Packet-based internet voting transactions with biometric authentication

[0001] This Application claims the benefit of:

[0002] U.S. Provisional Application Serial No. 60/351,266 filed Jan. 23, 2002,

[0003] U.S. Provisional Application Serial No. 60/352,901 filed Jan. 30, 2002,

[0004] U.S. Provisional Application Serial No. 60/359,558 filed Feb. 22, 2002,

[0005] U.S. Provisional Application Serial No. 60/377,824 filed May 3, 2002,

[0006] U.S. Provisional Application Serial No. 60/382,033 filed May 20, 2002, and

[0007] U.S. Provisional Application Serial No. 60/385,118 filed May 30, 2002.

[0008] The present invention relates to Internet transactions and, in particular, to transactions conducted via the Internet with authentication. Such transactions may include, but are not limited to, voting, other government transactions (e.g., e-government), and/or private and/or commercial transactions (e.g., e-commerce). Authentication may include biometric authentication.

[0009] Many problems have been experienced with conventional voting apparatus, whether paper ballot, punch-card ballot, optical scan ballot, lever or other mechanical machine and electronic voting machines, as reported in the popular media and in specialized media. When these problems are coupled with the problems of access to voting because of handicap or disability, poor physical facilities at a polling place, geographical location outside of the election jurisdiction during an election, military service, travel, relative short and limited tines for voting, and the like, a desire arises for a voting system that would allow people to vote without having to go to a polling place on an election day.

[0010] Recent approaches to reducing the impact of such problems have included voting-by-mail in Oregon, USA, and early voting, such as that conducted in shopping malls and the like for the November 2002 election in Sacramento County, California. Of these, voting by mail comes with all of the problems associated with the paper ballots utilized plus the problems of delayed delivery and possible vote fraud when the ballots are away from the control of the local election office (LEO). Early voting, while burdensome for LEO personnel, logistically inconvenient with moving and setting up voting equipment, and technically challenging for the equipment utilized, is feasible and has been successfully conducted. The successful early voting in the November 2002 election in Sacramento County, California, utilized the VOTE TRAKKER voting system available from Avante International Technology, Inc. located in Princeton, Junction, New Jersey, whose web site address is www.vote-trakker.com

[0011] Another solution proposed is voting over the Internet (VOI) which would allow people to vote from their own computers, in their homes, offices and other convenient places, without regard to their geographical location and without having to limit voting to a relatively short period of time, such as to one day or a part thereof.

[0012] The prospect of Internet voting raises another set of potential problems regarding security, identification, authentication, viruses, Trojan horses, hacking, attack, and the like. Concerns regarding Internet voting are described, for example, in R. Mercuri, A Better Ballot Box, IEEE Spectrum, October 2002, pages 46-50, in P. Neumann et al, Internet and Electronic Voting, The Risks Digest, Volume 21, Issue 14, 12 December 2000, in B. Schneier, Voting and Technology, Crypto-Gram, Dec. 15, 2000, in R. Mercuri, Rebecca Mercuri's Statement on Electronic Voting, http://www.notablesoftware.com/RMstatement.html, and in R. Mercuri, Electronic Voting, http://www.notablesoftware.com/evote.html.

[0013] While the many problems are raised and discussed, apparently no satisfactory solution has come to the attention of those writing about the problems. Of these, two important problems are that of authenticating the identity of a voter who is not present at a polling place or otherwise not before an election official, of accuracy/security that the vote is not changed or otherwise tampered with, and of transparency in providing the ability to verify that the vote case by a voter has been properly recorded and counted without compromising the anonymity and privacy of the voter.

[0014] Accordingly, there is a need for a method and system for conducting Internet transactions, in particular, Internet voting transactions, that is more robust in addressing one or more of the foregoing problems.

[0015] To this end, the method of the present invention for conducting a transaction via the Internet comprises:

[0016] transmitting via the Internet a first information packet;

[0017] authenticating the first information packet;

[0018] if the first information packet is authenticated, transmitting a second information packet via the Internet, the second information packet including machine readable instructions for enabling transaction information to be entered and transmitted in a predetermined format in a third information packet;

[0019] transmitting via the Internet the third information packet including transaction information entered therein;

[0020] validating the third information packet as relating to the second information packet;

[0021] if the third information packet is validated, testing the third information packet for transaction information in the predetermined format; and

[0022] if the transaction information is in the predetermined format, processing the transaction information of the third information packet that is in the predetermined format for conducting a transaction.

[0023] According to other aspects of the invention, selection information may include a selection from among predetermined selections and/or a write-in selection, and/or the write-in information may be limited by number and type of characters.

[0024] According to another aspect, identifying and/or authenticating information may include one or more of a symmetric key, an asymmetric key, a public key, a private key, a biometric identifier, and/or a biometric digitized signature.

[0025] According to a further aspect, the invention may include a storage medium encoded with machine-readable computer instructions for conducting a transaction via the Internet.

