people or devices, in addition to the above-mentioned voting devices being able to verify the masked statistical results, a third party can also verify the masked statistical results, and this disclosure does not make specific limitations. The public verification in the following process also means that in addition to the voting parties and the vote counting parties, a third party can also verify it.

The counting tree is pre-constructed by the counting party based on the number of voting parties. The counting tree includes a number of operation nodes and leaf nodes. The leaf nodes in the counting tree represent the voting results corresponding to each voting party, and each leaf node represents the voting result of a voting party. All nodes in the counting tree except the leaf nodes are operation nodes, and the operation nodes are used to perform XOR operations, AND operations, etc. on the data input into the operation node. The result output by the root operation node in the counting tree is the final voting result after the voting results of each voting party are counted. In one embodiment, for the upstream node (i.e., the operation node) of the leaf node in the counting tree, the voting results of two voting parties are input into the upstream node, and for the upstream node of the upstream node, four voting directions can input data into the upstream node of the upstream node.

For example, as shown in FIG2, FIG2 is a schematic diagram of a vote counting tree provided by an embodiment of the present disclosure. Assume that there are n voting parties conducting electronic voting, namely, voting party _D1 to voting party _Dn , and the corresponding input of each voting party is _V1 to _Vn , and _V1 to _Vn are used as leaf nodes of the vote counting tree. Since the process of counting votes can be expressed as _V1 + _V2 + _V3 + _V4 +...+ _Vn , or can be expressed as ( _V1 + _V2 )+( _V3 + _V4 )+...+(Vn _-1 + _Vn )=[( _V1 + _V2 )+( _V3 + _V4 )]+...+(Vn _-1 + _Vn )], at the bottom layer of the vote counting tree, every two leaf nodes can be used as inputs of their upstream nodes, for example, _V1 and _V2 of the leaf nodes are used as inputs of their upstream nodes, and the upstream nodes are operation nodes. In the process from the upstream node of the leaf node of the vote counting tree to the top layer, the output of every two operation nodes is used as the input of its upstream node. The nodes with "+" in the box in Figure 2 represent the operation nodes in the vote counting tree, and the operation bits of the operation nodes are increased layer by layer. The operation bits of the upstream operation nodes of the two leaf nodes are 1 bit, and the operation bits of the upstream operation nodes of the upstream operation nodes are 2 bits. The operation bits of the operation nodes are increased layer by layer until the root operation node. The result output by the root operation node is V ₁ +V ₂ +V ₃ +V ₄ +...+V _n , and the operation bits of the root operation node are log n bits.

The above-mentioned homomorphic commitment function is used to process the label value, and the label value can be processed by adding a random factor to the label value. When the label commitment value is generated based on the homomorphic commitment function and each intermediate label value, the vote counting party can determine the commitment value corresponding to each intermediate label value based on the homomorphic commitment function, and use the sum of each commitment value as the label commitment value. Of course, the vote counting party can also first determine the sum of each intermediate label value, and then determine the commitment value of the sum of each intermediate label value as the label commitment value based on the homomorphic commitment function. The label commitment value is used by the voting party to verify whether the label values output by all computing nodes or computing units in the process of the counting party counting the voting results are correct. By verifying whether the label value is accurate, it is determined whether the mask statistical results obtained by the counting party based on the computing nodes or computing units are accurate.

Specifically, the vote counting party determines the masked voting result and label value of each operation node in the pre-constructed vote counting tree according to each masked voting result and each initial label value, and determines the masked voting result output by the operation node according to the masked voting result input to the operation node as the first result, and determines the label value output by the operation node according to the label value input to the operation node as the intermediate label value. Afterwards, the masked voting result output by the operation node is used as the masked voting result of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the masked voting result and label value output by the last operation node are determined, and the masked voting result output by the last operation node is used as the masked statistical result of the output of the vote counting tree. Afterwards, the vote counting party generates a label commitment value based on the homomorphic commitment function and each intermediate label value, and publishes the label commitment value and each first result, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result published by the vote counting party.

The next operation node of this operation node is the mask voting result and label output by this operation node. The value is used as the input computing node. When determining the masked voting result and label value input to the computing node, if the computing node is the upstream computing node of the leaf node in the vote counting tree, the masked voting result and label value input to the computing node is one of the masked voting results announced by each voting party and the initial label values received. If the computing node is not the upstream computing node of the leaf node in the vote counting tree, the masked voting result and label value input to the computing node is the masked voting result and label value output by the previous computing node of the computing node.

In the present disclosure, an operation node may include an XOR operation unit, and an operation node may include one or more XOR operation units. Therefore, when each operation node includes several XOR operation units, in the above step S102, the counting party may determine the masked voting result and label value input to the XOR operation unit for each operation node in the counting tree and for each XOR operation unit in the operation node in turn according to each masked voting result and each initial label value, perform XOR operation on the determined masked voting result, and determine the masked voting result output by the XOR operation unit as the first result. And perform XOR operation on the determined label value, and determine the label value output by the XOR operation unit as the intermediate label value. Afterwards, the masked voting result output by the XOR operation unit is used as the masked voting result of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the masked voting result and label value output by the last XOR operation unit are determined, and the masked voting result output by the last XOR operation unit is used as the masked voting result output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node. Afterwards, the masked voting result output by the operation node is used as the masked voting result of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the masked voting result and label value output by the last operation node are determined, and the masked voting result output by the last operation node is used as the masked statistical result output by the counting tree.

Wherein, if the XOR operation unit is the first operation unit in the operation node, the mask voting result and label value input to the XOR operation unit are the mask voting result and label value input to the operation node. If the XOR operation unit is not the first operation unit in the operation node, the mask voting result and label value input to the XOR operation unit are the mask voting result and label value output by the previous XOR operation unit of the XOR operation unit.

In the present disclosure, an operation node may include an AND operation unit, and an operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, in the above step 102, the counting party may determine the masked voting result input to the AND operation unit for each operation node in the counting tree, and for each AND operation unit in the operation node in turn, based on each masked voting result and each initial label value, and determine the unit ciphertext corresponding to the AND operation unit based on the determined masked voting result. Afterwards, determine the label value input to the AND operation unit, and determine the masked voting result and label value output by the AND operation unit based on the determined label value and unit ciphertext, and use the determined masked voting result as the first result, and use the determined label value as the intermediate label value. Then, the masked voting result output by the AND operation unit is used as the masked voting result of the next AND operation unit input to the AND operation unit, and the label value output by the AND operation unit is used as the label value of the next AND operation unit input to the AND operation unit, until the masked voting result and label value output by the last AND operation unit are determined, and the masked voting result output by the last AND operation unit is used as the masked voting result output by the operation node, and the label value output by the last AND operation unit is used as the label value output by the operation node. After that, the masked voting result output by the operation node is used as the masked voting result of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the masked voting result and label value output by the last operation node are determined, and the masked voting result output by the last operation node is used as the masked statistical result output by the counting tree.

