Systems and methods for secure voting

Methods, systems, and computer-readable media are provided for conducting an election. In one exemplary embodiment, there is provided a method for ensuring integrity of an electronic ballot. The method can include creating electronic ballots for voters based on votes received from the voters; digitally signing the electronic ballots; storing the signed electronic ballots; retrieving the signed electronic ballots from storage; verifying the digital signatures on the retrieved electronic ballots; and presenting the voters with validation pages derived from the retrieved electronic ballots, the validation pages including a user interface element for the voters to confirm that the retrieved electronic ballots accurately reflect their vote.

BACKGROUND

A. Technical Field

The present invention generally relates to computer security and, more particularly, for methods of implementing secure elections using networked computers.

B. Detailed Background

Computers can be used in a variety of different ways to conduct an election. For example, computers can be used to read punch cards or other paper-based ballots, and computers can also be used directly at a polling site where voters cast their vote using a computer. Computers placed at a polling site can store the votes locally, or they can transmit votes electronically across a network to a computer at another location, where the votes can be subsequently stored and counted.

Using computers to conduct an election introduces a number of efficiencies into the process. For example, computers can be easier for disabled persons to use than traditional polling booths. Electronic ballots can be more accurate than paper ballots because computers can record votes with near-perfect accuracy, rather than having human beings trying to discern voter intent from a punchcard. Further, votes can be tabulated much more quickly by a computer than by human beings or mechanical devices.

On the other hand, computers are susceptible to certain vulnerabilities that cause some apprehension about their use in a process as critical as an election. For example, doubts can arise about the integrity of votes cast at a computer. Mechanisms must be in place to ensure that a vote counted in an election was indeed actually cast by a voter and not manipulated by an attacker. Even assuming no one intentionally interferes with the integrity of an election, voters may have doubts that their electronic votes were accurately recorded. These voters may fear that their votes were inadvertently counted for the wrong election choice.

Using networked, rather than stand-alone, computers to conduct an election can introduce even further efficiencies into the election process. By centralizing certain processing at a server and using distributed voting terminals to communicate votes to the central server over a network, it is possible to reduce the potential for fraud. For example, by using one central server to store votes in a physically secure environment, the server may be more trustworthy than a number of dispersed voting terminals that have been handled by a number of different individuals.

However, transmitting data across any network generally leads to some security concerns. In the case of an election, a computer masquerading as a legitimate voting terminal could be used to cast any number of fraudulent votes. Further, a computer with access to the network could conduct a “snooping” attack and monitor a voter's choices in a given election. An attacker could also conduct a “spoofing” attack by presenting a web page on a voting terminal that makes the attacker's computer appear to be a central voting server.

Given the privacy concerns and potential for fraud discussed above, it is desirable to provide a comprehensive system for implementing secure elections using computers. It is further desirable to allow voters in an online election using a central server to accurately identify communications from the server as coming from the server and not a spoofing attacker. It is further desirable to allow voters to transmit network traffic that identifies the voters' choices to the server, while preventing an attacker on the network from being able to discern the choices.

SUMMARY

Consistent with the invention, there is provided methods and apparatus for ensuring the integrity of an electronic ballot, the method comprising the steps of creating electronic ballots for voters based on votes received from the voters; digitally signing the electronic ballots; storing the signed electronic ballots; retrieving the signed electronic ballots from storage; verifying the digital signatures on the retrieved electronic ballots; and presenting the voters with validation pages to confirm their votes, the validation pages being based on the retrieved electronic ballots.

Consistent with the invention, there is also provided methods and apparatus for identifying an election server to a voter over a network, the method comprising the steps of requesting a credential from the voter, the credential having been provided to the voter with verification data unique to the voter using a secure channel, presenting the verification data to the voter if the voter supplies the credential in response to the request, receiving, from the voter, acknowledgement data unique to the voter, altering the verification data using the acknowledgement data received from the voter, and identifying the election server to the voter by presenting the altered verification data to the voter over the network.

Consistent with the invention, there is also provided methods and apparatus for obscuring selections of voters in an on-line election, the method comprising the steps of storing media files representing election elements available to the voters, the election elements including a first election element and the media files including a media file representing the first election element, generating a plurality of unique first election element identifiers for use by the voters to select the first election element, assigning the first election element identifiers to the voters, sending the voters their respective assigned first election element identifiers and the media file representing the first election element, receiving an element identifier from a first one of the voters, and determining that the first voter has selected the first election element if the received element identifier matches the assigned first election element identifier sent to the first voter.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as described. Further features and/or variations may be provided in addition to those set forth herein. For example, the present invention may be directed to various combinations and subcombinations of the disclosed features and/or combinations and subcombinations of several further features disclosed below in the detailed description.

DETAILED DESCRIPTION

FIG. 1is a block diagram of an exemplary election system100. Election system100may include a voting terminal101-1for use by a first voter, a voting terminal101-2for use by a second voter, a network102, a web server103, an application server104, a database server105, a database mirror server106, and a network107. Collectively, web server103, application server104, database server105, database mirror server106, and network107comprise a central election site108. Networks102and107may each be any combination of wired or wireless computer networks. Networks102and107can be virtually any type of network, including a WAN such as the Internet, or a home- or office-based LAN. In one embodiment, network102is the Internet, and network107is a virtual private network (VPN) connecting the various servers in central election site108. Of course, many more terminals101-3to101-nmay be included in system100.

Voting terminals101-1and101-2, web server103, application server104, database server105, and database mirror106may be any suitable type of computer device such as a desktop or laptop computer, a commercial server, or a handheld device. Voting terminal101-1and101-2, web server103, application server104, database server105, and database mirror106may include one or more processors, as well as storage devices such as RAM, ROM, hard drives, CD/DVD, or flash drives. Methods consistent with the invention may be tangibly embodied on these storage devices as instructions for execution by the one or more processors. Voting terminals101-1and101-2, web server103, application server104, database server105, and database mirror106may also include various peripherals such as monitors, printers, keyboards, mice, and other devices.

Each of the components of system100shown inFIG. 1represents a physical implementation of a logical component of system100. However, the systems and methods disclosed herein can be embodied in many different combinations of hardware and software. Further, the systems and methods disclosed herein can be embodied in a geographically centralized or distributed manner.

Communication network102allows voting terminals101-1and101-2to communicate with the various servers in central election site108, in particular application server104. In one embodiment, communications from voting terminals101are sent to web server103using SSL (secure sockets layer) or TSL (transport layer security) protocol. Web server103then routes these communications across network107to application server104.

For the sake of brevity and clarity, the discussion below centers on two voters, namely a first voter operating voting terminal101-1, and a second voter operating voting terminal101-2. However, in actual use, any number of voters may operate any number of voting terminals to participate in the election. In some embodiments, more than one voter will use a single voting terminal. The voters at voting terminals101-1and101-2can be distinguished by using credentials supplied to voters before the election.

Also for brevity and clarity, the discussion below relates to an election in a single town, “Bigtown,” in the year 2008. The election is for the Mayor of Bigtown, and two candidates are on the ballot for Mayor. The disclosed embodiment can also be used in elections with multiple candidates, multiple jurisdictions, and with ballot choices other than human candidates, such as referenda or initiatives.

Application server104can implement various processes to conduct an election, such as sending election data to voting terminals101-1and101-2, and receiving data such as votes from voting terminals101-1and101-2, through web server103. Application server104can store votes on database server105. Database mirror server106can store identical data as that on database server105, to serve as a backup in case of malfunction. In one embodiment, database mirror server106is present in a different location than database server105, to further mitigate the risk of data loss. Database mirror server106can use available replication techniques, such as mirroring and clustering, to provide a backup of database server105.