[0026] The detailed description of the preferred embodiments of the present invention will be more easily and better understood when read in conjunction with the FIGURES of the Drawing which include:

[0027] FIG. 1 is a schematic diagram representative of an example election process;

[0028] FIG. 2 is a schematic diagram of a portion of the example election process of FIG. 1;

[0029] FIG. 3 is a schematic diagram of another portion of the example election process of FIG. 1;

[0030] FIG. 4 is a schematic block diagram of an example voting system related to the example election process of FIGS. 1-3;

[0031] FIG. 5 is a schematic diagram representative of a ballot generation aspect of the example voting method and system of FIGS. 3 and 4;

[0032] FIG. 6 is a schematic diagram representative of a vote tabulation aspect of the example voting method and system of FIGS. 3 and 4; and

[0033] FIG. 7 is a schematic diagram representative of various security arrangements associated with the example voting method and system described.

[0034] In the Drawing, where an element or feature is shown in more than one drawing figure, the same alphanumeric designation may be used to designate such element or feature in each figure, and where a closely related or modified element is shown in a figure, the same alphanumerical designation primed or designated a or b or the like may be used to designate the modified element or feature. Similarly, similar elements or features may be designated by like alphanumeric designations in different figures of the Drawing and with similar nomenclature in the specification. It is noted that, according to common practice, the various features of the drawing are not to scale, and the dimensions of the various features are arbitrarily expanded or reduced for clarity.

[0035] FIG. 1 is a schematic flow diagram representative of an example election process 10. Prior to an election, i.e. pre-election, voters are registered 100 to vote via a server, for example, a web server communicating via the Internet. Conducting registration 100 may include utilization of a digital signature certificate issued by an appropriate agency or person, and includes a biometric digitized signature captured in a suitable manner. A biometric signature is a digitized signature that includes the unique dynamic characteristics of the signer signing the signature, which can only be reproduced by the person signing the signature, as opposed to an image, picture or other graphical representation of a signed signature of which an electronically and/or optically reproduced or copied reproduction is easily done electronically and is indistinguishable from the original. A biometric digitized signature, which may also be referred to as a dynamic signature, provides the capability to authenticate the identity of a person (voter) electronically when the person is not present, e.g., at a polling place or election office before an election official.

[0036] A preferred biometric digitized signature is described in U.S. patent application Ser. No. 10/127,793 entitled GENERATION AND VERIFICATION OF A DIGITIZED SIGNATURE filed Apr. 22, 2002 by Kevin Kwong-Tai Chung et al, which application is hereby incorporated herein by reference in its entirety. It is noted that any biometric digitized signature or other biometric characteristic, such as a fingerprint, palm print, eye and/or iris scan, facial scan and the like, that reliably identifies an individual, may be suitable, however, social and/or cultural factors may tend to make certain people and/or people groups averse to certain biometric identifiers.

[0037] It is noted that PKI technology may be implemented in two prevalent wayseither by a registered PKI key or digital certificate on and/or linked to certain equipment or by a PKI smart card. In the case of the equipment-linked PKI which operates on the equipment serial number or other equipment identifier and a personal user key, anyone gaining access to the equipment can conduct a transaction using the equipment. In the case of a PKI certificate associated with a smart card in which is coded the necessary PKI information, anyone gaining access to the card and having the ability to utilize same may conduct a transaction. Thus, PKI encryption alone, which cannot authenticate the identity of the remote user (voter), is not considered adequate for providing the degree of authentication and security desired for a voting transaction.

[0038] On the other hand, a unique biometric identifier is not subject to the inability to authenticate the user inherent in present public key infrastructure (PKI) digital signature technology and digital image signature technology, and so can replace the requirement for a written (ink) signature of a voter, and possibly of a witness, as is required by the present election law of certain jurisdictions, e.g., for registration, voting and/or absentee voting. Biometric digitized signature authentication and/or other biometric authentication as described may be utilized alone or in combination with a PKI certificate, a PKI common access card and/or other access/identification card, and/or other security features.

[0039] During an election, during the day or other period for voting, voting is conducted 200 via the Internet and/or via other communication with a server. For Internet voting, a voter logs on 210a to a web server via the Internet and/or other means for communicating. Once logged on 210a, a digitized signature, preferably a biometric digitized signature, is provided 220 and is now referred to as a transaction digitized signature. The transaction digitized signature is compared 230 to a reference digitized signature previously acquired, e.g., a biometric digitized signature acquired in one or more previous transactions, such as in registering 100 to vote and/or in voting in a previous election, that is stored in a registration and/or voter database on the web server and/or on another server and/or computer.

[0040] If comparison 230 of the transaction and reference digitized signatures produces an indication Y of a match, then the voter is deemed to be authenticated and voting is authorized. The voter then votes 250 by whatever form of ballot (e.g., regular, absentee or provisional) is appropriate. If comparison 230 of the transaction and reference digitized signatures does not produce an indication N of a match, there is no match and the voter is deemed to not be authenticated and is denied to vote 240. If there is any question as to whether the digitized signatures match and/or as to eligibility to vote, an Y indication may be provided and provisional voting 250 may be authorized.

[0041] It is noted that the identifying and/or authenticating information may include one or more of a symmetric key, an asymmetric key, a public key, a private key, a biometric identifier, and/or a biometric digitized signature, or other suitable unique identifier.

[0042] For voting at a polling place or at voting apparatus at another location, a voter logs on 210b at a vote kiosk or other voting apparatus. The vote kiosk or other voting apparatus includes a computer therein and/or is in communication with a computer via the Internet and/or other means for communicating, and may be and/or include a direct recording electronic (DRE) voting machine as described herein. A suitable voting machine/kiosk arrangement is described in U.S. patent application Ser. No. 10/255,348 entitled ELECTRONIC VOTING APPARATUS, SYSTEM AND METHOD filed Sep. 26, 2002, by Kevin Kwong-Tai Chung, which application is hereby incorporated herein by reference in its entirety.

