Method for secure on-line voting

A voting application on a computing device of a voter sends a challenge including data identifying and verifying the voter, the challenge is validated to ensure that the identified voter allowed to vote, and a response is sent with a vote identification value identifying the voter as being activated. A ballot is then sent to the voting application and presented thereby to the voter based on which voting information is gathered from the voter. The voting application then sends a vote package with the vote identification value and the gathered voting information, and the vote package is validated to ensure that the vote identification value matches the vote identification value matches. The voting information from the vote package is then tallied.

TECHNICAL FIELD

The present invention relates to a method by which secure on-line voting may be accomplished. More particularly, the present invention relates to such a method whereby such on-line voting is closely controlled by a vote counting authority to prevent fraud and abuse even though such voting takes place on a computing device and with a voting application that is not in the physical control of the vote counting authority.

BACKGROUND OF THE INVENTION

Voting, and especially voting for a political election or the like, should be monitored and closely controlled to prevent fraud and abuse. Accordingly, and in the prior art, voting for such a political election in particular is held at specified polling places, based on certified voter rolls, with specialized vote counting machinery, and with polling judges, workers, and the like in attendance, among other things. With such monitoring and close control, then, a particular voter should only be allowed to vote once, and in the name of such particular voter and no one else. In addition, with such monitoring and close control, the selections made by the particular voter should be honored and not altered in any manner, especially by any nefarious entity that might wish to influence the election in an inappropriate manner.

With the advent of personal computing, interconnected data networks such as the Internet, and the wide use of personal computing devices to perform tasks, it would seem that a voter voting in an election or the like should be able to do so by way of a computing device coupled by way of a network to a vote gathering service maintained by a vote counting authority. As should no doubt be appreciated, voting by way of a computing device would free the voter from the need to actually visit a specific polling place, and would also free the voter from any un-pleasantries associated therewith, including taking time off from other activities, traveling to the polling place, possibly waiting at the polling place for others to vote, and being required to employ possibly unfamiliar vote counting machinery, among other things. Moreover, voting by way of a computing device would allow the voter to vote from wherever the voter may be located, be it work, home, at a library, or elsewhere, presuming of course the voter at the location was properly provisioned with appropriate hardware, software, and communications access.

However, it is to be appreciated that a vote counting authority is likely highly hesitant to allow a voter to vote from a place other than a polling location, especially inasmuch as such voting would take place on a computing device and with a voting application that is not in the physical control of the vote counting authority. Put simply, such vote counting authority is likely rightfully concerned that allowing a voter to vote from a place other than a polling location is an invitation to fraud and abuse, especially by the aforementioned nefarious entity that might wish to influence the election in an inappropriate manner.

Accordingly, a need exists for a method for implementing secure and trustworthy voting from a place other than a polling location. In particular, a need exists for a method for implementing such voting by way of a computing device appropriately coupled to a vote gathering service and appropriately provisioned with a voting application. Further, a need exists for a method for implementing such voting that is not prone to fraud or abuse.

SUMMARY OF THE INVENTION

The aforementioned needs are satisfied at least in part by the present invention in which a method and architecture are provided to collect a vote from a voter at a computing device. In the method, the voting application on the computing device of the voter sends a challenge including collected challenge data identifying the voter and verifying the identity of the voter at the voting application, and the challenge and challenge data therein are verified and validated at least in part to ensure that the identified voter in the challenge data in fact provided the challenge data, and is in fact allowed to vote. Thereafter, a response is sent to the voting application including a vote identification value identifying the voter as being activated, and the vote identification value and an identification of the voter are stored in a database.

A ballot including at least one contest for the voter to vote on is sent to the voting application, and the voting application presents the ballot to the voter and gathers voting information from the voter based thereon. The voting application then sends a vote package with the vote identification value and the gathered voting information, and the vote package and vote identification value therein are verified and validated at least in part to ensure that the vote identification value matches the vote identification value from the database. The vote identification value from the vote package is noted in the database as having been employed, and the voting information from the vote package is tallied.