FIG. 2Ais a block diagram of an exemplary voting terminal101. Voting terminals101-1and101-2share the architecture shown for voting terminal101. Voting terminal101includes a web browser201for browsing web sites such as those available over the Internet. Voting terminal101also includes a security component202for encrypting communications to and from web browser201. Security component202can provide secure sockets layer (SSL) or transport layer security (TSL) functionality to implement the secure communications for web browser201. Thus, web browser201can use SSL or TSL to encrypt communications and securely communicate across an insecure network such as the Internet. In some embodiments, security component202will be integrated into web browser201.

Voting terminal101also includes a receiving component203for receiving information over network102, and a transmitting component204for transmitting information over network102. Receiving component203may receive both encrypted communications for decryption by security component202, and unencrypted communications. Similarly, transmitting component204may transmit both communications encrypted by security component202, and unencrypted communications, over network102.

FIG. 2Bis a block diagram of web server103. Web server103includes web server software205, such as Apache HTTP Server. Web server software205can be used to provide a web site to which voting terminals101-1and101-2may connect over network102. Web server103also includes a security component206. Security component206provides services similar to security component202, such as providing secure sockets layer (SSL) or transport layer security (TSL) functionality to web server software205. Thus, security component206allows web server software205to encrypt communications and securely communicate across insecure networks. In some embodiments, security component206will be integrated into web server software205.

Web server103also includes a receiving component207and a transmitting component208. Receiving component207and transmitting component208function similarly to receiving component203and transmitting component204of voting terminal101, respectively, including using security component206to communicate with voting terminals101-1and101-2, and application server104.

FIG. 2Cis a block diagram of application server104. Application server104includes a reference table access component209for correlating identifiers to candidates or other election choices, as detailed below. Application server104also includes election element identification media storage210, for storing files such as pictures of candidates, or audio or video files that can be used to identify election candidates or other choices available to voters.

Application server104also includes a credential receiving and verifying component211, an election identifier providing component212, an election identifier receiving component213, an election identifier interpreting component214, an electronic ballot creation component215, a digital signature component216, an electronic ballot storing component217, an electronic ballot retrieving component218, a digital signature verification component219, a validation page presenting component220, and a vote tabulating component221. These components can perform steps in a method300, as discussed below with respect toFIG. 3.

Unless otherwise indicated, references herein to communications between application server104and voting terminals101-1and101-2may be assumed to be routed through web server103. Further, communications between application server104and voting terminals101-1and101-2may be assumed to use encrypted SSL or TSL sessions. As discussed, the SSL or TSL sessions can be implemented using security component202on voting terminals101-1and101-2, and security component206on web server103.

FIG. 2Dis a block diagram of database server105. Database server105includes a ballot storing component231for storing ballots received from application server104, and a ballot retrieving component232for retrieving the stored ballots and providing them to application server104. Database server105also includes a reference table233for storing certain data used to conduct an election, as discussed below. Generally speaking, application server104will use reference table access component209to access reference table233on database server105.

FIG. 2Eis a block diagram of database mirror106. Database mirror106includes a ballot storing component241for performing functions similar to those of ballot storing component231on database server105, a ballot retrieving component242for performing functions similar to those of ballot retrieving component232on database server105, and a reference table243for performing functions similar to those of reference table233on database server105.

FIG. 3is an exemplary flowchart300of a method consistent with the invention. Flowchart300illustrates a method for tabulating votes received from voters using election system100. An election can be any organized process where individuals vote for one or more particular outcomes. Examples of elections include local or national public elections such as those for choosing elected officials or referenda on ballot initiatives. Other examples of elections include shareholders voting to elect corporate board members or approve corporate decisions, or even public voting for a winner of a contest on television or on the Internet. Voting in an election can be one person one vote, cumulative voting, or any other counting mechanism used to determine an outcome based on voter choices.

The electronic election begins at step S301. At step S301, credential receiving component211on application server104receives credentials from voters and verifies the credentials to identify the voters, as discussed below. Prior to the election, each voter has been assigned and provided or already knows (e.g. birth date) one or more credentials. Once the election begins, these credentials are used by application server104to verify the voters' identity.

A first voter using voting terminal101-1and a second voter using voting terminal101-2can access application server104through web server103, and enter their credentials in response to a prompt displayed on voting terminals101-1and101-2. While method300is discussed as occurring concurrently for both voters, method300can be implemented at different times for each voter.

At step S301, credential receiving and verifying component211on application server104receives credentials from the voters and verifies the credentials to identify the voters, as discussed below.

Step S301begins when the first voter enters their assigned credentials into voting terminal101-1, and the second voter enters their assigned credentials into voting terminal101-2. Voting terminals101-1and101-2then send, using transmitting component204, the respective credentials through web server103to application server104.

Credential receiving and verifying component211can authenticate the first and second voters with the credentials received over the network, provided that the received credentials match the credentials supplied to the voters before the election. At this time, “trust tokens” can be used to identify central election site108to the voters at voting terminals101-1and101-2. Trust tokens are discussed in more detail below with respect toFIG. 9. Generally, trust tokens will only be displayed to those voters who have successfully provided their credentials to identify themselves to application server104.

At step S302, election identifier providing component212on application server104provides the identified first and second voters with election element identifiers corresponding to election elements, as discussed below.

After application server104receives credentials from each voter, election identifier providing component212assigns election identifiers to various election elements, such as a candidate A and a candidate B. Election elements can include any information about the election, including a voter's session identifier, the election itself, the races in the election, candidates in the election, ballot initiatives, referenda, or any other aspect of the election.

In one embodiment, the assigned election identifiers are “GUIDs,” or “Globally Unique Identifiers.” GUIDs are one example of an identifier complying with the Universally Unique Identifier (UUID) standard. UUIDs such as GUIDs are used to correlate to both a particular voting session and to a particular voter at a single point in time using reference table access component209and reference table223.

As shown inFIG. 2CandFIG. 4, application server104may create unique values of GUIDs401-A1,401-B1,401-A2, and401-B2using election identifier receiving component212and use the reference table access component209to store those values in the reference table223on database server105. GUIDs are used to uniquely associate each election element for an individual voting interaction. While GUID values are generally 128-bit identifiers, for simplicity GUID values in reference table233are illustrated as 4-digit base-10 GUIDs.

In one embodiment, voters' identities are verified using reference table233by the credential(s) that was supplied or known to them in advance. As shown in reference table233, if the first voter at voting terminal101-1uses credential “3518C” to identify themselves to application server104, application server104can use “3518C” to identify those GUIDs which are associated with the first voter. Similarly, if the credential assigned to the second voter at voting terminal101-2is “7832R,” application server104can store values of “7832R” to identify the GUIDs which are associated with the second voter.

For example, candidate A GUID400-A1can be designated for use by the first voter at voting terminal101-1to select candidate A, and candidate B GUID400-B1can be designated for the first voter to select candidate B. Similarly, candidate A GUID400-A2and candidate B GUID400-B2can be designated for use by voter2at voting terminal101-2, thus enabling candidates A and B as available choices for voter2. Note that the first voter can use a different GUID than the second voter to refer to the same election element. For example, as shown inFIG. 4, the first voter would use candidate A GUID400-A1, i.e. 4572, to refer to candidate A. In contrast, the second voter would use candidate A GUID400-A2, i.e. 1024, to refer to the same candidate, i.e. candidate A.

As shown inFIG. 5, each election element can be represented in one or more stored media files on election element identification media storing component210of application server104. For example, candidate A can be represented by a stored candidate A photo500A, and candidate B can be represented by a stored candidate B photo500B. Candidate A photo500A and candidate B photo500B are media files representing the election elements candidate A and candidate B, respectively. Similarly, the 2008 election for Bigtown is represented by Bigtown Election 2008 image501, and the mayor race in Bigtown is represented by Bigtown Mayor Race image502.