[0043] Once logged on 210b at a voting machine and/or kiosk, a digitized signature, preferably a biometric digitized signature, is provided 220 and is compared 230 to a reference digitized signature previously acquired, e.g., as described above. If comparison 230 of the transaction and reference digitized signatures produces an indication Y of a match, then the voter is deemed to be authenticated and voting is authorized. The voter then votes 250 by whatever form of ballot is appropriate. If comparison 230 of the transaction and reference digitized signatures does not produce an indication N of a match, there is no match and the voter is deemed to not be authenticated and is denied to vote 240. Provisional voting 250 may be authorized where there is a question of matching of the digitized signatures match and/or eligibility to vote.

[0044] When the period for voting has ended, i.e. in a post-election period, the votes are tabulated 300 and the results of the voting is certified 340 as the official outcome of the election. Although vote tabulating 300 may be performed in any order, it is usually preferred that a particular order and process be followed for better security. In particular, votes cast in the regular manner (i.e. not having any write-in votes and/or not cast provisionally or by an absentee voter) are typically counted and tabulated first, e.g., because these are in a prescribed standardized form that can be counted quickly and automatically without intervention by voting officials, and also typically because these are the majority of the votes cast and often, but not always, point to the final outcome.

[0045] Provisional and absentee ballots are also counted and tabulated 320, 330. Because provisional and absentee ballots require action on the part of an election authority to determine the eligibility of the voter to vote and/or to authenticate the ballot prior to the ballot being counted, counting and tabulating 320, 330 of these votes is typically follows counting and tabulating 310 of the regularly cast ballots. When all of the votes/ballots have been counted and the result tabulated/tallied, then the election result is certified 340 in accordance with applicable legal requirements.

[0046] Voting as used herein refers to any and/or all of the ways in which a vote may be cast, whether by regular, provisional, absentee and/or any other form of ballot. An election as used herein refers to any time period, whether a day or part thereof or other time period, in which a vote may be cast, and may include where a different time period may be permitted for voting certain forms of ballots, e.g., absentee ballots.

[0047] Voting transactions as used herein refers to any and/or all actions taken by a person registering to vote and/or to vote whether using a regular, provisional, absentee and/or other form of voting and/or election, and also includes any and/or all actions taken by election authorities and/or other personnel in relation to registering a person to vote, to conducting voting whether by a regular, provisional, absentee and/or other form of voting, and/or to receiving, collecting, authenticating, counting, tabulating and/or otherwise processing votes and/or to conducting, controlling and/or managing an election.

[0048] FIG. 2 is a schematic flow diagram of a portion 100 of the example election process 10 of FIG. 1. Registration 100 includes accessing 110 a server and/or logging on to a server, e.g., via the Internet or other communication means, for registering 120 a voter to vote, i.e. establishing a person on a database accessed via the server wherein is stored registration information concerning persons who are registered and/or eligible to vote and/or conduct a voting or other transaction. Registration 100 includes initial registration 120 and/or registration 130 for absentee voting. Registering 130 for absentee voting may be included in an initial voting registration 120 and/or may be a separate transaction for persons who have previously registered 120 for voting.

[0049] Registration 120, 130 includes entering voter and/or voting (election) registration information via the computer and server, and then submitting 140 the entered registration information via the server and communication means. Registration formats may be in like format to federal registration forms, e.g., the federal post card application (FPCA), the electronic federal post card application (EFPCA), and/or to state and/or local format requirements, and may also include enlarged fonts, enlarged display and/or voice assistance, for visually-impaired persons. In addition, the electronic registration forms provided may include look-up tables, hyperlinks and or other means for allowing the person to access information that may be necessary and/or helpful in registering and/or voting (e.g., election laws, address-to-voting district correlations) and/or for automatically checking information provided by the person for consistency (e.g., motor vehicle records, voting registration records for other jurisdictions, health department death records), with or without access by the person registering.

[0050] Submitting 140 registration information includes electronically submitting same to the server, however, where the election law requires a paper application and/or written (ink) signature, the registration application may also be printed for signature by the person registering and physical submission (e.g., by mall or courier) to the appropriate election office. Preferably, visual and/or aural prompts are provided, e.g., at the initiation of the submission 140, to urge the person to provide all required information, e.g., by reminder to enter missing information. The completed registration is signed by the person using a biometric digitized signature, a biometric identifier, a PKI digital signature and/or other identifier, prior to submission 140. Registration by paper application is not precluded by the electronic registration arrangement described herein.

[0051] Submitted 140 registration information may be stored 150 in a central registration database and/or may be stored 170 in a local registration database. In addition to name, address, date of birth and other voter identifying information, the biometric digitized signature and/or other biometric identifying information is stored in the registration database. Entry of the information provided by the person registering may be entered 150, 170 into the database automatically directly from the electronic registration application, may be entered manually by election personnel, and/or may be entered automatically subject to confirmation and approval by election personnel. Such confirmation and approval may include verification against and/or comparison with other government or non-government records, e.g., motor vehicle registrations, driver's license records, a previously provided digitized signature and/or biometric digitized signature, and/or another biometric identifier.