DETAILED DESCRIPTION OF THE INVENTION

Computer Environment

FIG. 1and the following discussion are intended to provide a brief general description of a suitable computing environment in which the present invention and/or portions thereof may be implemented. Although not required, the invention is described in the general context of computer-executable instructions, such as program modules, being executed by a computer, such as a client workstation or a server. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types. Moreover, it should be appreciated that the invention and/or portions thereof may be practiced with other computer system configurations, including hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

As shown inFIG. 1, an exemplary general purpose computing system includes a conventional personal computer120or the like, including a processing unit121, a system memory122, and a system bus123that couples various system components including the system memory to the processing unit121. The system bus123may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. The system memory includes read-only memory (ROM)124and random access memory (RAM)125. A basic input/output system126(BIOS), containing the basic routines that help to transfer information between elements within the personal computer120, such as during start-up, is stored in ROM124.

The personal computer120may further include a hard disk drive127for reading from and writing to a hard disk (not shown), a magnetic disk drive128for reading from or writing to a removable magnetic disk129, and an optical disk drive130for reading from or writing to a removable optical disk131such as a CD-ROM or other optical media. The hard disk drive127, magnetic disk drive128, and optical disk drive130are connected to the system bus123by a hard disk drive interface132, a magnetic disk drive interface133, and an optical drive interface134, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, program modules and other data for the personal computer120.

Although the exemplary environment described herein employs a hard disk, a removable magnetic disk129, and a removable optical disk131, it should be appreciated that other types of computer readable media which can store data that is accessible by a computer may also be used in the exemplary operating environment. Such other types of media include a magnetic cassette, a flash memory card, a digital video disk, a Bernoulli cartridge, a random access memory (RAM), a read-only memory (ROM), and the like.

A number of program modules may be stored on the hard disk, magnetic disk129, optical disk131, ROM124or RAM125, including an operating system135, one or more application programs136, other program modules137and program data138. A user may enter commands and information into the personal computer120through input devices such as a keyboard140and pointing device142. Other input devices (not shown) may include a microphone, joystick, game pad, satellite disk, scanner, or the like. These and other input devices are often connected to the processing unit121through a serial port interface146that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port, or universal serial bus (USB). A monitor147or other type of display device is also connected to the system bus123via an interface, such as a video adapter148. In addition to the monitor147, a personal computer typically includes other peripheral output devices (not shown), such as speakers and printers. The exemplary system ofFIG. 1also includes a host adapter155, a Small Computer System Interface (SCSI) bus156, and an external storage device162connected to the SCSI bus156.

The personal computer120may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer149. The remote computer149may be another personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the personal computer120, although only a memory storage device150has been illustrated inFIG. 1. The logical connections depicted inFIG. 1include a local area network (LAN)151and a wide area network (WAN)152. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet.

When used in a LAN networking environment, the personal computer120is connected to the LAN151through a network interface or adapter153. When used in a WAN networking environment, the personal computer120typically includes a modem154or other means for establishing communications over the wide area network152, such as the Internet. The modem154, which may be internal or external, is connected to the system bus123via the serial port interface146. In a networked environment, program modules depicted relative to the personal computer120, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

Secure On-Line Voting

For on-line voting or any other voting to be secure and trustworthy, and in general, the voting process should at a minimum fulfill the requirements that: (1) only authorized voters can vote; (2) no voter can vote more than once in a contest; (3) no one can determine for whom any particular voter voted; (4) no voter can duplicate the vote of any other voter; (5) no one can change the vote of any voter without being discovered; and (6) every voter can make sure that the vote thereof has been tallied.

In the present invention, and turning now toFIG. 2, a voter creates a vote at a computing device10with a voting application12thereon. The computing device10is communicatively coupled to a vote gathering service14by way of an appropriate network connection16, and the vote from the voter is securely transmitted to the vote gathering service14by way of the network connection16in a trustworthy manner. The vote gathering service14records the transmitted vote from the voter at the computing device10, and ensures that the voter is in fact entitled to transmit the vote and also that the voter transmits the vote only once.