If the AND operation unit is the first operation unit in the operation node, the mask voting result and label value of the AND operation unit are input as the mask voting result and label value of the operation node. If the AND operation unit is not the first operation unit in the operation node, the mask voting result of the AND operation unit is input as The AND label value is the mask voting result and label value output by the previous AND operation unit of the AND operation unit.

The above-mentioned unit ciphertext is determined by each voting party based on the vote counting tree and sent to the vote counting party. Therefore, in the above-mentioned step S100, the vote counting party can send the pre-constructed vote counting tree to each voting party, and then determine the masked voting results announced by each voting party, and receive the unit ciphertext of each AND operation unit in the vote counting tree sent by each voting party and the initial label value corresponding to the masked voting result. Among them, each voting party can generate a corresponding unit ciphertext for each AND operation unit in the vote counting tree, and when generating the unit ciphertext, it is necessary to determine the bit value of the masked voting result input to the AND operation unit, and the bit value can be 0 or 1. Since there are two masked voting results input to the AND operation unit, there are 4 combinations of the bit values of the masked voting results input to the AND operation unit, which are 00, 01, 10 and 11, respectively. Each combination corresponds to a unit ciphertext, so each unit ciphertext corresponding to the AND operation unit can be generated based on multiple combinations, and the unit ciphertext corresponding to each combination can be generated by each voting party, that is, there are several unit ciphertexts corresponding to the operation unit.

Based on this, when determining the unit ciphertext corresponding to the operation unit according to the determined masked voting result, the counting party can determine the combination of the bit values corresponding to the masked voting result according to the determined masked voting result, and determine the unit ciphertexts corresponding to the operation unit from the unit ciphertexts of the operation unit sent by each voting party according to the determined combination, that is, the number of unit ciphertexts corresponding to the operation unit. For example, voting parties _D1 and _D2 respectively sent 4 unit ciphertexts of the operation unit A to the counting party, and the 4 unit ciphertexts were determined based on 4 combinations (i.e., 00, 01, 10, and 11), so the counting party can receive a total of 8 unit ciphertexts of the operation unit A. Assuming that the bit values corresponding to the determined masked voting results are 0 and 1 respectively, the bit value combination is 01. The vote counter can determine the unit ciphertext corresponding to the combination 01 from the 8 unit ciphertexts of operation unit A sent by voting parties _D1 and _D2 . Therefore, the vote counter can determine the two unit ciphertexts corresponding to operation unit A.

When determining the masked voting result and the label value output by the AND operation unit according to the determined label value and the unit ciphertext, the counting party can determine the masked voting result and the label value output by the AND operation unit corresponding to each unit ciphertext according to the determined label value and the unit ciphertext. Afterwards, the determined masked voting results are used as the masked voting results output by the AND operation unit, and the determined label values are used as the label values output by the AND operation unit.

In the present disclosure, the operation node may also include several AND operation units and several XOR operation units. Therefore, in the above step S102, the vote counting party may determine the type of the operation unit for each operation node in the vote counting tree, and for each operation unit in the operation node in turn, according to each masked voting result and each initial label value. When the operation unit is an XOR operation unit, the masked voting result and label value output by the XOR operation unit are determined according to the above process, and the determined masked voting result is used as the first result, and the determined label value is used as the intermediate label value, which will not be repeated here. Afterwards, the determined masked voting result and label value are used as the masked voting result and label value of the next operation unit input to the XOR operation unit. When the operation unit is an AND operation unit, the masked voting result and label value output by the AND operation unit are determined according to the above process, and the determined masked voting result is used as the first result, and the determined label value is used as the intermediate label value, which will not be repeated here. Afterwards, the determined mask voting result and label value are used as the mask voting result and label value of the next operation unit input to the operation unit. The subsequent process is similar to the above process of determining the mask statistical result and label commitment value, which will not be repeated here.

In addition, since the masked voting results output by the XOR operation unit can be obtained by XORing the masked voting results input to the XOR operation unit, and the masked voting results of each voting party are published, that is, any party can know the masked voting results of each voting party, so when publicly verifying the masked statistical results, the counting party can only use the determined masked voting results output by each AND operation unit as the first result, and use the label value output by each AND operation unit as the intermediate label value. Afterwards, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are published.

S106: When the mask statistical result is verified, determine the mask bit shares corresponding to the mask statistical result published by each voting party.

S108: Decrypt the masked statistical results according to the bit shares of each mask, and determine and publish the final voting results.

When the masked statistical result is verified, the counting party determines the masked bit share corresponding to the masked statistical result published by each voting party. The masked statistical result is decrypted according to each masked bit share, the final voting result is determined, and the final voting result is announced. Among them, each voting party will send the masked bit share corresponding to the masked statistical result to the counting party, and the masked bit share is used to decrypt the masked statistical result finally output by the counting tree.

Specifically, each voting party publicly verifies the masked statistical results based on the label commitment value and each first result announced by the counting party in the above step S104. When the masked statistical results are verified, each voting party will announce the masked bit share corresponding to the masked statistical results. The counting party can determine the masked bit shares announced by each voting party, and decrypt the masked statistical results according to each masked bit share, determine the final voting results, and announce the final voting results. Among them, each masked bit share is a key generated by the voting party for the masked statistical results output by the counting tree, and the counting party can decrypt the masked statistical results output by the counting tree according to each masked bit share.

In addition, in order to ensure the accuracy of the masked bit shares announced by each voting party, the voting party can determine the masked commitment value corresponding to the masked bit share based on the homomorphic commitment function and announce it. The counting party determines the masked commitment value corresponding to the masked bit share announced by each voting party, and publicly verifies each masked bit share based on each masked commitment value. When each masked bit share is verified, the masked statistical results are decrypted based on each masked bit share, the final voting result is determined, and the final voting result is announced.

The masked commitment value announced by each voting party includes the original commitment value and other commitment values. Therefore, when determining the masked commitment value corresponding to the masked bit share announced by each voting party, the vote counting party can determine the original commitment value and other commitment values corresponding to the masked bit share announced by the voting party for each voting party, wherein the original commitment value is the commitment value determined by the voting party based on the masked bit share corresponding to the voting party, and the other commitment values are the commitment values determined by the voting party based on the masked bit shares announced by other voting parties. Other voting parties are voting parties other than the voting party.