[0052] In view of recent legislation in the United States, centralized state voter registration databases are expected to become typical, with local (e.g., county, municipal, etc.) election offices utilizing the state database or a database derived from information in the state database. Thus, registration information is typically stored 150 in a state database and is distributed for being stored 170 in a county, municipal and/or other local database. However, the central registration database could be a national or federal database and the local registration database could be a state, provincial, municipal and or other local database, depending upon the governmental structure, election organization and applicable law.

[0053] Typically, registration identifying information and security information is provided 160 and associated with a registration by the primarily responsible election office, be that stored 150 in the central database and/or stored 170 in the local database. Identifying and/or security information may include a voter identifier (also known as a VID number), a PKI certificate, a PKI key, and the like. Preferably, the VID number is of a sort including voting jurisdiction information and a unique randomized identifier, e.g., as described in incorporated U.S. patent application Ser. No. 10/255,348.

[0054] Registration when processed and approved is acknowledged 180 to the person registering by providing one or more of a PKI certificate, a PKI key, a VID number, and the like, and/or an optional voter identification card by mail. Preferably, because the processing of a registration application may take time to verify the person's identity and/or other information, the person registering may be quickly (e.g., within minutes) provided an application tracking number and a receipt that can be printed out. The printed receipt may be a copy of the electronic application as submitted. Until the registration is approved, the status thereof in processing may be made available via the election office web site, e.g., in response to entering the application tracking number and other identifying information.

[0055] Preferably, communication 140 of each registration application and each acknowledgment 180 is transmitted via the Internet and/or other communication means, with a packetized communication, encryption, and/or date-time stamp, as described herein.

[0056] A suitable voter registration arrangement is described in U.S. patent application Ser. No. 10/208,926 entitled REGISTRATION APPARATUS AND METHOD, AS FOR VOTING filed Jul. 30, 2002, by Kevin Kwong-Tai Chung, which application is hereby incorporated herein by reference in its entirety.

[0057] FIG. 3 is a schematic flow diagram of another portion of the example election process 10 of FIG. 1. Specifically, an arrangement is described wherein Internet communication between a person registering and/or voting and the server is minimized, thereby to reduce the opportunities for an intruder and/or hacker to change and/or interfere with information transmitted over the Internet. To this end, interactive communication between the person registering/voter and the election server is preferably avoided and communication by sending a limited number of information packets, each having a predetermined format, is utilized. In addition, and optionally, each information packet may be encrypted for communication, such as by PKI encryption, security socket layer (SSL) which prevents the content of the transmission from being read, MD5 128-bit encryption which provides security for the integrity of the content of the transmission, and/or any other suitable encryption means.

[0058] Accordingly, registration need only include the sending of a registration packet via the Internet to the person registering and that person returning the completed registration packet to the registration server. Similarly, voting need only include the sending of a ballot packet via the Internet to the person voting and that person returning the completed (i.e. voted) ballot packet to the voting server. For improved security, registration packets and ballot packets preferably are opened one at a time according to a certain protocol. Such packetized communication and data processing is described in relation to a voting transaction, e.g., voting, however, the communication and data processing for registration and other transactions is similar. In FIG. 3, operations typically performed by a voter's computer are arranged in dashed area 410 and those performed on a server are arranged in dashed areas 420, 430, 440.

[0059] A voting transaction 200 is initiated by a voter signing on 210 to the server and submitting 220 a sign-in packet including providing a biometric digitized signature (e.g., including accessing the server and logging on) therewith for initiating voting. Sign-in information may also include a VID number, a PKI key or certificate, and/or other identifying information, in addition to a biometric identifier. Logging on 210 and submitting 220 are performed on a user device 410, such as the voter's computer, personal computer, pocket PC, PDA device and the like, including a digitized signature capturing device associated therewith.

[0060] The voter's sign in packet is received at a server 420, e.g., a central server, such as a federal or state server, wherein the identity of the voter is authenticated 230, e.g., by comparing the biometric digitized signature provided 220 with a previously provided biometric digitized signature, e.g., from registration and/or a prior election. It is noted that the sign-in packet and following actions may be for regular voting, for provisional voting and/or for absentee voting. Authentication 230 may also include authenticating the voters PKI certificate, VID number and/or other voter information with information stored in the voter registration database.

[0061] Once voter sign-in is authenticated 230, an acknowledgment 232 thereof is provided, e.g., to a local server 430, 440, such as a state, county, municipal or other server, which server 430, 440 issues 234 a ballot packet. The acknowledgment may include the voter PKI information, VID number and/or other voter information. Preferably, the voter sign-in information submitted in the sign-in packet includes a VID number which includes information representing the jurisdiction in which the voter is eligible to vote, and the VID number is forwarded 232 with the acknowledgment to the local server. Preferably, the ballot of the ballot packet is generated for the appropriate jurisdiction and issued 234 from the jurisdiction represented by the VID number included in the acknowledgment 232.

[0062] When the ballot packet is issued 234 by a local server 430, 440, it is transmitted to the central server 420 wherein it is routed 236 to the voter's computer 410, via the Internet, for the voter to vote 250. In voting 250, the voter on his computer 410 casts his vote 252 on the ballot packet and when finished voting submits 254 the ballot packet to the server via the Internet. It is noted that the ballot packet includes one or more ballot screens of a format determined by the appropriate election office, and desirably appears on the display of the voter's computer 410 in format similar to that of a like ballot displayed at a voting kiosk, a voting machine, on a paper ballot or other voting means. The voted ballot packet submitted 254 is preferably in a standardized format so that all voted ballot packets received by the server have the sane or similar characteristics.

