Privacy, Identity and Trust in Electronic Voting Technologies

电子投票技术中的隐私、身份和信任

• 批准号: RGPIN-2020-07170
• 负责人: Essex, Aleksander
• 金额: $ 2.99万
• 依托单位: University of Western Ontario
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=741638
• 关键词: Privacy; Identity; Trust; Electronic; Voting

This proposal addresses cybersecurity in the context of explosive interest and adoption of information and communication technology (ICT) into Canada's elections. Online voting, for example, is currently offered in almost half of Ontario's municipalities and expected to double by 2022. In October 2019, the Northwest Territories became the first sub-national election agency to offer online voting, and Quebec is currently holding a public consultation on this technology. Online voting is seen as a means of boosting voter turnout and engagement and building self-governance capacity in Indigenous nations. Despite this rapid growth and interest, however, no standards for online voting exist in Canada, and federal and provincial governments have warned of cybersecurity concerns. With the goal of providing Canada with a responsible path toward election ICT, the PI proposes to investigate cyber technologies that will protect the democratic process as we enter this new era of digital democracy. Elections as a cybersecurity design problem are highly constrained. Solutions must be inclusive to a highly diverse electorate, protect against an unusually broad threat landscape, and juggle the competing properties of ballot secrecy and public accountability. Developing ICT along these lines presents a unique research challenge requiring fundamentally novel techniques. The research objectives of this program will coincide with three pressing cybersecurity gaps in contemporary election ICT: trust, privacy, and identity. The trust objective of the proposed research program will focus on the technical challenge of providing an electorate with compelling, objectively verifiable evidence that an election result is correctly counted and reported. This will be accomplished through the design of novel techniques, algorithms, and protocols for cryptographic end-to-end verifiable internet voting (E2E-VIV), and the use of blockchains for specialized tasks such as automatic smart-contract based proof validation. The identity objective will tackle the broader issue of client-side security and voter eligibility to identify and demonstrate vulnerabilities in existing deployments to malware, phishing, cross-site scripting, and knowledge-based authentication. The privacy objective will focus on strengthening formal guarantees to ballot secrecy in connection with advances made under the confidence and identity objectives. This includes studying the privacy impact of existing confidence and identity ICT through the inter-disciplinary application of techniques such as re-identification risk from the health data privacy world. It will also explore the long-term privacy prospects of E2E-VIV proof transcripts through the development of post-quantum cryptographic techniques and protocols.

该提案在爆炸性的兴趣和信息和通信技术（ICT）的背景下解决了网络安全。例如，在线投票目前在安大略省几乎一半的市政当局提供，预计到2022年将翻一番。2019年10月，西北地区成为第一家提供在线投票的次国家选举机构，而魁北克目前正在就此技术进行公开咨询。在线投票被视为促进选民投票和参与以及在土著国家建立自治能力的一种手段。但是，尽管增长和兴趣迅速，但加拿大没有在线投票的标准，联邦和省政府警告了网络安全问题。 为了为加拿大提供通往选举ICT的负责任之路，PI提议调查当我们进入这个新的数字民主时代时将保护民主进程的网络技术。作为网络安全设计问题的选举受到高度限制。解决方案必须纳入高度多样化的选民，防止异常广泛的威胁格局，并兼顾投票保密和公众问责制的竞争性。沿着这些线路开发ICT提出了一项独特的研究挑战，需要从根本上进行新的技术。该计划的研究目标将与当代选举ICT中的三个紧迫的网络安全差距相吻合：信任，隐私和身份。拟议的研究计划的信任目标将集中在为选民提供引人注目的，客观可验证的证据表明选举结果正确计算和报告的技术挑战。这将通过设计新颖技术，算法和密码端到端可验证的互联网投票（E2E-VIV）的设计来实现，并将区块链用于专业任务，例如自动智能合同基于基于智能合同的证明验证。身份目标将解决客户端安全性和选民资格的更广泛问题，以识别和证明现有部署的恶意软件，网络钓鱼，跨站点脚本和基于知识的身份验证的漏洞。隐私目标将着重于加强与信心和身份目标所取得的进步有关的正式保证。这包括研究现有信心和身份ICT的隐私影响，通过跨学科应用技术（例如从健康数据隐私世界中重新识别风险）进行的技术影响。它还将通过开发量词后加密技术和协议的发展，探索E2E-VIV证明转录本的长期隐私前景。