Based on this, when publicly verifying each mask bit share according to each mask commitment value, the vote counting party can determine the sum of each original commitment value as the first value, and determine the sum of each other commitment value as the second value. When the first value is consistent with the second value, it is determined that each mask bit share has passed the verification. When the first value is inconsistent with the second value, it is determined that each mask bit share has failed the verification, and the vote counting party announces the message of the verification failure.

When the masked statistical results are decrypted according to the bit shares of each mask and the final voting result is determined, the following formula (1) can be used for calculation:

Among them, z _w represents the final voting result, z′ _w represents the mask statistical result, represents the exclusive OR operation, represents the share of each mask bit sent by voting party _Di , and n represents the number of voting parties.

It can be seen from the above method that when the present disclosure conducts electronic voting, the counting party can determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party. The masked voting result is the result after the voting party processes the voting result according to the masked bit share, so that the privacy contained in the voting results of each voting party can be protected. Afterwards, according to each masked voting result and each initial label value, based on the pre-constructed counting tree, each masked voting result is counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each computing node in the multiple computing nodes included in the counting tree are determined. Then, based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result announced by the counting party, so as to ensure the accuracy of the process of counting the voting results by the counting party, that is, to ensure the accuracy of the masked statistical result determined by the counting party. The vote counter only knows the masked statistical results, but not the specific voting results of each voter, which protects the privacy of the voter. In addition, it speeds up the calculation of voting results and reduces time costs. At the same time, when publicly verifying the masked statistical results, in addition to the voter, a third party can also Verification is performed to better ensure the accuracy of the masked statistical results. Afterwards, when the masked statistical results are verified, the masked bit shares corresponding to the masked statistical results published by each voting party are determined, and the masked statistical results are decrypted according to each masked bit share, and the final voting results are determined and announced, so that the counting party uses each masked bit share to decrypt the masked statistical results when the masked statistical results are verified, thereby ensuring the accuracy of the final voting results.

Furthermore, in order to ensure the accuracy of the mask bit shares announced by each voting party, the counting party can also verify each mask bit share according to the mask commitment value corresponding to the mask bit share announced by each voting party, and when each mask bit share is verified, use each mask bit share to decrypt the mask statistical result, determine and announce the final voting result. This prevents each voting party from announcing an incorrect mask bit share and ensures the accuracy of the final voting result.

In the present disclosure, in addition to verifying whether the label value is accurate and determining whether the mask statistics are accurate, it is also possible to further verify the mask voting results output by the operation node or the operation unit to determine whether the mask statistics are accurate. Therefore, when the label commitment and each first result are announced in the above step S104, the vote counting party can also determine the mask voting results input to the AND operation unit for each AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit based on the secure multi-party computing preprocessing function. According to the determined verifiable mask bit shares of the input and output, and the mask voting results, the verifiable check bits of the AND operation unit are determined. According to the verifiable check bits, the message verification code of the AND operation unit is determined, and the verification code commitment value of the message verification code is determined based on the homomorphic commitment function. Afterwards, the sum of the verification code commitment values is determined as the verification code aggregate commitment value, and the verification code aggregate commitment value, each first result and the label commitment value are announced. The verifiable masked bit shares include the masked bit shares, the message authentication codes corresponding to the masked bit shares, and the keys of the message authentication codes corresponding to the masked bit shares of other voting parties, where the other voting parties are voting parties other than the voting party itself. The verification code aggregate commitment value is used by each voting party to publicly verify the accuracy of the masked voting results output by the computing node or computing unit.

When determining the verifiable check bit of the AND operation unit based on the determined verifiable mask bit shares of the input and output and the mask voting result, the following formulas (2) to (3) can be used for calculation:

in, as well as The three parameters in the triple corresponding to the operation unit determined by the vote counting party T based on the secure multi-party computation preprocessing function can be 0 or any three values. _{d γ} and e _γ can be any pre-set values or directly 0. represents the verifiable check bit of the AND operation unit determined by the vote counting party T, z′ _α and z′ _β represent the two masked voting results input into the AND operation unit, as well as represents the two verifiable mask bit shares of the input to the AND operation unit determined by the vote counter T, It represents the share of verifiable mask bits output by the AND operation unit determined by the vote counter T.

Since the verifiable check bit is obtained through the above calculation, the verifiable check bit includes the message verification code corresponding to the check bit. The vote counter can directly determine the message verification code of the AND operation unit from the verifiable check bit corresponding to the AND operation unit, that is, the message verification code corresponding to the check bit. Subsequently, the verification code commitment value of the message verification code is determined based on the homomorphic commitment function. After that, the sum of the verification code commitment values is determined to be the verification code aggregate commitment value, which can be expressed as in, represents the message verification code of the operation unit w determined by the vote counter T, W represents the set of operation units, and Com(x) represents the homomorphic commitment function.

When determining the masked voting result and the label value output by the AND operation unit according to the determined label value and the unit ciphertext in the above step S102, the counting party can determine the masked voting result to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code (i.e., the masked voting result to be verified output by the AND operation unit) output by the AND operation unit according to the determined label value and the unit ciphertext for each unit ciphertext. The message verification code corresponding to the result is determined. Then the key of the message verification code output by the AND operation unit generated based on the secure multi-party computation preprocessing function is determined, and the calculation is performed according to the key and the masked voting result to be verified output by the AND operation unit to determine the first calculation result. Afterwards, it is determined whether each first calculation result is consistent with the message verification code corresponding to each masked voting result to be verified (that is, the message verification code output by each AND operation unit). If so, each masked voting result to be verified is used as the masked voting result output by the AND operation unit. If not, the voting party corresponding to the masked voting result to be verified that failed the verification is determined, and a verification failure message is sent to the determined voting party.

When determining the mask voting result to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code output by the AND operation unit according to the determined label value and the unit ciphertext, the following formula (4) can be used for calculation:

in, represents the unit ciphertext corresponding to the AND operation unit sent by the voting party _Di to the counting party, t＝z′ _α , z′ _α represents the masked voting result input into the AND operation unit, s＝z′ _β , z′ _β represents the masked voting result input into the AND operation unit, Indicates the label value input to the AND operation unit. Indicates the label value input to the AND operation unit. Indicates the mask voting result to be verified output by the AND operation unit, Indicates the masked voting result to be verified The corresponding message verification code, that is, the message verification code output by the AND operation unit, Indicates the intermediate label value output by the AND operation unit. The message verification code representing the masked voting results to be verified of other voting parties _Dj determined by the voting party _Di is determined by the counting party based on the determined label value and the unit ciphertext. represents the key of the message authentication code of the masked voting result to be verified output by the AND operation unit and determined by other voting parties _Dj and stored by voting party D _i , represents the masked voting result to be verified output by the AND operation unit determined by other voting parties _Dj , _Δi represents the global key of voting party _Dj , Represents the label value output by the AND operation unit. H(x) represents the hash function, γ represents the output of the AND operation unit, and s and t represent the two inputs of the AND operation unit respectively.