[0063] Where a central server 420 is utilized, the voted ballot packet submitted 254 by the voter is routed 256 to the appropriate local server 430, 440 for vote tabulation 300. E.g., a federal server 420 may route 256 ballot packets to state servers 430, and/or a state server 420 may route ballot packets to county servers 430. Where separate servers 430, 440 are utilized, e.g., in a state and in counties thereof, the ballot packet is distributed 312 to the server 430, 440 of the jurisdiction to which it pertains. E.g., a state server 430 may distribute 312 ballot packets to county or municipal servers 440.

[0064] Vote tabulation 300 includes, e.g., tabulating 310 the ballot packets for regular votes, tabulating 320 ballot packets for provisional votes, and/or tabulating 330 the ballot packets for absentee votes. Optionally, the ballot packets when submitted by a voter may include another biometric digitized signature that can again be authenticated by comparison with the digitized signature information stored in the database from previous registration and/or voting when the ballot packet is opened 316, 318.

[0065] Each of tabulating 310 the ballot packets for regular votes, tabulating 320 ballot packets for provisional votes, and tabulating 330 the ballots packets for absentee votes, comprises the following process. Each ballot packet is unwrapped 314 in that it is decrypted and is tested for integrity, such as by any one or more of parity or other error checking means. Preferably, unwrapping 314 includes testing each ballot packet to verify that it conforms to predetermined characteristics of a standard ballot packet, i.e. a ballot in which only selections among the provided voting selections have been made (e.g., votes cast only for candidates and questions listed on the ballot) without any write-in information or other deviation from the standard ballot.

[0066] Preferably, these test characteristics permit identification and separation of ballot packets including one or more write in votes from ballot packets not having any write-in information, preferably without opening the ballot packet and without compromising the anonymity of the vote. It is desirable to segregate ballots including write-in information for separate processing because the additional information therein could include a virus, Trojan horse or other destructive code, and segregation permits these ballots to be opened one at a time in isolation from all other ballots so that if a ballot contains destructive code, only that ballot can be damaged by any destructive code therein.

[0067] Ballots conforming to the predetermined standard ballot characteristics are opened and counted 316 and the votes cast therein are tabulated 310. Opening a ballot includes reading the decrypted voting information therein that represents the voting selections made by the voter in casting his vote 252. Ballots with write-in information are opened one at a time in isolation and counted 318, with the written-in information being read and also tabulated. Optionally, where a voted ballot packet includes an optional biometric digitized signature, that signature is authenticated by comparison with a reference database signature when the ballot is unwrapped 314 or opened 316, and prior to counting the vote. Ballot packets for absentee votes are opened and counted 314, 316 after the ballot has been authenticated as being a valid absentee ballot. Ballot packets for provisional votes are opened and counted 314, 316 only after the eligibility of the voter has been established by the election office and the ballot has been authenticated as being a valid provisional ballot.

[0068] In opening and counting 314, 316 ballots, the registration record in the registration database may be marked or flagged to indicate that a voter has voted and, if the voter record has previously been so marked or flagged, then the subsequent ballot may be deemed a duplicate and not be counted. Checking for plural voting at this time may be useful, e.g., where a voting machine (kiosk) is not connected to the server during the time for voting, and so a person could vote once via the Internet and once via such free-standing kiosk voting machine. A suspect ballot may be set aside for investigation leading to it being counted if determined not to be another vote by the same voter and/or to prosecution if it appears that voting fraud has been attempted. Attempts at voting fraud may also be detected in the manner described in U.S. patent application Ser. No. 10/127,787 entitled VOTING FRAUD DETECTION SYSTEM AND METHOD filed Apr. 22, 2002, by Kevin Kwong-Tai Chung, which application is hereby incorporated herein by reference in its entirety.

[0069] FIG. 4 is a schematic block diagram of an example voting system 400 related to the example election process of FIGS. 1-3. System 400 includes a computer 410 utilized by a person registering and/or conducting a transaction with a server 420 via the Internet. Central server 420 is in communication with intermediate server 430 which is in communication with local server 440, and/or server 420 is in communication with local server 440 via communication means 450. Typically each of servers 420, 430 and/or 440 is a server or a cluster of servers in one or more locations. Also typically, each of intermediate server 430 and local server 440 may represent plural servers and/or clusters of servers utilized by different political entities, such as states, provinces, counties, municipalities and the like. Communication means 450 illustrates an optional communication path(s) and/or route(s) that may be employed where no intermediate processor(s) 430 is employed.

[0070] The two-directional arrows between computer 410 and server 420, between servers 420 and 430 and between servers 430 and 440, and between means 450 and servers 420, 440, as well as communication means 450, represent communication paths which may include, for example, any one or more of the Internet, a local area network (LAN), a wide area network (WAN), another network and/or communication hub, telephone, wire, cable, optical fiber, radio and/or optical wireless communication, as well as other means of communication. As used herein, the shorthand term via the Internet may refer to communication over the Internet alone and/or to a communication path including the Internet and any one or more of the foregoing communication means. Communication among servers 420, 430 and/or 440 may be via a government-controlled network having appropriate security and other features for insuring the integrity of the voting information, process and result.