As shown inFIG. 4, reference table233includes a GUID column401that stores GUID values, thus correlating GUIDs to media files representing the different election elements. In addition, reference table233can be used to resolve election elements to a corresponding media file.

Candidate photos500A and500B can also include text image503A and503B, respectively. Text image503A indicates that candidate A's name is “Bob Smith,” and text image503B indicates that candidate B's name is “Pamela Jones.” However, candidate photos are not the only types of media files that can be used to represent candidates. For example, videos containing identifying information such as pictures of the candidate can be used to identify the candidates. Further, audio information can be stored in audio or video media files, such as a voice or moving video image saying the candidate's name. These alternate types of media files can be used in place of or in conjunction with candidate photos500A and500B to identify the candidates to the voters.

Application server104then creates a user-perceivable ballot such as an HTML ballot for both voters.FIGS. 6A and 6B, respectively, illustrate exemplary HTML ballots600-1for the first voter at voting terminal101-1, and600-2for the second voter at voting terminal101-2. The HTML source code for HTML ballot600-1includes values of the first voter's assigned GUIDs for each candidate, e.g. candidate A GUID400-A1and candidate B GUID400-B1. Similarly, the HTML source code for HTML ballot600-2includes both candidate A GUID400-A2and candidate B GUID400-B2. Application server104sends HTML ballot600-1over network102to voting terminal101-1, and HTML ballot600-2to voting terminal101-2.

Application server104separately sends candidate A photo500A and candidate B photo500B to voting terminals101-1and101-2. HTML ballots600-1and600-2are displayed in web browsers201on voting terminals101-1and101-2, concurrently with candidate A photo500A and candidate B photo500B.FIG. 6Aillustrates a view of first HTML ballot600-1as it would appear on voting terminal101-1, andFIG. 6Billustrates a view of second HTML ballot600-2as it would appear on voting terminal101-2.

HTML ballot600-1and HTML ballot600-2may each be displayed with several images to enable the voters to understand the ballot. For example, candidate A photo500A, candidate B photo500B, Bigtown Election 2008 image501, and Bigtown Mayor Race image502may all be displayed with HTML ballots600-1and600-2. Images602-1and602-2are signed trust tokens, to be discussed later in greater detail.

The first voter at voting terminal101-1decides to vote for candidate A, and registers a selection with choice response element601-1A corresponding to candidate A. Similarly, the second voter at voting terminal101-2decides to vote for candidate B, and registers a selection with choice response element601-2B, corresponding to candidate B.

At step S303, election identifier receiving component213on application server104receives at least a portion of the election element identifiers as votes for the corresponding election elements, as discussed below.

For example, because the first voter at voting terminal101-1selected candidate A, voting terminal101-1will send the corresponding GUID values, i.e. candidate A GUID401-A1value of “4572”, back to application server104to indicate a vote for candidate A. Similarly, voting terminal101-2will send candidate B GUID401-B2value of “5517” back to application server104, to indicate a vote for candidate B. Election identifier receiving component213receives the voted GUIDs over network102. This technique allows voting terminals101-1and101-2to indicate their corresponding voting choices to application server104without allowing a snooping attacker to discern the voting choices of the first and second voters. Using GUIDS to obscure communications between voting terminal101and application server104is discussed in more detail below.

At step S304, election identifier interpreting component214on application server104interprets the received election element identifiers as votes for the corresponding election elements, as discussed below.

For example, election identifier interpreting component214can interpret the received GUID value “4572” voted by the first voter at terminal101-1(namely401-A1) and see if that GUID value is a valid GUID for the first voter. Assuming that no failure due to an attack or other cause corrupts the transmission of the voted GUIDs, the GUID value received from the first voter will be “4572,” which matches candidate A GUID401-A1. Election identifier interpreting component214reads reference table233using reference table access component209. By reading reference table233, election identifier interpreting component214is able to interpret the received GUID value as a vote for candidate A. Likewise, election identifier interpreting component214interprets the GUID value from the second voter as a vote for candidate B if the GUID value received from voting terminal101-2matches the candidate B GUID401-B2value, i.e. “5517.” In this case, the method proceeds to step S305.

However, if a voted GUID value is invalid, i.e. does not match one of the voter's assigned GUIDs, application server moves back to step S101. For example, if application server304receives a GUID value other than “4572” or “7897” from voting terminal101-1, the method goes to back to step S101for voting terminal101-1, and new GUIDs are generated for each of the election elements for the first voter at voting terminal101-1. Similarly, if a GUID value other than “1024” or “5517” is received from voting terminal101-2, the method goes to step S101for voting. terminal101-2, and new GUIDs are assigned to the election elements. At this time, application server104will also log information about the invalid GUID such as the time the GUID was received and the identity of the voting terminal that sent the invalid GUID

Steps S305to S310may used to ensure that central election site108accurately records the received votes as electronic ballots. Thus, steps S305-S310constitute a method350for ensuring the integrity of the electronic ballots. As discussed below, method350may be integrated into method300, and steps S305-S310will be discussed with respect to method300. However, method350may be implemented independently of method300in various embodiments where it is desirable to ensure the integrity of an electronic ballot.

At step S305, electronic ballot creation component215on application server creates electronic ballots for the voters based on the received votes, as discussed below.

As shown inFIGS. 7A and 7B, electronic ballot creation component215will create a first electronic ballot700-1for the first voter at voting terminal101-1, and a second electronic ballot700-2for the second voter at voting terminal101-2. Note that electronic ballots700-1and700-2respectively constitute executed versions of HTML ballots600-1and600-2, thus representing the choices the voters selected on their respective HTML ballots. In one embodiment, electronic ballots700-1and700-2comprise XML code.

Electronic ballots700-1and700-2may be stored in volatile memory such as RAM on application server104, although those skilled in the art will appreciate that in some embodiments nonvolatile memory may be used in addition to or instead of RAM. For example, in virtual memory implementations, RAM may be used in conjunction with a hard drive on application server104to store electronic ballots700-1and700-2. In other implementations, nonvolatile memory such as flash memory may be used instead of volatile RAM.

Application server104may store electronic ballots700-1and700-2using representations other than the GUIDs sent by voting terminals101-1and101-2. For example, application server104may store database keys representing the candidates who were voted for. Application server104reads reference table233to translate the GUID values into the corresponding database key. For example, candidate_key_A may be the primary key for candidate A in database server105, and candidate_key_B may be the primary key for candidate B in database server105.

Thus, as shown inFIG. 7A, electronic ballot creation component215includes candidate key_A in selected election element field702-1of electronic ballot700-1for the first voter at voting terminal100-1, because the first voter provided the candidate A GUID401-A1value of 4572 indicating a vote for candidate A. Similarly, electronic ballot creation component215includes candidate key_B in selected election element field702-2of electronic ballot700-2for the second voter at voting terminal100-2, because the second voter provided the GUID401-B2value of 5517, indicating a vote for candidate B. Electronic ballots700-1and700-2also have race fields701-1and701-2, respectively, to identify which race they correspond to. In this case, electronic ballots701-1and701-2are both voted ballots in the race for the mayor of Bigtown.

Fields701and702may be conceptualized as a “base” electronic ballot, as fields701and702generally include stored information relevant to the election itself, e.g. the voter's choice in a given race. In some embodiments, as discussed below in more detail, fields703-706are included in electronic ballots700-1and700-2for encryption purposes. Further, as discussed below, fields707-709may be included in electronic ballots700-1and700-2for digital signature purposes.