In the present disclosure, other voting parties can determine the initial label value of the masked voting result based on the masked voting result announced by the voting party, and send it to the counting party. The initial label value is a K-bit bit string randomly generated by other voting parties based on the masked voting result. Therefore, each masked voting result announced by each voting party corresponds to an initial label value generated by multiple voting parties. Therefore, in the above step S100, the counting party can receive each initial label value corresponding to each masked voting result sent by each voting party.

Based on this, in the above step S102, the counting party can count each masked voting result based on the pre-constructed counting tree according to each masked voting result and each initial label value corresponding to each masked voting result, and determine the masked statistical result output by the counting tree. The specific process is similar to the above process in which each masked voting result corresponds to an initial label value, except that each masked voting result corresponds to multiple initial label values, and the label value output by each XOR operation unit and each AND operation unit is a set containing multiple label values. The specific process will not be repeated here.

In the present disclosure, when the vote counting party announces the label commitment value and each first result, it can send the label commitment value and each first result to the bulletin board, so that each voting party and a third party can know the label commitment value and each first result. Of course, when the vote counting party announces other content, such as the verification code aggregation commitment value, it can also send the content to be announced to the bulletin board, and the present disclosure does not make specific limitations.

The present disclosure further provides an electronic voting method, which is applied to a voter. FIG3 is a flow chart of another electronic voting method provided by an embodiment of the present disclosure, and the method includes the following steps S200 to S210.

S200: Determine the voting result according to the voting options, and generate the mask bit share by using the secure multi-party computing preprocessing function according to the topological structure of the counting tree pre-constructed by the counting party.

S202: Process the voting result according to the mask bit share, determine the mask voting result, publish it, generate an initial label value corresponding to the mask voting result, and send the initial label value to the The vote counting party makes the vote counting party count the masked voting results announced by each voting party and the received initial label value based on the vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, generate a label commitment value based on the homomorphic commitment function and the intermediate label values, and publish the label commitment value and each first result.

In order to protect the privacy contained in the voting results, the voting party can first determine the voting results according to the voting options, and use the secure multi-party computing pre-processing function to generate the mask bit share according to the topological structure of the counting tree pre-constructed by the counting party. Then process the voting results according to the mask bit share, determine the masked voting results, and announce them, and generate the initial label value corresponding to the masked voting results, and send the initial label value to the counting party. Among them, the counting tree is constructed by the counting party according to the number of each voting party. The voting results are determined by the voting party according to the voting options. Different voting scenarios and different voting options will result in different voting results. Of course, the voting parties are also different. The specific voting parties and voting results in different voting scenarios can be what kind of data as described in the above step S100, which will not be repeated here. The secure multi-party computing pre-processing function is a function in the existing secure multi-party computing library. The initial label value corresponding to the masked voting result can be a label value randomly generated by the voting party based on the masked voting result.

Specifically, the voting party can determine the voting result according to the voting options, and use the secure multi-party computing preprocessing function to generate a mask bit share according to the topological structure of the counting tree published by the counting party, and then process the voting result according to the mask bit share to determine the masked voting result and generate an initial label value corresponding to the masked voting result. The masked voting result is published, and the initial label value is sent to the counting party. The counting party is enabled to count the masked voting results based on the counting tree according to the masked voting results published by each voting party and the received initial label value, determine the masked statistical results output by the counting tree, and determine the first result and intermediate label value output by each computing node in the multiple computing nodes included in the counting tree, and generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result.

In the present disclosure, an operation node may include an AND operation unit, and an operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, when sending the initial label value to the vote counting party, the voting party needs to send the unit ciphertext corresponding to the AND operation unit in the vote counting tree to the vote counting party in addition to sending the initial label value corresponding to the masked voting result to the vote counting party. Therefore, the voting party can determine the verifiable mask bit share and label value input to the AND operation unit for each operation node in the vote counting tree, and for each AND operation unit in the operation node in turn, and use a secure multi-party computing preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit. Then, according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, determine the unit ciphertext corresponding to the AND operation unit. Then, the unit ciphertext corresponding to each operation unit in the counting tree and the initial label value corresponding to the masked voting result are sent to the counting party.

Among them, if the operation node is the upstream operation node of the leaf node in the vote counting tree, the verifiable mask bit share input to the operation node is generated by the voting party using the secure multi-party computing preprocessing function, and the label value input to the operation node is the K-bit bit string randomly generated by the voting party or the result of the XOR operation of the randomly generated K-bit bit string and the global key, that is, the initial label value. If the operation node is not the upstream operation node of the leaf node in the vote counting tree, the verifiable mask bit share and label value input to the operation node are the verifiable mask bit share and label value output by the previous operation node of the operation node.

If the AND operation unit is the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit.

In addition, when the previous operation unit of the AND operation unit is an AND operation unit, a secure multi-party computing preprocessing function is used to determine the verifiable mask bit share output by the previous operation unit of the AND operation unit and use it as Input the verifiable mask bit share of the AND operation unit, and determine the label value output by the previous operation unit of the AND operation unit, and use it as the label value input to the AND operation unit. Of course, in the present disclosure, the operation node may also include a plurality of XOR operation units, so when the previous operation unit of the AND operation unit is an XOR operation unit, determine the verifiable mask bit share and label value of the previous operation unit (i.e., the XOR operation unit) input to the AND operation unit, perform XOR operation on the determined verifiable mask bit share, and use the result after the operation as the verifiable mask bit share output by the XOR operation unit, and perform XOR operation on the determined label value, and use the result after the operation as the label value output by the XOR operation unit. Use the verifiable mask bit share and label value output by the above-mentioned XOR operation unit as the verifiable mask bit share and label value input to the AND operation unit.

When determining the unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, the voting party may determine the first value according to the first numerical value in the triple and the first share of the verifiable mask bits input to the AND operation unit, and determine the second value according to the second numerical value in the triple and the second share of the verifiable mask bits input to the AND operation unit. Specifically, the following formulas (5) to (6) may be used for calculation:

Among them, the triplet is three parameters generated by the secure multi-party computing preprocessing function, and the triplet includes a first value, a second value, and a third value, that is, the first value, the second value, and the third value of the AND operation unit determined by the voting party _Di are respectively as well as The verifiable mask bit shares input to the AND operation unit include a first verifiable mask bit share and a second verifiable mask bit share, that is, the first verifiable mask bit share and the second verifiable mask bit share input to the AND operation unit determined by the voting party _Di are respectively as well as When the AND operation unit is the first operation unit of the operation node, and the operation node is the upstream operation node of the leaf node in the vote counting tree, as well as Both can be generated by the voting party based on a secure multi-party computing function, or can be 0, which is not specifically limited in this disclosure. represents the first value determined by the voting party _Di , Represents the second value determined by the voting party _Di.