[0071] Computer 410 may be utilized for obtaining a PKI certificate, applying to vote, requesting an absentee ballot, voting, to receive and act on information packets and to submit information packets, to receive and check on the status of an application submitted, and/or to log on and sign in, including providing a biometric identifier such as a biometric digitized signature. For submitting a biometric digitized signature, an appropriate signature device is associated with computer 410 and the necessary software therefor is included in the information packet(s) provided via election server 420.

[0072] As above, central server 420 may be a federal or state server, and servers 430, 440 may be state, county, municipal and/or another local server, it being noted that local server 440 and/or intermediate server 430 may be optional. Any one or more or all of servers 420, 430, 440 may be referred to as a server or as the server, e.g., where it the distinction is not deemed important, such as apart from describing FIG. 4.

[0073] Server 420, which may be a federal server, acts as a postmaster in directing, routing, and/or distributing information packets (e.g., registration packets, ballot packets, voted ballot packets) among computer 410 and servers 430, 440, as well as authenticating and/or verifying voter identity, biometric digitized identifier and/or ballot information. In addition, server 420 may attach a date-time stamp to each information packet processed, wherein the date-time stamp preferably includes the time to a very precise and fine division. Preferably, the time is specified to the millisecond. Optionally, the server time may be referenced to a national and/or international time standard, such as that maintained by the National Institute for Standards and Technology (NIST) in the United States.

[0074] Where intermediate and/or local servers 430, 440 operate with differing formats for, e.g., registration and/or election databases, ballot formats and the like, server 420 may serve as a conversion processor and/or compiler for providing registration packets and/or ballot packets in a standardized format and/or style, and/or for providing completed registration packets and/or voted ballot packets in the format(s) utilized by servers 430 and/or 440.

[0075] Optional intermediate server 430 may be, e.g., a state server, that acts as postmaster for directing, routing, and/or distributing information packets (e.g., registration packets, ballot packets, voted ballot packets) among plural local servers 440. Where server 430 is a state server 430, a centralized state registration database is preferably maintained thereon, registration packets are issued and completed registration packets are processed by server 430, and information from the registration database is communicated to central server 420 and/or to local servers 440 as needed. Optionally, server 430 may add a date-time stamp to each information packet produced and/or processed, in like manner to that described for server 420.

[0076] Local server 440 is typically controlled by the election office controlling voter registration, voting and/or elections. Server 440 may authorize or deny absentee and/or provisional voting and may generate and provide appropriate ballot packets therefor, and may also provide updating information to a central state registration database, e.g., on server 420 or 430. Server 440 may also generate ballots for use in voting at polling places and/or via the Internet for contests under its jurisdiction. Voted ballot packets are received at server(s) 440 where they are stored until being processed. Voted ballot packets are processed at server(s) 440, e.g., they are unwrapped, authenticated, opened, counted and tallied/tabulated. Alternatively and/or additionally, such processing may be performed at any one or more of servers 420, 430, 440, as may be required by the applicable election law or as may be desirable and/or convenient.

[0077] FIG. 5 is a schematic flow diagram representative of a ballot generation 500 aspect of the example voting method and system of FIGS. 3 and 4. In FIG. 5 computer files are represented by symbols evocative of a cylinder (e.g., 512) and sheets of paper (e.g., 514, 516, etc.), and operations therein are typically performed by one or more of servers 420, 430, 440, or on a server or computer provided for ballot generation. Ballot packet generation 510 is represented to the left of the dashed vertical line (and typically may be performed by server 440) and ballot object generation 540 to the right of the dashed line (and typically may be performed by server 420).

[0078] A ballot is designed 520, e.g., is laid out in a desired format and/or style and contest information representative of one or more contests, candidates, public questions, referenda, constitutional amendments and/or matters to be voted on is entered, typically by an election office, and is stored in one or more files in a ballot database (DB) 512. Ballot generation may be run in a browser/client or client/server mode, in a format compatible with and/or convertible into the format of the ballot object generating process to be described. Preferably, the ballot is generated in a format that is compatible with the ballot object generating process and any voting machine to be utilized.

[0079] Generating a ballot object 540 is requested 522 when all ballot information has been entered and is performed by ballot object generating software that includes machine readable instructions that includes the ballot object template source code 542. Preferably, the ballot object generating software 540 cannot be accessed by the election official, but the data utilized for generating 546 the ballot object must come from the ballot information entered by an election official. The ballot template source code 542 is modified according to the ballot information to generate 546 ballot object source code based upon the template which is stored as ballot object source code 544, and a unique identifier is generated and assigned thereto and associated therewith to uniquely identify the particular ballot object 544 in the universe of all ballot objects, e.g., without regard to a particular election and/or jurisdiction. The ballot object source code 544 is assembled 548 to produce the ballot object. The assemble function and technology of the tool program, e.g., ActiveX Control developed with a Visual C tool, may be utilized directly or indirectly for assembling the ballot object.