At step S306, digital signature component216on application server104digitally signs the electronic ballots, as discussed below.

Digital signature component216generates a first cryptographic hash, or message digest, of electronic ballot700-1, and a second cryptographic hash, or message digest, of electronic ballot700-2. In particular, the first cryptographic hash is a hash of fields701-1and701-2, and the second cryptographic hash is a hash of fields701-2and702-2. Thus, the cryptographic hashes are performed on the “base” electronic ballots represented by fields701and702. These message digests can be created, for example, using SHA1 or other suitable hashing algorithms known to those skilled in the art.

The message digests serve as unique identifiers for the contents of electronic ballots700-1and700-2, such that it is computationally infeasible to generate a different electronic ballot that will hash to the same message digest. Thus, these message digests can be used to ensure that the contents of electronic ballots700-1and700-2have not been altered.

Digital signature component216then creates digital signature709-1by encrypting the first message digest for electronic ballot700-1with an encryption key. In some embodiments, the encryption key used by digital signature component216at this step is a private key from a public/private key pair such as are used in RSA (Rivest, Shamir, Adelman) or DSA (digital signature algorithm). Digital signature component216then appends digital signature709-1to the encrypted electronic ballot700-1. Similarly, digital signature component216creates digital signature709-2by encrypting the second message digest for electronic ballot700-2with the private key, and appends digital signature709-2to the encrypted electronic ballot700-2.

While creating the digital signatures, digital signature component216also may append some information for the digital signatures to electronic ballots700-1and700-2. For example, digital signature component216may append hash method identifiers707-1and707-2, certificate serial numbers708-1and708-2, and digital signatures709-1and709-2.

At step S307, electronic ballot storing component217on application server104stores the signed electronic ballots, as discussed below.

Electronic ballot storing component217sends signed encrypted electronic ballots700-1and700-2over network107to database server105. For redundant storage, either database server105or electronic ballot storing component217can send a copy of the signed encrypted electronic ballots700-1and700-2to database mirror106. The signed electronic ballots can be stored in ballot holding areas234and244on database server105and database mirror106, respectively. Ballot holding areas234and244are used to store the signed electronic ballots until the ballots are verified by a voter, as discussed below.

Ballot storing components231and241will generally store the signed encrypted ballots in nonvolatile storage such as a hard drive, although in many embodiments they will also be temporarily stored in RAM on database servers105and106before being moved to the nonvolatile storage. Once the signed electronic ballots have been stored on database server105, application server104may delete part or all of the electronic ballots.

By eliminating the electronic ballots from any volatile or nonvolatile storage on application104, it will be possible to prove that the electronic ballots stored on database server105accurately reflect the choices received from the voters at step S303. Immediately after deleting the electronic ballots, an auditor may inspect application server104to ensure that no electronic ballots are remaining in volatile or nonvolatile storage. In some embodiments, not only are the electronic ballots themselves wiped from application server104, but any election data, such as data from reference table233, may be completely eliminated from application server104.

At step S308, electronic ballot retrieving component218on application server104retrieves the signed electronic ballots from storage. For example, shortly after storing the signed, encrypted electronic ballots700-1and700-2, electronic ballot retrieving component218can retrieve ballots700-1and700-2from ballot holding area234on database server105to subsequently verify their integrity on database server105. In some embodiments, each electronic ballot is retrieved and verified immediately after the electronic ballot is deleted from memory on application server104.

At step S309, digital signature verification component219on application server104verifies the digital signatures on the retrieved electronic ballots, as discussed below.

Digital signature verification component219performs a first cryptographic hash of electronic ballot700-1. In some embodiments, the hash will be performed on the base electronic ballot, e.g. fields701-1and701-2. Digital signature verification component219also decrypts first digital signature709-1using the public key from the public/private key pair to obtain a first message digest for electronic ballot700-1.

The first cryptographic hash is compared to the first message digest, and if a match is obtained, digital signature verification component219has verified that electronic ballot700-1has remained intact since originally being signed by application server104. Digital signature verification component219performs a similar process for electronic ballot700-2, generating a second cryptographic hash of electronic ballot700-2and comparing the second cryptographic hash with a second message digest obtained by decrypting digital signature709-2.

For electronic ballots that are verified to be intact, the method proceeds to step S310to allow the voters to validate their choices. However, if a message digest does not match the calculated cryptographic hash, this indicates that a particular ballot was improperly stored or altered since the digital signature was appended at step S309. In this case, the method returns to step S301, and the voter is given another opportunity to cast their vote.

In some embodiments, the method does not return to step S301, and the voter may not be allowed to cast another vote. In other embodiments, the voter may have to take other steps to participate in the election. For example, the voter may have to present physical identification to receive a new set of credentials before returning to step S301. It is also useful to store certain information if the decrypted message digest does not match the calculated hash, such as voter credentials and identification, the time when the electronic ballot was initially stored on database server105, and the time when the electronic ballot was retrieved from database server105.

Note that because the electronic ballots were deleted from application server104at step S307, it is possible to be certain that the electronic ballots retrieved at step S308are the ballots stored on database server105, rather than a local copy on application server maintained on104. This can be useful, for example, to prove to an auditor that database server105includes an accurate copy of the ballot created at step S307, and not a copy placed on application server104by an attacker. Further, because the messages digest will only properly decrypt with the public key if they were encrypted with the private key, it is possible to ensure that the electronic ballots were signed by application server104, and not signed or altered by an attacker, provided that the private key from the public/private key pair has not been compromised.

At step S310, validation page presenting component220on application server104presents the voters with validation pages derived from the retrieved electronic ballots, as discussed below.

Validation page presenting component220receives electronic ballots700-1and700-2, from digital signature verification component219. As shown inFIGS. 8A and 8B, validation page presenting component220then creates a validation page800-1for the first voter at voting terminal101-1and a validation page800-2for the second voter at voting terminal101-2. Validation page presenting component220then sends the respective validation pages to voting terminals101-1and101-2.

Note that validation page presenting component220is creating validation pages800-1and800-2based on the electronic ballot retrieved from database server105. Validation pages are not created based directly on the received GUIDs or other information stored on application server104; indeed in some embodiments this would be impossible as all such data is erased from application server104. Thus, it is possible to prove that validation pages accurately reflect the content of database server105.

Voting terminal101-1displays validation page800-1to the first voter, and voting terminal101-2displays validation page800-2to the second voter. As shown, validation page800-1accurately reflects the choice of candidate A at voting terminal101-1by the first voter, and validation page800-2accurately reflects the choice of candidate B. The voters can click “Confirm my vote” input element801-1and801-2respectively, and voting terminals101-1and101-2will transmit information over network102indicating to application server104that the votes have been validated. In some embodiments, when a voter confirms their vote, the corresponding electronic ballot is moved from ballot holding area234to ballot storing component231. Thus, ballot holding area234can store electronic ballots awaiting validation, and ballot storing component231can store only validated ballots. In other embodiments, application server104can simply mark ballots as validated once voters confirm their choices.

In certain embodiments, validation pages800-1and800-2can be presented for each decision a voter makes in a given election, thus allowing voters to do interim validations for each vote they cast in the election. For example, a voter would perform receive a validation page each time they voted for a candidate in a given race, and also for each referendum or other election choice. In other embodiments, a voter's selections across an entire election are combined into a single validation page. In such embodiments, validation pages800-1and800-2would include information reflecting each selection the voter made in the election.

When a voter does a final validation of their votes, multiple images representing election elements can be combined into an individual image that represents the combination of election elements. For example, a final validation page could include a single image file with a picture of a voter's chosen candidate for mayor along with a picture of the voter's chosen candidate for sheriff. When a final validation page is used, votes are not fully validated until the voter approves the collection of all of their votes in the final validation page.