Above as well as When it is not 0, it can be expressed by the following formula (7):

in, represents the share of verifiable mask bits generated by the voting party _Di and input into the operation node or the AND operation unit, represents the share of mask bits generated by voting party _Di , express The corresponding message verification code, Represents the key corresponding to the message authentication code generated by other voting parties _Dj and input into the operation node or corresponding to the mask bit share of the operation unit.

Then, the first value and the second value are sent to other voting parties. The other voting parties are voting parties that belong to the computing node together with the voting party, that is, the other voting parties are voting parties other than the voting party (that is, the above-mentioned voting party D _i , that is, the voting party as the execution subject) among the voting parties that input data to the computing node. The third value and the fourth value sent by other voting parties are received, and the received third value and the first value are aggregated to determine the first total value, and the received fourth value and the second value are aggregated to determine the second total value. Specifically, the following formulas (8) to (9) can be used for calculation:

Wherein, d _γ represents the first total value determined by the voting party _Di , n represents the number of voting parties, represents the first value determined by the voting party _Di , represents the third value determined by the voting party D _n , and the third value is sent to the voting party D _i . The determination process of the first value and the third value is similar, but they are determined locally by different voting parties. e _γ represents the voting party The second total value determined by D _i , Represents the second value determined by the voting party _Di. It represents the fourth value determined by the voting party D _n , and sends the third value to the voting party D _i . The second value is determined similarly to the fourth value, but is determined locally by different voting parties.

Afterwards, the mask voting result to be verified output by the AND operation unit is determined according to the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit. Specifically, the following formulas (10) to (11) can be used for calculation:

in, represents the masked voting result to be verified output by the AND operation unit determined by the voting party _Di , It represents the share of verifiable masked bits output by the AND operation unit determined by the voting party _Di , and the share of verifiable masked bits output by the AND operation unit is generated by the voting party _Di using the secure multi-party computing preprocessing function, t, s are bit values, and each t, s∈{0,1}.

Afterwards, the unit ciphertext corresponding to the AND operation unit is determined according to the mask voting result to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit. Specifically, the following formula (12) can be used for calculation:

in, It indicates the unit ciphertext corresponding to the operation unit determined by the voting party _Di. Since t can be 0 or 1, and s can be 0 or 1, there are 4 combinations of t and s. Each combination corresponds to a unit ciphertext, so there are 4 unit ciphertexts corresponding to the operation unit. :＝ is the assignment symbol, It indicates that when the bit value determined by the voting party _Di is t, the label value input into the AND operation unit is represents the label value input to the AND operation unit when the bit value determined by the voting party _Di is t, γ represents the output of the AND operation unit, The message verification code representing the mask voting result to be verified output by the AND operation unit, represents the label value output by the AND operation unit when the bit value determined by the voting party _Di is 0, _Δi represents the global key of the voting party _Di , It represents the key corresponding to the message verification code of the masked voting result to be verified output by the operation unit and determined by other voting parties _{Dj and} stored by the voting party Di.

If the AND operation unit is the first operation unit in the operation node, and the operation node is the upstream operation node of the leaf node in the vote counting tree, the above and They are all K-bit bit strings randomly generated by the voting party _Di , but the bit values are t and s respectively.

In the present disclosure, since the masked voting results of a voting party are announced to all other voting parties (i.e., other voting parties except the voting party), other voting parties can determine the initial label value corresponding to the masked voting results based on the masked voting results announced by the voting party, and send it to the counting party. The initial label value is a K-bit bit string randomly generated by the other voting parties based on the bit value of the masked voting results. The specific process is similar to the process of generating the initial label value in step S202 above, and will not be repeated here. Based on this, the counting party can receive each initial label value corresponding to each masked voting result sent by each voting party.

S204: Determine the label commitment value and each first result published by the vote counting party.

S206: Determine the label value output by each operation node in the vote counting tree according to the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value.

S208: Publicly verify the mask statistics result according to the label commitment value and the verification commitment value.

The voting party determines the label commitment value and each first result announced by the counting party, determines the label value output by each operation node in the counting tree according to each first result, and determines the verification commitment value of each label value according to the homomorphic commitment function. And publish the verification commitment value. Afterwards, the masked statistical results are publicly verified based on the label commitment value and the verification commitment value. Among them, the vote counting tree includes a number of operation nodes. When determining the label value output by each operation node in the vote counting tree according to each first result, since each first result is the masked voting result output by each operation node in the vote counting tree, the voting party can determine the masked voting results announced by other voting parties, and calculate the masked statistical results output by the vote counting tree according to the masked voting results determined in the above step S202, the masked voting results of other voting parties, and each first result according to each operation node in the vote counting tree, and determine the label value output by each operation node in the vote counting tree.

When determining the verification commitment value of each tag value according to the homomorphic commitment function, the voting party may first aggregate the tag values, and then determine the commitment value of the aggregated tag value as the verification commitment value based on the homomorphic commitment function. The voting party may also first determine the commitment value corresponding to each tag value based on the homomorphic commitment function, and use the result of aggregating the commitment values as the verification commitment value, which is not specifically limited in this disclosure.

In the present disclosure, the operation node may also include a number of XOR operation units and a number of AND operation units, so each label value corresponding to the above-mentioned verification commitment value is the label value output by each operation unit. In addition, since the masked voting result output by the XOR operation unit can be obtained by XOR operation of the masked voting result input to the XOR operation unit, and the masked voting result of each voting party is announced, that is, any party can know the masked voting result of each voting party, so when publicly verifying the masked statistical results, the counting party can only use the determined masked voting results output by each AND operation unit as the first result, and determine the label commitment value corresponding to the label value output by each AND operation unit, and announce the label commitment value and each first result. Correspondingly, the voting party can also only determine the verification commitment value corresponding to the label value output by each AND operation unit, and announce it. The verification commitment value can be specifically expressed as in, represents the label value output by AND operation unit w determined by the voting party _Di , and W represents the set of AND operation units.

In the above step S208, the voting party can determine the verification commitment value announced by other voting parties as other verification commitment values, aggregate the other verification commitment values and the verification commitment value, and then publicly verify the mask statistics result based on the aggregated verification commitment value and the label commitment value. Among them, the aggregated verification commitment value can be expressed as: Here, n represents the number of voting parties.