[0080] The generated 546 and assembled 548 ballot object is downloaded 524 and is stored as a ballot object 514. Optionally, an election official may be required to sign 526 the ballot object before it is embedded into a web page, e.g., by signing with a digital identifier such as an alphanumeric identifier, and the signed ballot object 516 is stored. A ballot packet 518 is generated 528 from the ballot object 514 or signed ballot object 516, as the case may be, and stored. The ballot object 514, 516 may be embedded in a web page in generating 528 the ballot packet 518 which may also include JavaScript functions. Ballot packet 516 is tested 530, e.g., with function, data format and integrity tests to assure that it completely and accurately presents the voting selections a voter will have opportunity to select and completely and accurately accepts and records voting selections made by a voter. Ballot packet 518 may include, either as a standard packet and/or as a requested feature, voice assistance and/or large (expanded) size display for assisting visually impaired persons to vote, in similar manner to that described in relation to the voting apparatus and method of incorporated U.S. patent application Ser. No. 10/255,348.

[0081] The ballot packet 518 is then distributed 234, 236 responsive to voter's requests, e.g., requests in the form of submitted sign-in packet, via the Internet. Distribution (sending) and return (receiving) of a ballot packet to a voter via the Internet may be accomplished in various ways. For example, an HTML form with some JavaScript and/or XML support is one common approach, however, it may lack some functions desired for the ballot packet and it undesirably allows access to the ballot source code. A preferable approach is to utilize JavaApplet and/or ActiveX Control which can be embedded into the web page and downloaded automatically therewith. JavaApplet is compiled as Java bytecodes which are interpreted at runtime by a virtual machine; ActiveX Control is compiled and run as binary code, thereby providing a degree of security for the internal design, running logic and special data within ballot packet 518. In addition, JavaApplet and/or ActiveX Control can generate a voted ballot packet in standard HTML data format or a predetermined format and encrypt the voted ballot packet which includes all of the voter's voting selections for submission.

[0082] After a voter has downloaded a ballot packet 518, he utilizes it to vote locally, i.e. on the computer 410 to which ballot packet 518 was distributed 234, 236. In other words, there is no interaction between the voter's computer and the web server during voting. The voter's computer 410 may remain connected to the Internet or may be disconnected during the period between receiving a ballot packet sent 236 to the voter and submitting 254 a voted ballot packet. Preferably, the ballot packet 518 may be started only once when it is downloaded and cannot restart independently, so the voter's computer 410 cannot be turned off before the voted ballot packet is submitted 254.

[0083] FIG. 6 is a schematic flow diagram representative of a vote tabulation aspect of the example voting method and system of FIGS. 3, 4 and 5. In FIG. 6 computer files are represented by symbols evocative of a cylinder (e.g., 552, 554), and operations typically performed by computer 410 and servers 420, 440 are separated by dashed lines.

[0084] Ballot packet 518 is voted and submitted 250 as a voted ballot packet by the voter. Specifically, the ballot and voting selections are packed and encrypted 254a with the PKI public key of the local election office (LEO) included in ballot packet 518. The packed and encrypted 254a ballot and voting selections are signed 254b with the voter's PKI private key and is submitted (transferred) 254c, 256a as a voted ballot packet, e.g., to server 420.

[0085] Server 420 authenticates 256b the voter PKI private key and, if authenticated, attaches a date-time stamp to the encrypted voted ballot packet and transfers 312 the voted ballot packet to the server, e.g., server 440 of the LEO or other vote counting and tabulating authority. The voted ballot packet is logged 313 and stored in a buffer database 552 as are all voted ballot packets, which may be received one at a time over a period of hours or days or weeks, depending upon the time period established for voting and/or the type of ballot. E.g., typically, even where regular voting is conducted on one day (election day), early voting may be permitted for one or more weeks in advance of the election day and absentee ballots may be received at any time during a period extending several weeks prior to the election day and perhaps for several days after the election day.

[0086] Voted ballot packets from database 552 are unwrapped 314 one at a time and are stored in a valid ballot database 554. I.e. a first voted ballot packet is decrypted 314a and checked for being a valid voted ballot, then a second is decrypted and checked, and an N^th voted ballot is decrypted 314n and checked. Typically, unwrapping 314 is performed after the time for voting has closed and at least all regularly voted votes that are valid have been received, although ballot packets for absentee ballots may be later received and ballot packets for provisional ballots may be held back for later processing after the eligibility of the voter to vote has been verified. All voted ballots are counted 316, 318 and the voting result is tabulated 300.

[0087] FIG. 7 is a schematic flow diagram representative of various security arrangements associated with the example voting method and system described. Security is of substantial importance in Internet transactions, particularly in the context of an election where the integrity of voting and the election result has governmental and political implications. As the period over which voting in an election expands, e.g., from a period of hours on an election day to a period of weeks or months for absentee and advance voting and/or early voting, the time during which hackers, terrorists and others may attempt to cast improper votes, to corrupt the election, to inject a virus, Trojan horse or other destructive code, and/or otherwise attack the election server(s) and/or system, likewise increases. Any and all of the foregoing are referred to as malicious code.

[0088] A transaction 250 is accomplished by the transmission of three separate information packets, e.g., via the Internet. Preferably, each information packet comprises a one-way transmission without interactive communication between the computer from which the transaction is made and the server processing the transaction. For example, a voting transaction 250 requires only transmitting 610 a sign-in packet from the computer to the server, transmitting 612 a ballot packet from the server to the computer if the sign-in packet is authenticated, and transmitting a voted ballot packet from the computer to the server.