In other embodiments, one or more audio files can be used in place of, or in conjunction with, image files to allow a voter to confirm their selections. The audio files may contain recordings of the voter's selected candidate, or recordings of other individuals, speaking the candidate's name. In some embodiments, final or interim validation images can be distorted to prevent detection of similar images based on file size or by calculating hash values of different files. In some embodiments, images contain watermarks to authenticate them as images provided by application server104.

In some embodiments, validation pages800-1and800-2include a CAPTCHA that the voter must complete in order to validate their selection. As known in the art, a CAPTCHA is a challenge-and-response test to distinguish between a computer and a human, typically requiring that human users verify themselves by correctly identifying a series of distorted letters. If validation page800-1and800-2include audio files, the audio files may contain an audio CAPTCHA that must be completed to validate the votes.

In place of a CAPTCHA, an accessible audio identification technique can be used. In this technique, several audio files representing a single subject can be sent from application server104to voting terminals101-1and101-2. Voters must correctly identify the common subject in order to validate their votes. For example, an audio file of a dog barking, and an audio file of a person training their dog to fetch can be presented to the voters. The voters must correctly choose “dog” as the subject out of a series of options in order to validate their votes. In some embodiments, the audio files are accompanied by images or videos representing the same subject as the audio files.

For voters who successfully validate their votes, application server104can separate any identification data for the voters (such as voting terminal column402from reference table233, or any credentials information, user ID, or other information) from the voter's selections. Validated votes are stored by application server104on database105, and any voter identification data can be discarded or stored in a separate database. In this way, it is impossible to use database105to associate voter identifications with voter selections, i.e. one cannot discern from database105which individuals voted for which candidates.

For voters who validated their votes by selecting “confirm my vote,” the method moves to step S310. For voters who instead select “Do not confirm my vote,” the method returns to step S301, and the voters are required to re-enter their credentials in order to proceed through method300again. In other embodiments, voters who do not confirm their votes are not required to re-enter their credentials, but simply return to step S308where their ballots are retrieved again from storage and another opportunity is provided to confirm their vote. In still further embodiments, voters who do not confirm their vote return to step S302, where new GUIDs are generated and the voters cast their votes again. Regardless of how method300is implemented for voters who do not confirm their votes, the corresponding electronic ballots may be deleted from ballot holding area234when the voters do not confirm their votes.

At step S311, vote tabulating component221on application server104tabulates the validated votes on database server105, as discussed below.

Vote tabulating component221retrieves the validated votes from database105and counting the votes for each candidate. Application server104can retrieve the votes in arbitrary order, such as by GUID. The tabulated results then can be used to determine an election winner.

Encrypted Electronic Ballots

As discussed above, digital signature component216may sign electronic ballots700-1and700-2at step S306. In some embodiments, electronic ballots700-1and700-2may be encrypted by encryption component222before they are digitally signed. In some embodiments, digital signature component216will use a symmetric encryption algorithm such as AES (advanced encryption standard), DES (data encryption standard), TwoFish, or 3DES (triple DES).

In some embodiments, encryption component222will encrypt “base” electronic ballot fields701and702. To each electronic ballot, encryption component222will append encryption algorithm identifiers703-1and703-2, key bit lengths704-1and704-2, encryption keys705-1and705-2, and encryption algorithm initialization vectors706-1and706-2in voted electronic ballots700-1and700-2. In such embodiments, digital signatures709-1and709-2can be computed not only for “base” electronic ballot fields701and702, but also for fields703-706.

As understood by those skilled in the art, if digital signatures are computed for the encryption fields703-706as well as base electronic ballot fields701and702, digital signature component216will need to calculate cryptographic hashes based on all of these fields to create a message digest that will match the decrypted digital signature at step S309. In this manner, it is possible to ensure not only that fields701and702have not been altered for a given electronic ballot, but also that appended encryption information703-706is also secure.

Remote RSA Encryption

In other embodiments, electronic ballots700-1and700-2are encrypted using public key encryption rather than symmetric encryption. In such embodiments, encryption component222will encrypt electronic ballots700-1and700-2using a public key from a public/private key pair. An election official can be provided with a corresponding private key using a secure channel. Thus, only the election official can decrypt the encrypted electronic ballots. In some embodiments, the election official will have the key on a computer-readable medium such as a flash drive, and application server104will be unable to decrypt the electronic ballots until the flash drive is installed in application server104.

In such embodiments, once an auditor (or the election official) verifies at step S307that election data has been deleted from application server104, it is impossible for application server104to interpret the encrypted electronic ballots on database server105. This provides an added layer of security by allowing the election official to do any required auditing of application server104while securely holding onto the private key. Once the auditing is completed, the election official can provide the private key, thus allowing application server104to begin decrypting the votes. This provides additional confidence that the validation pages presented to the voters at step S310are indeed derived from secure electronic ballots on database server105.

In some embodiments, application server104can also be wiped clean after step S310. In such embodiments, application server will need perform steps similar to steps S308and S309, e.g. again retrieving and verifying the signed electronic ballots from storage before tabulating the votes, along with any required decryption of the electronic ballots. This can provide a second entry point for auditing the election. In embodiments where an election official controls a private decryption key, step S311cannot take place until the election official agrees that application server104is secure, and provides the private key for decrypting the electronic ballots in ballot storing component231. In some embodiments, application server104will display each digital signature to the election official or auditor to prove that each retrieved ballot is a ballot signed at step S306.

Trust Token

FIG. 9is an exemplary flowchart900of a method consistent with the invention. Flowchart900illustrates a method for identifying application server104to a voter at voter terminal101using election system100. The method can be implemented, for example, using credential receiving and verifying component211of application server104.

As shown inFIG. 10, credential receiving and verifying component211may include a credential requesting component1001, a token presenting component1002, an acknowledgement data receiving component1003, a token altering component1004, and an altered token presenting component1005. These components can be used to implement method900, as discussed below.

Before step S901, the first voter and the second voter are provided with verification data such as a token, and one or more credentials. The credentials can be generated by application server104, or can be generated simply by having each voter provide some information already known to each voter. For example, a credential could be a birth year, a 4-digit PIN, a password, or a membership number. The generated credential can be composed in whole or part of information supplied by each voter, such as the password or birth year. In a certain embodiments, multiple credentials are generated for each voter, so that each voter has at least a first credential and a second credential. For the sake of brevity, one credential will be discussed for each voter. The first voter has been provided a credential “3518C,” and the second voter has been provided credential “7832R.”

In one embodiment, a unique trust token is assigned to each voter, and is not chosen by the voters but rather by application server104. As shown inFIG. 11A, trust tokens1101-1and1101-2for the first voter and the second voter can be, for example, a random combination of a shape and a color, along with a randomly generated four-digit number. For example trust token1100-1is a white circle with the number “9228,” and trust token1100-2is a black diamond with the number “3969.”

As shown inFIG. 11B, trust tokens1101-1and1101-2can be represented on application server104by stored trust token files1108-1and1108-2, respectively. Trust tokens files1108-1and1108-2may include shape attributes1104-1and1104-2, color attributes1105-1and1105-2, random number attributes1106-1and1106-2, and signature attributes1107-1and1107-2. More broadly, trust tokens can be any information that can be unique to a voter, such as an alphanumeric code.

Before step S901, the first voter is provided the credential “3518C” with trust token1101-1, and the second voter is provided credential “7832R” with trust token1101-2. The first and second voters are provided with their respective trust tokens and credentials using a secure channel. For example, the secure channel could be an SSL or TSL session over network102between voting terminal101and application server104. Alternately, the credentials and trust tokens could be sent to voters using a physical secure channel such as by mail or in person delivery. In one embodiment, voters are provided with credentials and trust tokens when they register to vote. Regardless of what secure channel is used to provide the credentials and tokens to the voters, the voters are informed to safeguard both their trust tokens and their credentials. In the discussion below it is assumed that each voter is provided with a single credential. However, in certain embodiments voters are provided with and required to enter multiple credentials.