The vote as created by the voter may be with regard to an election, contest, or other determination, such as for example a municipal election, a union election, a ballot question, a membership board election, a popularity contest, and the like. Although not especially crucial to the present invention, such vote may comprise a single choice representing a single contested issue, or may comprise multiple choices representing multiple contested issues.

The computing device10employed by the voter may be any appropriate computing device without departing from the spirit and scope of the present invention. For example, the computing device may be a personal computer, a portable communications device, a wireless communications device, etc. Likewise, the network connection16coupling the computing device10and the vote gathering service14may be any appropriate network connection without departing from the spirit and scope of the present invention. Such connection16may for example be a direct connection or may be a network connection such as an intra- or inter-network connection employing appropriate communications protocols.

The vote gathering service14is typically an application running on a server, computer, or other computing device at a location remote from or local to the computing device10, although such service14may instead be any other type of appropriate service without departing from the spirit and scope of the present invention. Such service14receives and verifies the transmitted vote from the voter at the computing device10in a manner that will be set forth in detail below. Such service14may also compile and tabulate transmitted votes from other voters to determine a winner of one or more contests or elections to which each vote relates, or may certify the votes and deliver same to another service which performs such compiling and tabulating. Presumably, such service14and related services are run by or on behalf of a vote counting authority which is responsible for overseeing the election or contest to which each vote relates.

The voting application12on the computing device10and employed by the voter may be any appropriate voting application without departing from the spirit and scope of the present invention. For example, the voting application12may be an executable, may be a library of functions to be executed by a virtual machine, may be a plug-in to another application, or may be executable code delivered to the voter at the computing device10as part of a page of information or the like. In addition, the voting application12may contain therewith information specific to a particular contest, or may allow information specific to a particular contest to be provided to the voter by way of downloading same from the vote gathering service14or the like by way of the network connection16. Moreover, such voting application12may be produced and delivered by or on behalf of the vote counting authority, may be part of an operating system running on the computing device10, may be developed by a third party, or the like. The voting application12may be delivered by any appropriate conveyance such as for example by download, by electronic mail, by regular mail, by pick-up from a distribution site, or the like.

In one embodiment of the present invention, and as seen inFIG. 2, the voting application12is run on the computing device10of the voter within the context of a secure computing environment18operating on the computing device12, where the secure computing environment18is to be trusted by the vote counting authority by way of the vote gathering service14. Thus, the secure computing environment18should be able to demonstrate such trust to the vote gathering service14, such as for example by way of being able to proffer a key, digital signature, digital certificate, or the like. Typically, such a digital certificate includes a chain of certificates leading back to a root trust authority, and the vote gathering service14accepts the digital certificate and grants trust based thereon if the vote gathering service14recognizes and honors the root trust authority of such certificate.

As may be appreciated, the secure computing environment18operating on the computing device10of the voter should be free of control by other entities operating on the computing device10thereof or of control by other entities, either from other computing devices or of human form. Thus, the secure computing environment18should not be able to be forced to transmit a vote when such vote is not warranted, such as for example may be the case should a nefarious entity wish to transmit a vote without approval of the voter. Likewise, the secure computing environment18should not be able to be forced to alter a vote from a voter, such as for example the nefarious entity may wish to do.

Such secure computing environment18may be any appropriate secure computing environment without departing from the spirit and scope of the present invention, subject of course to the constraints set forth herein. For example, the secure computing environment18may be a trusted portion of an operating system on the computing device10, where the trusted portion of such operating system is free of undue external influence. The secure computing environment18may either itself perform secure actions, or may establish trust in a secure application running thereon to perform secure actions. In one embodiment of the present invention, the secure computing environment18in fact includes an attestation unit20as an application running thereon and/or hardware running therein to perform secure actions and/or attest to the security thereof.