When the mask statistics result is publicly verified based on the aggregated verification commitment value and the label commitment value, when the aggregated verification commitment value is consistent with the label commitment value, it means that the mask statistics result has passed the verification. When it is established, it means that the mask statistics result verification has passed. When the aggregated verification commitment value is inconsistent with the label commitment value or the above formula is not established, it means that the mask statistics result verification has failed, and the voting party announces the message that the mask statistics result verification has failed. Indicates the label commitment value announced by the vote counter.

In addition, in addition to verifying whether the label value is accurate and determining whether the mask statistics are accurate, it is also possible to further verify whether the mask statistics are accurate by verifying the mask voting results output by the operation node or operation unit. Therefore, when the mask statistics are publicly verified according to the aggregated verification commitment value and the label commitment value, when the aggregated verification commitment value is consistent with the label commitment value, the mask voting results announced by other voting parties are determined. Afterwards, for each AND operation unit, according to each mask voting result and each first result, the mask voting result input to the AND operation unit is determined, as well as the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit are determined. Then, according to the determined verifiable mask bit share of the input and output, and the mask voting result, the verifiable check bit of the AND operation unit is determined. Then, according to the verifiable check bit, the message verification code of the AND operation unit is determined, and the verification code commitment value of the message verification code is determined based on the homomorphic commitment function. Afterwards, the sum of the verification code commitment values is determined to be the verification aggregation commitment value, and the verification aggregation commitment value is announced. Then, the verification code aggregate commitment value announced by the vote counting party is determined, and the mask statistics result is publicly verified based on the verification code aggregate commitment value and the verification aggregate commitment value. Among them, the verifiable check bit of the AND operation unit is determined based on the determined input and output verifiable mask bit shares and the mask voting results, which can be calculated using the following formula (13):

in, represents the verifiable check bit of the AND operation unit determined by the voting party _Di , z′ _α and z′ _β represent the two mask voting results input to the AND operation unit determined by the voting party _Di , as well as represents the two verifiable mask bit shares of the input to the AND operation unit determined by the voting party _Di , It represents the share of verifiable mask bits output by the AND operation unit determined by the voting party _Di.

Since the verifiable check bit is obtained through the above calculation, the verifiable check bit includes the message verification code corresponding to the check bit. The voting party can directly determine the message verification code of the AND operation unit from the verifiable check bit corresponding to the AND operation unit, that is, the message verification code corresponding to the check bit. Subsequently, based on the homomorphic commitment function, the verification code commitment value of the message verification code is determined, and then the sum of the verification code commitment values is determined as the verification aggregate commitment value. The verification aggregate commitment value can be expressed as in, represents the message verification code of the operation unit w determined by the voting party _Di , W represents the set of operation units, and Com(x) represents the homomorphic commitment function.

When publicly verifying the masked statistical results based on the verification code aggregate commitment value and the verification aggregate commitment value, the voting party can determine the verification aggregate commitment value announced by other voting parties, aggregate the verification aggregate commitment values of other voting parties and the above-determined verification aggregate commitment value, and publicly verify the masked statistical results based on the aggregated verification commitment value and the verification code aggregate commitment value. The aggregated verification commitment value can be expressed as When the aggregated verification commitment value is consistent with the verification code aggregate commitment value, it means that the mask statistics result verification has passed, that is, When it is established, it means that the masked statistical result verification has passed. When the aggregated verification commitment value is inconsistent with the verification code aggregate commitment value or the above formula does not hold, it means that the masked statistical result verification has failed, and the voting party announces the message that the masked statistical result verification has failed.

S210: When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit shares announced by each voting party, determines and announces the final voting result.

When the masked statistical result is verified, the voting party determines the masked bit share corresponding to the masked statistical result and announces it, so that the counting party decrypts the masked statistical result according to the masked bit share announced by each voting party, determines the final voting result, and announces the final voting result.

In order to ensure the accuracy of the masked bit shares announced by each voting party, when the masked statistical results are verified, the voting party can determine the masked bit shares corresponding to the masked statistical results, determine the masked commitment values corresponding to the masked bit shares based on the homomorphic commitment function, and announce them, so that the counting party can publicly verify each masked bit share according to the masked commitment values corresponding to the masked bit shares announced by each voting party, and when each masked bit share is verified, the counting party decrypts the masked statistical results according to each masked bit share, determines and announces the final voting results. Among them, the mask commitment value is used to verify whether the mask bit share is accurate. The mask commitment value includes the original commitment value and other commitment values. Therefore, when the mask commitment value corresponding to the mask bit share is determined based on the homomorphic commitment function and announced, the voting party can determine the commitment value corresponding to the mask bit share as the original commitment value based on the homomorphic commitment function, determine the mask bit share corresponding to the mask statistical result announced by other voting parties, and determine other commitment values based on the homomorphic commitment function according to the mask bit share announced by other voting parties, and announce the mask bit share, the original commitment value and other commitment values. The counting party determines that the sum of the original commitment values is the first value, and the sum of the other commitment values is the second value based on the original commitment values and other commitment values announced by each voting party. When the first value is consistent with the second value, it is determined that the verification of each mask bit share has passed.

In the present disclosure, when a voting party announces the masked voting results, it can send the masked voting results to a bulletin board so that other voting parties, vote counting parties, and third parties can learn of the masked voting results. Of course, when a voting party announces other content, such as verification commitment value, verification aggregate commitment value, and masked commitment value, it can also send the content to be announced to the bulletin board, which is not specifically limited in the present disclosure.

The above is the electronic voting method provided by the present disclosure. Based on the same idea, the present disclosure also provides an electronic voting device, which is applied to the vote counting party, as shown in FIG4 .

FIG4 is a schematic diagram of the structure of an electronic voting device provided by an embodiment of the present disclosure, including:

The first determination module 300 is used to determine the masked voting results announced by each voting party, and receive the label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function;

The vote counting module 302 is used to count the masked voting results and the initial label values based on the pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and the intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree;

A publishing module 304 is used to generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the mask statistical result according to the label commitment value and each first result published by the vote counting party;

A second determination module 306 is used to determine the mask bit shares corresponding to the mask statistical result published by each voting party when the mask statistical result is verified;

The decryption module 308 is used to decrypt the mask statistical results according to the bit shares of each mask, and determine and publish the final voting results.

Optionally, the computing node includes a plurality of AND computing units;

The publishing module 304 is specifically used to determine, for each AND operation unit, the mask voting result of the input to the AND operation unit, and based on the secure multi-party computing preprocessing function, determine the verifiable mask bit share of the input to the AND operation unit and the verifiable mask bit share of the output of the AND operation unit; determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output, and the mask voting result; determine the message verification code of the AND operation unit according to the verifiable check bit, and determine the verification code commitment value of the message verification code based on the homomorphic commitment function; determine the sum of the verification code commitment values as the verification code aggregate commitment value, and publish the verification code aggregate commitment value, the label commitment value and the first results.