At step S901, credential requesting component1001requests a credential from the voter, the credential having been provided to the voter along with a token using a secure channel, as discussed below.

Step S901will usually occur once an election has actually begun, e.g. during step S301of the method shown in flowchart300. Voters access application server104through web server103. Credential requesting component1001requests the credential from each voter, for example by sending voting terminals101-1and101-2a web form that requests that the first and second voters enter their respective credentials. Voting terminals101-1and101-2send the credentials “3518C” and “7832R,” respectively, to application server104.

At step S902, token presenting component1002presents the token to the voters if the voters have supplied the credentials in response to the request, as discussed below.

For example, if the first voter at voting terminal101-1has correctly entered their previously received credential, token presenting component1002can present trust token1101-1to the first voter by sending trust token1101-1to voting terminal101-1. Web browser201on voting terminal101-1can display trust token1101-1in trust token verification window1100-1, as shown inFIG. 11A. At this point, because the voter has correctly entered their assigned credential, application server104can proceed knowing that the first voter is using voting terminal101-1, and not an attacker masquerading as a legitimate voter. Similarly, because application server104has sent the correct trust token1101-1to voting terminal101-1, the first voter knows that they are indeed communicating with application server104, and not a spoofing attacker.

Also at step S902, a similar process is performed for the second voter at voting terminal101-2. The second voter enters their credential into voting terminal101-2, and receives their trust token1101-2from token presenting component1002. Web browser201on voting terminal101-2displays trust token1101-2in trust token verification window1100-2. In this manner, application server104knows it is communicating with the true second voter, and the second voter knows they are communicating with the true application server.

As shown inFIG. 9, if application server104receives the wrong credential for any voter, the method returns to step S901and the voter is given another opportunity to enter the correct credential.

At step S903, acknowledgment data receiving component1003receives, from the voters, acknowledgement data unique to the voters, as discussed below.

The first voter at voting terminal101-1can verify trust token1101-1by entering acknowledgement data into trust token confirmation box1102-1. The acknowledgement data can be any “signature” that the first voter wishes to enter. In one embodiment, the signature is a text string, although the signature could be virtually any data including media files such as images, video, or audio. The first voter decides to enter “I LOVE MY DOG” as their signature into trust token confirmation box1102-1, and presses the enter key. Web browser201on voting terminal101-1sends the text string “I LOVE MY DOG” to acknowledgment data receiving component1003. When acknowledgment data receiving component1003receives the text string, acknowledgment data receiving component1003adds the text string to signature attribute1107-1of trust token file1108-1.

Also at step S903, a similar process is performed for the second voter at voting terminal101-2. The second voter decides to enter the string “PURPLE” for their favorite color into trust token confirmation box1102-2, and presses the enter key. Acknowledgment data receiving component1003receives the text string and adds it to signature attribute1107-2of trust token file1108-2.

If, however, any voter does not agree that the trust token is correct, the voter can click “not my trust token.” In this case, as shown inFIG. 9, the method proceeds back to step S901and the voter is given another opportunity to enter their credential.

In one embodiment, voters are informed when they receive their credentials and trust tokens that they will be prompted to enter acknowledgement data (signatures) into a web form when trying to participate in the electronic election. Thus, when the voters initially receive their credentials and trust token using the secure channel, they will know that when the time comes to vote in the electronic election, they should only enter the acknowledgement data if web browser201displays the correct trust token after they enter their credential.

At step S904, token altering component1004alters the tokens using the acknowledgement data received from the voters, as discussed below.

For example, token altering component1004may “sign” the trust tokens with the signatures by modifying the trust tokens to include the signatures. As shown inFIG. 11C, application server creates signed trust token602-1for the first voter at voting terminal101-1, and creates signed trust token602-2for the second voter at voting terminal602-2. Signed trust tokens602-1and602-2may comprise of a single image file combining the unsigned trust token with the signature, or may comprise multiple files.

At step S905, altered token presenting component1005identifies application server104to the voters by presenting the altered tokens to the voters over network102, as discussed below.

In one embodiment, altered token presenting component1005continually identifies itself to the voters by presenting the altered tokens to the voters over network102. During the course of the election, application server104may present any number of new web pages to the first voter by sending the web pages over network102to voting terminal101-1. For example, when HTML ballot600-1is sent to voting terminal101-1at step S303above, altered token presenting component1005can include signed trust token602-1in HTML ballot600-1.

If there are multiple races in the election, application terminal103can send one HTML ballot for each race, or combine several races on one ballot. In any event, each time application server104sends a new web page to voting terminal101-1, altered token presenting component1005embeds signed trust token602-1in the web page. In this manner, the first voter at voting terminal101-1can be certain that any web pages appearing in web browser201on voting terminal101-1were originally sent by application server104, and not an attacker.

Similarly, as the second voter at voting terminal101-2proceeds through the election, signed trust token602-2is displayed at each step so that the second voter is certain they are actually communicating with application server104. For example, when HTML ballot600-2is sent to voting terminal101-2, altered token presenting component1005embeds signed trust token602-2into HTML ballot600-2. Signed trust tokens602-1and602-2also appear in validation pages800-1and800-2, respectively.

Data Obfuscation

FIG. 12is an exemplary flowchart1200of a method consistent with the invention.FIG. 12illustrates a method1200for obscuring selections of voters in an electronic election. The method may be implemented, for example, using election element identification media storing component210, election identifier providing component212, election identifier receiving component213, and election identifier interpreting component214of application server104.

As shown inFIG. 13, election identifier providing component212may include election element identifier generating component1301, election element identifier assigning component1302, and election element identifier sending component1303. These components may, in conjunction with election element identification media storing component210and election identifier interpreting component214, implement method1200.

At step S1201, election element identification media storing component210stores media files representing election elements available to the voters, the election elements including a first election element and the media files including a media file representing the first election element, as discussed below.

Election element identification media storing component210stores election element identification media such as candidate A photo500A and candidate B photo500B shown inFIG. 5, as discussed above. The stored election element identification media can each correspond to an election element, such as candidate A and candidate B, respectively. Also as shown InFIG. 5, election identification media storing component210store election element identifiers for the election itself and for individual races, such as Bigtown Election 2008 image501and Bigtown Mayor Race image502.

At step S1202, election element identifier generating component1301generates a plurality of unique first election element identifiers for use by the voters to select election elements, as discussed below.

Election element identifier generating component1301can generate a number of different GUIDs. In one embodiment, the election element identifiers are GUIDs generated by a system call to a Windows™ operating system. Other embodiments may use identifiers other than GUIDs, such as UUIDs, random numbers, or any other numbers. In some embodiments the identifiers will be unique to the voters, but all that is required is that the identifier be sufficient for application server104to be able to correlate the identifier to a particular election element for a particular voter. Once election element identifier generating component1301generates the GUIDs, they can then be assigned to the voters, as discussed below.

At step S1203, election identifier assigning component1303assigns the election identifiers to the voters, as discussed below.

Election identifier assigning component1303may assign the generated GUIDs to each of the voters, to provide each voter with a unique identifier for referring to each election element. One example of this technique is discussed above with respect toFIG. 4, as reference table233may identify photos of the candidates along with other media with GUIDS unique to each voter. For example, as shown inFIG. 4, an election element BIGTOWN_ELECTION—2008 may be identified by a Bigtown_election_img file, stored in correspondence with GUID401-16585for the first voter at voting terminal101-1, and stored in correspondence with GUID401-21794for the second voter at voting terminal101-2. As another example, an election element BIGTOWN_MAYOR_RACE may be identified by a Bigtown_mayor_race_img file, stored in correspondence with GUID403-11648for the first voter, and stored in correspondence with GUID403-21794for the second voter.