The attestation unit20may be any appropriate hardware and/or software without departing from the spirit and scope of the present invention. For example, the attestation unit20may be established as trusted software running in a trusted area of the secure computing environment18, or may be a piece of hardware on the computing device10that is designed to perform attestation functions. In either case, such attestation unit20is protected from being monitored or influenced by any other software or hardware operating on the computing device, and especially is protected against attacks such as may be employed by a nefarious entity that would attempt to subvert the function of the attestation unit20. The attestation unit20, then, should be designed to be tamper proof, and should be capable of digitally signing, verifying a signature, encrypting, decrypting, and the like. Such an attestation unit20at a minimum should be apparent to the relevant public and therefore need not be set forth herein in any detail.

Note that the secure computing environment18and/or attestation unit20thereof likely must accept inputs that derive from hardware22on the computing device12that a voter would employ in the course of creating a vote in conjunction with the voting application12. For example, such hardware22may include a touch screen, a keyboard, a cursor control device such as a mouse, and the like. In addition, the secure computing environment18/attestation unit20may refer to other resources24of the computing device12such as a clock, memory, a controller, and the like. Each such piece of hardware22and each such resource24, then, may become an avenue by which a nefarious entity might attempt to improperly subvert proper creation of a vote by a voter. Accordingly, each such piece of hardware22and each such resource24may be constructed to be trusted by the attestation unit20, and also to be able to demonstrate such trust to the attestation unit20, such as for example by way of being able to proffer a key, digital signature, digital certificate, or the like. Again, such a digital certificate typically includes a chain of certificates leading back to a root trust authority, and the secure computing environment18accepts the digital certificate and grants trust based thereon if such attestation unit20recognizes and honors the root trust authority of such certificate.

Note that by running the voting application12within the context of the secure computing environment18, and presuming that the secure computing environment18provides a trusted path between the voter and the vote gathering service14, there is an implicit guarantee that the vote as received by the vote gathering service14is indeed from the voter at the computing device10, and not some nefarious entity wishing to do no good. Moreover, the voting options presented to the voter by way of the voting application12are trusted and the vote as created by the voter is likewise trusted. In addition, since the secure computing environment18presumably provides strong process isolation, there is also an implicit guarantee that no other rogue application is modifying or changing the vote as was created by the voter. Finally, since the secure computing environment18presumably includes the attestation unit20, the vote gathering service14can be provided with an attestation that the voting application12is indeed to be trusted.

The vote itself as created by the voter with the voting application12may take any appropriate form without departing from the spirit and scope of the present invention. For example, the vote may be constructed as a digital document based on some form of extensible Markup Language (XML) and may be digitally signed based on a private key and verifiable according to a corresponding public key available from the aforementioned digital certificate of the secure computing environment18, a digital certificate of the attestation unit20, or another digital certificate. Thus, such created vote may include such digital certificate. In addition, such created vote may be protected according to a secret shared with the vote gathering service14or the like, such as for example a symmetric or asymmetric key.

With the architecture as shown inFIG. 2, the voter may during a predetermined voting period employ the voting application12on the computing device10to create a vote and transmit same to the vote gathering service14. Such vote gathering service14may in addition to receiving such transmitted vote also receive an attestation as provided by the attestation unit20of the computing device10, where such attestation describes the voting application12and also describes the voter by way of one or more identifying indicia thereof.

In one embodiment of the present invention, the process of implementing on-line voting by way of an architecture such as that shown inFIG. 2may be divided into three main parts: distribution of the voting application12, activation of the voting application12, and voting with the voting application12. Each is disclosed in turn, below.

In one embodiment of the present invention, to distribute the voting application12, and turning now toFIG. 3, the vote gathering service14or another service first gathers a voter list of all legitimate voters (step301), and then publishes the voter list (step303) so that all voters thereon are given notice to obtain the voting application12from an appropriate source (step305). Upon in fact obtaining the voting application12, each voter is expected to install and activate such voting application12on an appropriate computing device10thereof with a secure computing environment18and attestation unit20, as will be set forth in more detail below. Note that the voter list may be gathered as at step301in any appropriate manner without departing from the spirit and scope of the present invention. For example, for a public election, the voter list may be a certified voter list as compiled and maintained by an election board, while for a private contest the voter list may be a previously compiled list of contest entrants. Publishing the voter list as at step303may likewise be performed in any appropriate manner without departing from the spirit and scope of the present invention, such as for example by posting a hard copy of the voter list at one or more physical locations and/or posting a soft copy of the voter list on a network-accessible location.