Optionally, the decryption module 308 is specifically used to determine the mask commitment value corresponding to the mask bit share published by each voting party; publicly verify each mask bit share according to each mask commitment value; when each mask bit share is verified, decrypt the mask statistical result according to each mask bit share to determine the final voting result.

Optionally, the masked commitment value includes an original commitment value and other commitment values;

The decryption module 308 is specifically used to determine, for each voting party, the original commitment value and other commitment values corresponding to the mask bit share announced by the voting party, wherein the original commitment value is the commitment value determined by the voting party based on the mask bit share corresponding to the voting party, and the other commitment values are the commitment values determined by the voting party based on the mask bit shares announced by other voting parties; determine the sum of the original commitment values as a first value, and determine the sum of the other commitment values as a second value; when the first value is consistent with the second value, determine that the verification of the mask bit shares has passed.

The present disclosure also provides an electronic voting device, which is applied to a voting party, as shown in FIG5 .

FIG5 is a schematic diagram of the structure of another electronic voting device provided by an embodiment of the present disclosure, including:

The generation module 400 is used to determine the voting result according to the voting options, and generate the mask bit share according to the topological structure of the counting tree pre-built by the counting party by using the secure multi-party computing pre-processing function;

The sending module 402 is used to process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate an initial label value corresponding to the masked voting results, and send the initial label value to the counting party, so that the counting party counts the masked voting results based on the counting tree according to the masked voting results published by each voting party and the received initial label value, and determines the output of the counting tree. The masked statistical results, and the first results and intermediate label values output by each operation node in the plurality of operation nodes included in the vote counting tree are determined, and based on the homomorphic commitment function and the intermediate label values, a label commitment value is generated, and the label commitment value and the first results are announced;

A determination module 404, configured to determine the label commitment value and each first result published by the vote counting party;

The commitment module 406 is used to determine the label value output by each operation unit in the vote counting tree according to the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value;

A verification module 408, configured to publicly verify the mask statistical result according to the label commitment value and the verification commitment value;

The mask module 410 is used to determine and publish the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party decrypts the mask statistical result according to the mask bit share published by each voting party, determines and publishes the final voting result.

Optionally, the verification module 408 is specifically used to determine the verification commitment values announced by other voting parties as other verification commitment values; aggregate the other verification commitment values and the verification commitment value; and publicly verify the mask statistical results based on the aggregated verification commitment value and the label commitment value.

Optionally, the computing node includes a plurality of AND computing units;

The verification module 408 is specifically used to, when the aggregated verification commitment value is consistent with the label commitment value, determine the mask voting results announced by the other voting parties; for each AND operation unit, determine the mask voting result input to the AND operation unit according to each mask voting result and the first results, as well as determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit; determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit share of the input and output, and the mask voting result; determine the message verification code of the AND operation unit according to the verifiable check bit, and determine the verification code commitment value of the message verification code based on the homomorphic commitment function; determine the sum of the verification code commitment values as the verification aggregate commitment value, and announce the verification aggregate commitment value; determine the verification code aggregate commitment value announced by the counting party, and publicly verify the mask statistical result according to the verification code aggregate commitment value and the verification aggregate commitment value.

Optionally, the mask module 410 is specifically used to determine the mask bit share corresponding to the mask statistical result; based on the homomorphic commitment function, determine the mask commitment value corresponding to the mask bit share, and publish it, so that the vote counting party can publicly verify each mask bit share according to the mask commitment value corresponding to the mask bit share published by each voting party.

Optionally, the masked commitment value includes an original commitment value and other commitment values;

The mask module 410 is specifically used to determine, based on the homomorphic commitment function, that the commitment value corresponding to the mask bit share is the original commitment value; determine the mask bit share corresponding to the mask statistical result announced by other voting parties, and determine other commitment values based on the homomorphic commitment function according to the mask bit share announced by the other voting parties, and announce the mask bit share, the original commitment value and the other commitment values.

The present disclosure also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned electronic voting method is implemented.

The present disclosure also provides an electronic device. As shown in FIG6 , at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the above-mentioned electronic voting method.

Of course, in addition to software implementation, the present disclosure does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many of the improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and produce dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing programs. The original code before compilation must also be written in a specific programming language, which is called Hardware Description Language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that realizes the logic method flow.

The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer readable medium storing a computer readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that in addition to implementing the controller in a purely computer readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the means for implementing various functions included therein may also be considered as a structure within the hardware component. Or even, the means for implementing various functions may be considered as both a software module for implementing the method and a structure within the hardware component.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and/or hardware.

Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present disclosure is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present disclosure. It should be understood that the flowcharts and/or block diagrams may be implemented by computer program instructions. Each process and/or box in the flowchart and/or block diagram, and the combination of the processes and/or boxes in the flowchart and/or block diagram. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device for implementing the functions specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, Phase Change RAM (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of random access memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash Memory or other memory technology, Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, tape and disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

The present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

Each embodiment in the present disclosure is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

The above description is only an embodiment of the present disclosure and is not intended to limit the present disclosure. In general, the present disclosure may have various changes and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure should be included in the scope of the claims of the present disclosure.

Claims (13)