At step S1204, election element identifier sending component1303sends the voters their respective assigned election element identifiers and the media file representing the first election element, as discussed below.

In one embodiment, the element identifiers (GUIDs) are sent separately from media files representing the election elements. Election element identifier sending component1303can do so by embedding the GUIDs into HTML ballots600-1and600-2as file names images referred to but not included in the HTML ballots. For example, while first HTML ballot600-1appears on voting terminal101-1as shown inFIG. 6A, the actual HTML source for first HTML ballot600-1may not include candidate A photo500A, candidate B photo500B, Bigtown Election 2008 image501, or Bigtown Mayor Race image502.

Instead, the HTML source may include references to these files that are only discernable by application server104. For example, the HTML source may include an HTML element that displays an image, such as an image tag. In such embodiments, the HTML source for first HTML ballot600-1may include <img src=“6585.jpg”/> as a reference to Bigtown Election 2008 image501. Similarly, the HTML source for HTML ballot600-1can also include <img src=“1648.jpg”/> as a reference to Bigtown_mayor_race_img502, <img src=“4572.jpg”/> as a reference to candidate A photo501A, and <img src=“7897.jpg”/> as a reference to candidate B photo501B. In similar fashion, HTML source for HTML ballot600-2may include <img src=“1794.jpg”/> as a reference to as a reference to Bigtown Election 2008 image501, <img src=“3590.jpg”/> as a reference to Bigtown_mayor_race_img502, <img src=“1024.jpg”/> as a reference to candidate A photo501A, and <img src=“5517.jpg”/> as a reference to candidate B photo501B. Each reference specifies where in HTML ballots600-1and600-2to display the identified .jpg files. Note that, because using image tags and file extensions such as .jpg may serve to help an attacker identify file types, different HTML tags may used to identify image files, along with file extensions that do not identify the file as an image. This technique can further obscure the significance of communications across network102.

At step S1205, electronic identifier receiving component213receives element identifiers from the voters, as discussed below.

Generally, voting terminals101-1and101-2will send electronic identifier receiving component213GUIDs corresponding to voter selections in order to inform application server104of the voters' choices in the election. In order to convey the correct GUID's to electronic identifier receiving component213, voting terminals101-1and101-2can simply rely on the file names that include the GUIDs.

This can be accomplished as follows. When voting terminal101-1receives HTML ballot600-1, web browser201on voting terminal101-1generates http requests to application server104for the files “6585.jpg,” 1648.jpg,” “4572.jpg,” and “7897.jpg.” Application server104can then refer to reference table233in order to determine which files are identified by the GUIDs6585,1648,4572, and7897for the first voter at voting terminal101-1for voter ID3518C. Application server104then sends the corresponding image files, i.e. Bigtown_election_img502, Bigtown_mayor_race_img_503, candidate A photo501A, and candidate B photo501B.

As shown inFIG. 6A, voting terminal101-1displays the received image files in their respective locations within HTML ballot600-1. The first voter can then select candidate A photo500A, and web browser201can send GUID4572back to application server104. In this manner, the first voter is able to identify their selection of candidate A to application server104in a secure manner. Even if an attacker has manipulated voting terminal101-1such as by storing a cascading style sheet file or a replacement image file on voting terminal101-1, the attacker cannot cause HTML ballot600-1to be displayed improperly. This is because the attacker cannot know the file name beforehand, as the filename includes the generated GUID. Thus, as long as the first voter selects the correct image file for their chosen candidate, the first voter also selects the correct GUID.

Further, using this technique, even an attacker who defeats the SSL or TSL encryption over network102cannot discern the meaning of the GUIDs transmitted across the network without having some entity determine the meaning of candidate photo A. In most instances it will be difficult or at least time-consuming for a computer to perform the requisite processing to determine that candidate A photo corresponds to candidate A500S, even if candidate A photo500A includes identifying text. In some embodiments, media files such as candidate A photo501A are rotated with different images representing the same concept, such as other photos of candidate A, or by making minor alterations to the file each time it is sent over network102, such as by watermarking the file each time with a different watermark. In this manner, even if a human being determines that a particular file corresponds to candidate A, the file actually used for each voter to represent candidate A is different. This prevents an attacker from simply having a human identify candidate A photo500A and candidate B photo500B when sent to the first voter, and then identifying the files by calculating a hash of the files and using the hash to identify other instances of these files on network102.

When voting terminals101-1and101-2send back their respective GUIDs, electronic identifier receiving component213receives the GUIDs for subsequent interpretation by election identifier interpreting component214.

At step S1206, election identifier interpreting component214determines that the voters have selected election elements if the received element identifiers match the assigned element identifiers sent to the voters, as discussed below.

Election identifier interpreting component214interpret GUID401-A1received from the first voter at voting terminal101-1as a vote for candidate A, and GUID401-B2received from the voter at voting terminal101-2as a vote for candidate B. Election identifier interpreting component214does so by referring to reference table233.

Obfuscation of Other Election Elements

In some embodiments, identifiers such as GUIDs are used to refer to election elements other than candidates, or indeed other than election choices. For example, each time a voter enters credentials, a new session ID can be created by application server104. Internally, application server104will use the same session ID, for example by storing the session ID in reference table233. However, application server104can use the technique discussed above so that the voting terminal will be reference a different session ID in each communication, e.g. the assigned GUID or other identifier. In this manner, an attacker cannot even discern that the same voter's session is being used in each communication between the voting terminal and application server104.

In some embodiments, a voter session is in place before method300begins. For example, an initial session GUID may be generated before the first voter supplies credentials at step S301of method300. Application server104may use this initial session GUID to refer to the voter session for the first voter throughout method300. In some embodiments, as method300proceeds, the initial session GUID is replaced, and successive GUIDs are generated by application server104. Application server104and voting terminal101-1may refer to the first voter's session using the current GUID.

It is also possible to use identifiers such as GUIDs to represent, for example, text files. In some embodiments, text files can be used to represent candidates, e.g. by including the candidate's name in the text file. Such text files could be used in place of the media files in reference table233. By assigning different GUIDs for the first voter and the second voter, different GUIDs can be used by the voters to use to refer to the same text file.

In some embodiments, each communication from central election site108to voting terminals101-1and101-2is obscured in this manner, e.g. by treating each file sent over network102as an election element, assigning a GUID to the file before sending the file over network102, and referring to the file by the GUID. For example, JavaScript files and cascading style sheet (CSS) files can be referred to by GUID rather than by a conventional file name.

Assigning GUIDs to HTML elements

In the embodiment disclosed above, the GUID used for the filenames of candidate A photo501A and candidate B photo501B was also used by voting terminals101-1and101-2to cast a vote. Thus, for example, selecting choice response element601-1A caused voting terminal101-1to send the GUID for candidate A photo501A back to application server104.

However, it is possible to assign different GUIDs to media files and input elements such as choice response element601-1A, and to name the input elements in the HTML code with the corresponding GUID. In such embodiments, the GUID for choice response element601-1A, rather than the GUID for candidate A photo500A, would be returned to application server104if the first voter chose candidate A.

Note that this introduces an additional layer of security. It is relatively obvious to a human viewer that, because of the disposition of choice response element601-1A underneath candidate A photo500A, this checkbox is used to vote for candidate A. However, it is not so obvious that this is the case to a computer that is not preprogrammed to understand the HTML ballot format.