The source from which the voting application12may be obtained by each voter on the voter list as at step305may again be any appropriate source without departing from the spirit and scope of the present invention. For example, such source may for example be an on-line source, a physical location from which media with the voting application12may be collected, or the like. Alternatively, the voting application12may be delivered to each voter on the voter list by way of regular mail, electronic mail, or the like. In at least some circumstances, the voter application12should only be distributed to each voter if on the voter list, and/or only after the voter has confirmed the identity thereof. Such identity confirmation may be achieved by way of submission of an ID card from an appropriate issuing entity, in which case such confirmation may be physically performed, or by submission of a digital certificate or the like, again from an appropriate issuing entity, in which case such confirmation may be performed by way of the network connection16or the like.

After a period of time during which each voter on the voter list has had an opportunity to collect the voting application12as at step305, and of course prior to the contest corresponding to the voting application12, the vote gathering service14ceases distributing such voting application12(step307) and then publishes a participation list (step309). Such period of time may be any appropriate duration, such as for example a period of days or weeks or even a month or two. Similar to publishing the voter list as at step303, publishing the participation list as at step309may be performed in any appropriate manner without departing from the spirit and scope of the present invention, such as for example by posting a hard copy of such list at one or more physical locations and/or posting a soft copy of such list on a network-accessible location. The participation list typically is based on each voter that has obtained the voting application12. As may be appreciated, publishing the participation list as at step309confirms each voter that has obtained a copy of the voting application12, and also acts to inspire confidence by all voters and others in the vote gathering process.

In one embodiment of the present invention, and at a designated period of time either before or after the participation list has been published as at step309but before the period of time set for voting in the contest, each voter with an obtained copy of the voting application12must install and activate such obtained voting application12. Presumably, the voting application12includes an appropriate installer or the like to install same on the computing device10of a voter. At a minimum, such voting application12and the installer thereof should allow the installation to take place only if the computing device10includes the secure computing environment18and attestation unit20ofFIG. 2, and can satisfy other appropriate minimum security and/or trustworthiness concerns. If for some reason the voting application12cannot be installed on any computing device10of the voter, the voter must vote in person at a physical voting location or else cannot vote in the contest.

Turning now toFIG. 4, to install and activate the voting application12on a computing device10of a voter, such voter loads the voting application12onto the computing device10and executes same (step401). As may be appreciated, in executing the voting application12, the installer thereof may load one or more files or other objects onto the computing device10, and may also perform some preliminary security and/or trustworthiness checks, such as for example to ensure that the computing device10in fact includes the secure computing environment18and attestation unit20ofFIG. 2. As was set forth above, the voting application12should allow itself to be executed only in such secure computing environment18so that the operation thereof cannot be observed by any nefarious entity.

Presuming that such preliminary checks are in fact satisfied, and in one embodiment of the present invention, the voting application12establishes communication by way of the network connection16with an activation service26which may be provided by the vote gathering service14or may be associated therewith (step403). Presumably, the activation service26can verify the identity of the communicating voting application12, perhaps by way of the attestation unit20of the computing device12. Of course, if not verified, the activation service26does not allow the voting application12to activate on the computing device10. However, presuming that the voting application12does indeed verify, the activation service26and the voting application12establish a secure channel therebetween (step405), such as for example by way of establishing a shared symmetric key by which messages may be encrypted and decrypted.