A method for electronic voting, characterized in that the method is applied to a vote counting party, and the method comprises: Determine the masked voting results published by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results of the voting party processing the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function; According to each masked voting result and each initial label value, based on a pre-constructed counting tree, the masked voting results are counted, the masked statistical result output by the counting tree is determined, and the first result and the intermediate label value output by each computing node among the multiple computing nodes included in the counting tree are determined; Based on the homomorphic commitment function and each intermediate label value, a label commitment value is generated, and the label commitment value and each first result are announced, so that each voting party publicly verifies the masked statistical result according to the label commitment value and each first result announced by the vote counting party; When the mask statistical result is verified, determining the mask bit shares corresponding to the mask statistical result published by each voting party; The masked statistical results are decrypted according to the bit shares of each mask, and the final voting results are determined and announced. The method according to claim 1, characterized in that the operation node comprises a plurality of AND operation units; The label commitment value and each first result are announced, including: For each AND unit, Determine the mask voting result input to the AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit based on the secure multi-party computation preprocessing function; Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result; Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function; The sum of the verification code commitment values is determined to be the verification code aggregate commitment value, and the verification code aggregate commitment value, the label commitment value and the first results are published. The method according to claim 1, characterized in that the mask statistical result is decrypted according to each mask bit share to determine the final voting result, comprising: Determining the mask commitment value corresponding to the mask bit share announced by each voting party; Publicly verifying each mask bit share according to each mask commitment value; When the verification of each mask bit share is passed, the mask statistical result is decrypted according to each mask bit share to determine the final voting result. The method of claim 3, wherein the masked commitment value includes the original commitment value and other commitment values; Determining the mask commitment value corresponding to the mask bit share announced by each voting party includes: For each voting party, determine the original commitment value and other commitment values corresponding to the mask bit share announced by the voting party, wherein the original commitment value is the commitment value determined by the voting party based on the mask bit share corresponding to the voting party, and the other commitment values are the commitment values determined by the voting party based on the mask bit shares announced by other voting parties; According to each mask commitment value, each mask bit share is publicly verified, including: Determining a sum of the original commitment values as a first value, and determining a sum of the other commitment values as a second value; When the first value is consistent with the second value, it is determined that the verification of each mask bit share is passed. A method for electronic voting, characterized in that the method is applied to a voting party, and the method comprises: Determine the voting result according to the voting options, and generate the mask bit share using the secure multi-party computing pre-processing function based on the topology of the counting tree pre-built by the counting party; According to the mask bit share, the voting result is processed to determine the masked voting result and publish it, and an initial label value corresponding to the masked voting result is generated and sent to the vote counting party. The vote counting party counts the masked voting results published by each voting party and the received initial label value based on the vote counting tree, determines the masked statistical results output by the vote counting tree, and determines the first result and the intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, generates a label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result; Determine the label commitment value and each first result published by the vote counting party; Determine the label value output by each computing node in the vote counting tree according to each of the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value; Publicly verifying the mask statistical result according to the label commitment value and the verification commitment value; When the masked statistical result is verified, the masked bit share corresponding to the masked statistical result is determined and announced, so that the vote counting party decrypts the masked statistical result according to the masked bit shares announced by each voting party, determines and announces the final voting result. The method according to claim 5, characterized in that the publicly verifying the mask statistical result according to the label commitment value and the verification commitment value comprises: Determine the verification commitment values announced by other voting parties as other verification commitment values; Aggregating the other verification commitment values and the verification commitment value; The mask statistics result is publicly verified according to the aggregated verification commitment value and the label commitment value. The method according to claim 6, characterized in that the operation node comprises a plurality of AND operation units; The publicly verifying the mask statistical result according to the aggregated verification commitment value and the label commitment value includes: When the aggregated verification commitment value is consistent with the label commitment value, determining the masked voting results announced by the other voting parties; For each AND unit, Determine the mask voting result input to the AND operation unit, and determine the verifiable mask bit share input to the AND operation unit and the verifiable mask bit share output by the AND operation unit according to each mask voting result and each first result; Determine the verifiable check bit of the AND operation unit according to the determined verifiable mask bit shares of the input and output and the mask voting result; Determine a message authentication code of the AND operation unit according to the verifiable check bit, and determine a verification code commitment value of the message authentication code based on the homomorphic commitment function; Determine the sum of the verification code commitment values as the verification aggregate commitment value, and publish the verification aggregate commitment value; Determine the verification code aggregate commitment value announced by the vote counting party, and publicly verify the mask statistical result based on the verification code aggregate commitment value and the verification aggregate commitment value. The method according to claim 5, characterized in that determining the mask bit share corresponding to the mask statistical result and announcing it comprises: Determining a mask bit share corresponding to the mask statistical result; Based on the homomorphic commitment function, the mask commitment value corresponding to the mask bit share is determined and announced, so that the vote counting party can publicly verify the mask bit shares according to the mask commitment value corresponding to the mask bit share announced by each voting party. The method of claim 8, wherein the masked commitment value includes an original commitment value and other commitment values; The determining, based on the homomorphic commitment function, a mask commitment value corresponding to the mask bit share and announcing the same comprises: Based on the homomorphic commitment function, determining that the commitment value corresponding to the masked bit share is an original commitment value; Determine the mask bit shares corresponding to the mask statistical results published by other voting parties, and determine other commitment values based on the mask bit shares published by other voting parties and the homomorphic commitment function, and publish the mask bit shares, the original commitment value and the other commitment values. An electronic voting device, characterized in that the device is applied to a vote counting party, and the device comprises: A first determination module is used to determine the masked voting results announced by each voting party, and receive the initial label value corresponding to the masked voting results sent by each voting party, wherein the masked voting results are the results after the voting party processes the voting results according to the masked bit shares, and the masked bit shares are generated by the voting party based on the secure multi-party computing preprocessing function; A vote counting module is used to count the masked voting results and the initial label values based on a pre-constructed vote counting tree, determine the masked statistical results output by the vote counting tree, and determine the first result and the intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree; A publishing module, used to generate a label commitment value based on the homomorphic commitment function and each intermediate label value, and publish the label commitment value and each first result, so that each voting party publicly verifies the mask statistical result according to the label commitment value and each first result published by the vote counting party; A second determination module is used to determine the mask bit shares corresponding to the mask statistical result published by each voting party when the mask statistical result is verified; The decryption module is used to decrypt the mask statistical results according to the bit shares of each mask, and determine and publish the final voting results. An electronic voting device, characterized in that the device is applied to a voting party, and the device comprises: A generation module is used to determine the voting result according to the voting options, and generate the mask bit share according to the topological structure of the counting tree pre-built by the counting party by using a secure multi-party computing pre-processing function; A sending module, used to process the voting results according to the mask bit share, determine the masked voting results, and publish them, and generate a label value corresponding to the masked voting results, and send the label value to the vote counting party, so that the vote counting party counts the masked voting results based on the vote counting tree according to the masked voting results published by each voting party and the received label value, determines the masked statistical results output by the vote counting tree, and determines the first result and intermediate label value output by each operation node among the multiple operation nodes included in the vote counting tree, and determines the label commitment value based on the homomorphic commitment function and the intermediate label values, and publishes the label commitment value and each first result; A determination module, used to determine the label commitment value and each first result published by the vote counting party; A commitment module, used to determine the label value output by each operation unit in the vote counting tree according to the first results, determine the verification commitment value of each label value according to the homomorphic commitment function, and publish the verification commitment value; A verification module, used for publicly verifying the mask statistical result according to the label commitment value and the verification commitment value; The mask module is used to determine and announce the mask bit share corresponding to the mask statistical result when the mask statistical result is verified, so that the vote counting party decrypts the mask statistical result according to the mask bit share announced by each voting party, determines and announces the final voting result. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 9 is implemented. An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of claims 1 to 9 when executing the computer program.