Using this technique, an attacking computer that compromised the security of the SSL session on network102would see two related GUIDs sent on network102to voting terminal101-1, e.g. the GUID for candidate A photo500A and the GUID for checkbox601-1A. When the first voter selects candidate A, only the GUID for checkbox601-1A will be sent over network102back to application server104. Therefore, because the attacking computer cannot comprehend the relationship between choice response element601-1A and photo500A, the attacking computer will not be able to tell that the GUID for choice response element601-1A sent back to the application server is also related to candidate A photo500A.

Note that this technique can be of particular benefit if text is used to represent a candidate, rather than or in addition to a media file such as photo500A. An attacking computer would need to do some facial or voice recognition or other complex technique to discern the meaning of a media file, but can simply read text. Therefore, if application server104represents candidate A with text written as “Candidate A,” it could be relatively easy for an attacker to understand that a corresponding GUID sent back to application server104would indicate a vote for candidate A. However, by using a GUID for a corresponding web page element such as choice response element601-1A rather than an identifier associated with the text, it is much more difficult for an attacking computer to appreciate the significance of the communications on network102.

Image Input Elements in an HTML Page

A refinement of the above approach is to use multiple images in place of an HTML input. For example, rather than an HTML checkbox, two images can be used for each checkbox—a picture of an unchecked box, and a picture of a checked box. Each image can have its own assigned GUID or other identifier, e.g. a GUID for an unchecked image of choice response element601-1A and a GUID for a checked image of choice response element601-1A. As in the other disclosed embodiments, application server104will store these GUIDs in reference table233.

When HTML ballot600-1is first displayed, unchecked images of a vote box will be displayed for vote boxes601-1A and601-1B. When the first voter selects the image for choice response element601-1A, a scripting language such as Javascript can be used to replace the unchecked image with the checked image of choice response element601-1A. In this embodiment, two GUIDs would be used to represent choice response element601-1A, and two GUIDs would be used to represent vote box601-1B. The GUID for the checked image of choice response element601-1A would be sent back to application server104. In some embodiments, the GUID for the unchecked box of image601-1B will also be sent back to application server104.

When application server104receives these GUIDs, application server104can simply read reference table233to determine which GUID represents a checked vote box. In this case, application server104will be able to interpret the GUID for the image of checked choice response element601-1A as a vote for candidate A. In this embodiment, an attacking computer would not only need to discern that checkbox601-1A corresponds to candidate A image500A, but would also need to appreciate the significance of the GUID for the checked image being used rather than the GUID for the unchecked image.

In certain embodiments, election identifier interpreting component214may delete or otherwise invalidate GUIDs after a certain period of time elapses. Election identifier interpreting component214may also invalidate GUIDs each time a new web page is sent to a voting terminal. For example, if application server104sends a new web page to voting terminal101-1, election identifier interpreting component214may invalidate any GUIDs assigned to the first voter at election identifier interpreting component214.

In such embodiments, a new GUID can be generated at each time interval or for each new web page, and the new GUID can replace the existing GUID in table233. Thus, each time a voter is presented with a web page for referring to a particular election element, the voter will be assigned a different GUID. For example, 4572 was assigned to the first voter when they were presented with HTML ballot600-1, and 4572 was used as the file name for candidate A photo501A. A new GUID, e.g. 2845, may be generated and replace 4572 in reference table233each time a web page is sent to voting terminal101-2. Thus, for example, even though validation page800-1may include candidate A photo501A, this time the file name will include the new GUID, e.g. “2845.”

As a general proposition, by shortening the time each GUID is valid, the security of system100can be improved. For example, if GUID 4572 were used to refer to candidate A photo501A in both HTML ballot600-1and validation page800-1, it would at least be possible for an attacker to know that the same image is being referenced in the two communications. By changing the GUID used to refer to candidate A photo501, it is more difficult for an attacker to discern that the same file is being transmitted over network102in both files.

Additional refinements are possible. For example, an attacker might be able to compute a hash value for candidate A photo501A each time the photo is sent over network102. Even if the file name (e.g., GUID) used to reference the photo changes, the hacker may be able to tell that the same file has been sent over the network twice simply by determining that both photos hash to the same value.

Therefore, in some embodiments application server104will add entropy to files each time they are sent over network102. In the case of a media file, the entropy can be added by altering virtually any characteristic of a media file, such as by adding a different watermark each time, or altering part of the file that does not affect viewing or playback of the file. In this manner, the media file will be recognizable to a human viewer at a voting terminal as the same picture even though the file itself has somewhat different data. This prevents an attacking computer from being able to tell that the two media files represent the same election element, while the human user at the voting terminal is easily able to understand the media file.

Entropy can also be added to data files. For example, if a file contains the words “Candidate A” to represent candidate A, characteristics can be altered to vary the file size without visually altering the representation. If characteristics are edited for the “Candidate A” file each time the file is sent over network102, the file will result in different hash computations and thus will not appear to be identical from the perspective of an attacking computer. A human user will be unaware of the altered characteristics and read the text “Candidate A.” In embodiments where text is used to represent a candidate or other election element, whitespace characters can be added to the text to alter the file size.

Stateless Application Server

By using the techniques discussed above, e.g. continually generating new GUIDs to refer to each election element, it is possible to reduce the amount of time a given GUID has any meaning to application server104. In some embodiments, each time application server104generates a new GUID for an election element, the GUIDs are stored only on database server105.

Because application server104is not required to maintain any persistent data about the correspondence of GUIDs to election elements, it is possible to make application server104“stateless.” In other words, each time application server104conducts a step in the disclosed methods, the processing of application server104is independent of any state information stored on application104. This can be beneficial if the various components of application server104need to pass some technical auditing to ensure they comply with security requirements in various jurisdictions.

Conclusion

Each of the components discussed above comprising the various servers in central election site108, as well as voting terminals101-1and101-2, may be implemented as hardware, software, or a combination thereof. In some embodiments, the various components are software code stored on computer-readable media used to provide computer-readable instructions for performing methods consistent with the invention. The various servers and voting terminals may comprise processors that execute the computer-readable instructions. In other embodiments, FPGA's, ASICs, or other programmable logic devices can be used to implement the components. For example, an FPGA or ASIC can be beneficially used by application server104to perform computationally intensive operations such as the encryption, decryption, and hashing functions described above.

Embodiments consistent with the invention can also be implemented in a variety of different architectures. The disclosed embodiments discuss various processes as being implemented on the architecture ofFIG. 1. However, those skilled in the art will understand that embodiments of the invention are susceptible to implementation on virtually any networked computer architecture. Further, embodiments may be devised that combine the functionality of the various computers in a manner different from that in the disclosed architecture. Functionality for any one of the disclosed computers can be distributed across several different computers, such as by implementing one or more of the various components of application server104on separate computers. Functionality disclosed herein as occurring on separate computers can be combined to occur on a single computer, such as by combining database server105and/or web server103into application server104.

Thus, the processes disclosed herein are not inherently related to any particular computer, network, architecture, environment, or other apparatus, and may be implemented by a suitable combination of hardware, software, and/or firmware. Various general-purpose machines may be used with programs written in accordance with teachings of the invention, or it may be more convenient to construct a specialized apparatus or system to perform the required methods and techniques.

The systems and methods disclosed herein may be implemented as a computer program product, that is, a computer program tangibly embodied in an information carrier. Such an information carrier may be embodied in a machine-readable storage device, for execution by, or to control the operation of, data processing apparatus, e.g., a programmable processor, a computer, or multiple computers. A computer program can be written in any appropriate form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program can be deployed to be executed on one computer or on multiple computers at one site or distributed across multiple sites and interconnected by a communication network.