Thereafter, the activation service26requests a challenge from the voting application12by way of the secure channel (step407), where the challenge includes data to identify the voter and verify the identity of the voter at the voting application12. Such challenge data may be any appropriate identifying information without departing from the spirit and scope of the present invention, and typically includes a name or number associated with the voter, and perhaps some information that only the identified voter would know, or else some sort of biometric or forensic data that has been positively established as being that of the identified voter. At any rate, the voting application12presents the request for the challenge to what presumably is the voter at the computing device10(step409), typically in the form of a user interface that the voter is to fill in with the appropriate challenge data by way of appropriate input hardware22on the computing device10, and then gathers at least a portion of the challenge data from the voter thereby (step411). In addition, the voting application12may gather additional challenge data from the voter such as the aforementioned biometric or forensic data by way of other hardware22on the computing device10. In any case, the hardware22employed should be trusted to faithfully transmit data to the voting application12by way of a trusted path not influenced by any nefarious entity, where such trust may be established by way of the attestation unit20of the computing device10.

Upon collecting the challenge data and appropriately organizing same into a form amenable to the activation service26, the voting application12then sends the requested challenge including the collected challenge data to such activation service26by way of the secure channel established therebetween as at step405(step413). On receiving the challenge, then, the activation service26appropriately verifies and validates same (step415). Such verification and validation may be performed in any appropriate manner without departing from the spirit and scope of the present invention. For example, presuming the challenge includes a digital signature from the voting application12or elsewhere and attestation information as provided by the attestation unit20of the computing device, such verifying may include ensuring that the digital signature verifies and that the attestation information is acceptable. Also for example, such validating may include comparing the challenge data from the voter with previously established data for the identified voter to ensure that the identified voter in fact provided the challenge data, and is in fact allowed to vote.

Presuming the challenge verifies and validates, then, the activation service26sends a response to the voting application12by way of the secure channel established therebetween as at step405(step417), where the response includes a vote identification value. As may be appreciated, such vote identification value is a random or non-random value that is to be employed by the voting application12when the voter votes therewith to identify the voter as being activated, as will be set forth below. Such vote identification may for example be a randomly generated large (128-bit, e.g.) value.

Of course, the activation service26and the voting application12should each store the vote identification value and an identification of the voter in respective appropriate databases for later retrieval (steps419,421). Note that along with the vote identification value and the identification of the voter, the activation service26may also store the challenge data from the challenge. Note, too, that inasmuch as voting should be anonymous, the activation service26in particular should be careful to ensure that a vote once created and cast is not tied back to a particular voter by way of the vote identification. Note, further, that the database employed by the voting application12on the computing device12to store the vote identification value and the identification of the voter should be a secure database that can only be accessed by the voter at the voting application12and no others.

As should now be appreciated, with such vote identification, the identified voter is now successfully activated to vote with the voting application12in connection with a particular contest. As should also be appreciated, receiving the vote identification acts to notifying the voting application12and the voter thereat that the activation thereof was successful.

After a period of time during which each voter on the participation list has had an opportunity to activate as set forth above, and of course prior to the contest corresponding to the voting application12, the activation service26ceases activating voters (step423) and may then publish an activation list (step425). Such period of time may as before be any appropriate duration, such as for example a period of days or weeks or even a month or two. Similar to before, publishing the activation list as at step425may be performed in any appropriate manner without departing from the spirit and scope of the present invention, such as for example by posting a hard copy of such list at one or more physical locations and/or posting a soft copy of such list on a network-accessible location. The activation list as should be appreciated is based on each voter that has activated in connection with a particular contest, and confirms each voter that has activated to vote by way of the architecture ofFIG. 2, and also acts to inspire confidence by all voters and others in the vote gathering process.

In addition, after the activation service26ceases activating voters as at step423, such activation service26sends a list of all valid vote identification values to the vote gathering service14(step427) which as seen below will be used by such vote gathering service during a particular contest in connection with actual vote gathering. Presumably, such activation service26sends the list of all valid vote identification values to the vote gathering service14by way of a secure channel so as to avoid revealing such list to any nefarious entity that may attempt to view same. As may be appreciated, the sent list of all valid vote identification values does not include the corresponding identifications of the voters. Thus, the vote gathering service14cannot itself tie a particular vote back to a particular voter by way of such vote identification.

Presumably, actual voting for the particular contest is to take place over a particular period of time such as for example a period of hours or days or even weeks or months. At any rate, and turning now toFIG. 5, to vote during the actual voting for the particular contest, the voter again executes the voting application12on the computing device10(step501), and the voting application12again establishes communication by way of the network connection16, although now with the vote gathering service14(step503). Again presumably, the vote gathering service14can verify the identity of the communicating voting application12, perhaps by way of the attestation unit20of the computing device12. Of course, if not verified, the vote gathering service14does not allow the voting application12to proceed. However, presuming that the voting application12does indeed verify, the vote gathering service14and the voting application12establish a secure channel therebetween (step505), such as for example by way of establishing a shared symmetric key by which messages may be encrypted and decrypted.

In the case where the vote identification value and the identification of the voter are stored in a secure database that can only be accessed by the voter at the voting application12and no others, the voter application12can presume that, having been executed by the voter, such voting application12may merely retrieve such vote identification value and the identification of the voter from the database (step506). Alternatively, the voting application12may interrogate the voter for appropriate information to verify the voter in connection with such retrieval. For example, the voting application12may confirm that the voter can provide the identification thereof as set forth in the database.

At any rate, the voting application12receives a ballot from the vote gathering service14by way of the secure channel established therebetween (step507), presents the ballot to the voter at the computing device10(step509), typically in the form of a user interface that the voter is to fill in with appropriate voting information by way of appropriate input hardware22on the computing device10, and then gathers the voting information from the voter thereby (step511). As before, the hardware22employed should be trusted to faithfully transmit the voting information from the voter to the voting application12by way of a trusted path not influenced by any nefarious entity, where such trust may be established by way of the attestation unit20of the computing device10.

Upon collecting the voting information from the voter and appropriately organizing same into a form amenable to the vote gathering service14, the voting application12then sends a vote package with the vote identification value as retrieved from the database together with such voting information to the vote gathering service14by way of the secure channel established therebetween as at step505(step513). On receiving the vote package, then, the vote activation service26appropriately verifies and validates same (step515). Such verification and validation may be performed in any appropriate manner without departing from the spirit and scope of the present invention. For example, presuming the vote package includes a digital signature from the voting application12or elsewhere and attestation information as provided by the attestation unit20of the computing device, such verifying may include ensuring that the digital signature verifies and that the attestation information is acceptable. Also for example, such validating may include comparing the vote identification value from the vote package with the list of all valid vote identification values as provided by the activation service26to the vote gathering service14at step427, above, to ensure that the vote package is from an activated voter.

Presuming the vote package verifies and validates, then, the vote gathering service14sends an appropriate acknowledgment to the voting application12by way of the secure channel established therebetween as at step505(step517). In addition, the vote gathering service14notes with regard to the list of all valid vote identification values that the vote identification value from the vote package has been employed and also that such vote identification value from the vote package has not been previously employed by another vote package (step519), and then appropriately tallies the voting information from the vote package (step521). Note that if it is found that the vote identification value from the vote package has in fact been previously employed by another vote package, the vote gathering service may either choose to ignore the voting information in the vote package and not tally same, or may choose to tally such voting information and in so doing overwrite the tallied voting information from the prior vote package, presuming of course such an option is available.

After the period of time during which each voter on the activation list has had an opportunity to vote as set forth above, the vote gathering service14ceases accepting vote packages (step523) and may then publish a hard copy and/or soft copy of a vote list (step525) detailing activated voters that voted. Note here, though, that such a vote list may not at all times be desired, although such a vote list may be employed to confirm that each activated voter did in fact vote by way of the architecture ofFIG. 2, and also acts to inspire confidence by all voters and others in the vote gathering process. If in fact a vote list is published, such vote list should not detail specific votes.

In addition, after the vote gathering service14ceases accepting vote packages as at step523, such activation service26may send a final tally to an organizing entity or board (step527), together with an appropriate certification and perhaps details regarding the final tally. Of course, such final tally and related information may be in any appropriate form and at any appropriate level of detail without departing from the spirit and scope of the present invention.

In one embodiment of the present invention, the vote package sent to the vote gathering service14as at step513includes the voting information therein in an encrypted form. As should be appreciated, such encryption adds an additional level of security, especially if there is any concern that the vote gathering service may be capable of adding or subtracting votes. In such situation, the voting application generates a key for encrypting the voting information and encrypts same therewith, sends the vote package with the encrypted voting information as at step513, and receives the acknowledgment as at step517.

In such embodiment, the vote gathering service14does not decrypt the encrypted voting information and tally same as at step521until after the period of time for the contest has concluded and the vote gathering service14has ceased to accept voting packages, as at step523. Instead, in such embodiment, once the acknowledgment is received, the voting application12breaks the secure channel with the vote gathering service14to conclude a first session, and waits for the contest to conclude.

Significantly, upon such conclusion, the vote gathering service14publishes the total number of votes, and thereafter, the voting application12again establishes a secure channel with the vote gathering service14, this time to conduct a second session. In such second session after such publication, the voting application12sends a decryption key to the vote gathering service14by which such vote gathering service14may decrypt the encrypted voting information, and such vote gathering service14thereafter in fact decrypts the encrypted voting information with such decryption key and then tallies same as at step521. Presumably, in such embodiment, the number of votes published by the vote gathering service14should equal the total votes in the final tally sent by such vote gathering service to the organizing entity or board as at step527. Otherwise, the vote gathering service14may have improperly added or subtracted votes.

With the present invention as set forth above and in the drawings, secure on-line voting may be achieved by way of a computing device10of a voter. In particular, such voting is secure in that the secure computing environment18on the computing device establishes trust with the hardware22employed by the voter, and also prevents malicious software or hardware from interfering with the operation of the voting application12running thereon. Since each voter can only access the vote identification value arranged for such voter, multiple voters can vote with the same computing device10. In fact, the computing device10may even be set up as a more-or-less traditional voting booth in a polling location.

The architecture of the present invention requires that the voter employ a computing device10with a secure computing environment18thereon, but otherwise represents no substantial cost to the user. Presumably, each voter is provided with a voting application14at no cost, and the computing device10already has the network connection16to contact the vote gathering service14and the activation service26. From the point of view of the organizing entity or board, employing the architecture of the present invention can potentially result in a huge cost savings, especially for a contest with a large number of voters that would otherwise have to be accommodated at traditional polling locations. Instead, such organizing entity or board or an agent thereof need only maintain the vote gathering service14and the activation service26and perhaps related services, and provide the copies of the voting applications12to the voters.

Note that although the present invention has been set forth in terms of three main parts: distribution of the voting application12, activation of the voting application12, and voting with the voting application12, it is to be appreciated that at least some of such parts may be combined in certain circumstances without departing from the spirit and scope of the present invention. For example, it may be the case that distribution and activation occur as one unified process, or that activation and voting take place as one unified process. Note, too, that although the present invention includes several occasions on which a list may be published, some or all of such lists may be dispensed with as deemed advisable or desired without departing from the spirit and scope of the present invention.

CONCLUSION

The present invention may be practiced with regard to any appropriate organizing entity or board conducting a contest or election, and with regard to any voter employing a computing device10with a voting application12operating in conjunction with a secure computing environment18. As should now be appreciated, with the present invention as set forth herein, on-line voting may be performed in a manner so that a voter may securely vote in a trustworthy manner.

The programming necessary to effectuate the processes performed in connection with the present invention is relatively straight-forward and should be apparent to the relevant programming public. Accordingly, such programming is not attached hereto. Any particular programming, then, may be employed to effectuate the present invention without departing from the spirit and scope thereof.

In the foregoing description, it can be seen that the present invention comprises a new and useful architecture and method for implementing secure and trustworthy voting from a place other than a polling location. Such voting is achieved by way of a computing device10appropriately coupled to a vote gathering service14and appropriately provisioned with a voting application12, and is not prone to fraud or abuse.

It should be appreciated that changes could be made to the embodiments described above without departing from the inventive concepts thereof. In general it should be understood, therefore, that this invention is not limited to the particular embodiments disclosed, but it is intended to cover modifications within the spirit and scope of the present invention as defined by the appended claims.