[0089] The sign-in packet includes authentication information such as a biometric digitized signature and/or other biometric identifier, and each packet is preferably encrypted for transmission. The ballot packet represents the applicable specific ballot in electronic form and includes voting-specific operating software, i.e. the software needed to mark the ballot in voting and to transmit the voted ballot in a predetermined form, i.e. as a voted ballot packet. Once the voter has made his voting selections and indicates same, e.g., by clicking on a Cast Vote button, the voted ballot is wrapped in two envelopes, an inner and an outer envelope, of the voted ballot packet.

[0090] For example, the voted ballot is wrapped with the voter VID number in an inner envelope which is encrypted, e.g., utilizing MD5 128-bit encryption. The unmarked inner envelope is then encrypted using the voter's PKI identification, and optionally including a biometric digitized signature, thereby providing a marked outer envelope. When each information packet is transmitted, it is tagged with a time-date stamp by each server, e.g., the central server as well as any intermediate and/or local server, with the time recorded to a fine division, e.g., a millisecond.

[0091] When the voted ballot packet is unwrapped and/or opened, the marked outer packet is decrypted first and the identifying information therein, e.g., VID number, biometric signature and/or PKI identifier, may be read and processed for verifying eligibility to vote and/or authenticating the voter, as well as for testing the ballot packet for conformance to the parameters of a standard voted ballot packet. Specifically, MD5 encryption may be utilized to assure integrity between the VID number and the voted ballot, e.g., within the inner envelope, because any change to the information therein will be detected. With MD5 the relationship between the VID number and the voted ballot information is fixed and cannot be changed. Then the unmarked ballot packet, if valid, is stored for later opening and counting as described. Each information packet transmitted by one server to another may be tagged with a time-date stamp by each server, e.g., the central server as well as any local and/or intermediate server, with the time recorded to a fine division, e.g., a millisecond.

[0092] Because the sign-in packet, the ballot packet and at least the non-write in portion of the voted ballot packet are in predetermined form, there is no opportunity to insert malicious code therein. In addition to security benefitting from only a small number of transmissions, there is no definite or predictable time or other relationship between the transmissions of the information packets that could be used to facilitate identifying any one information packet with any other information packet.

[0093] Upon or after receipt at the server, the voted ballot packet is validated 616 and if valid is stored 620 as a validated ballot packet or is isolated 618 as an invalid ballot packet, typically being removed 618 as an invalid voted ballot packet. Validation may include, for example, testing the size and form of the packet against a standard size and form that all valid packets must have, verifying a PKI or other encryption characteristic, authenticating a biometric digitized signature and/or other biometric identifier, and/or comparing voter identifying information to information in a registration database. Invalid voted ballot packets may be discarded or may be retained, e.g., for investigation.

[0094] At the time and/or times for counting voted ballots, stored 620 validated voted ballots are counted and tabulated 630. Each packet is tested 632 for conformance to the predetermined standard voted ballot packet criteria and if a standard ballot, is opened and counted 634 and is tallied and/or tabulated 636. Because all of the possible combinations of information that can a voted ballot packet can contain is known, i.e every possible combination of voting selections is known, a standard voted ballot packet must conform to one of the possible combinations to be valid, unless a write-in vote is included. Testing may include comparing each voted ballot packet with all of the possible combinations, in which case each valid standard voted ballot packet will match one of the possible combinations, and all others are non-standard, e.g., contain a write-in.

[0095] If all ballots have not been counted 638, path N is followed to the test 638 and the cycle 632-638 repeats until all ballots have been counted. This typically results in all ballots being counted except those including a write-in vote, e.g., typically greater than 95% of the valid voted ballot packets received (ballots cast) and more typically more than 99% of the valid voted ballot packets received (ballots cast). Because there is no opportunity for added code in the valid standard voted ballot packet, no malicious code can be inserted therein, e.g., as to gain access to the server thereby.

[0096] After all valid standard voted ballot packets are counted 634 and tabulated, decision 638 follows path Y for opening and counting 640 and tabulating 642 the valid voted ballot packets including one or more write-in votes. If an opened 640 ballot packet includes code that is considered suspect code, i.e. code suspected of being malicious code, that ballot is removed 644, e.g., for later investigation. If all ballots have not been counted 646, path N is followed to opening 640 and the cycle 640-644 repeats until all ballots have been counted. When all the ballots are determined 646 to have been counted, path Y is followed.

[0097] Because voted ballot packets including write-in information are opened separately and one at a time, each can be tested for the presence of malicious code. Any malicious code therein can contaminate only that vote, and not any other vote, whether prior or later opened and counted. To further reduce the potential effect of malicious code, counting/tabulating 630 preferably includes separately processing the non-write-in and the write-in portions of voted ballot packets containing write-in information. For example, opening and counting 640 preferably includes for each voted ballot packet containing write-in information, separately opening and counting 640a the standard portion thereof and also separately opening and counting 640b the write in portion thereof.

[0098] Further, each write-in portion may be opened and counted separately form each other write in portion, thereby to prevent malicious code spread among two or more write-in portions from acting together. In addition, any attempt to submit malicious code is further limited by limiting the number of characters that can be submitted in any write-in portion, e.g., limiting the field to 16 characters. Still further, any attempt to submit malicious code is further limited by limiting the type of characters that can be submitted in any write-in portion, e.g., limiting the field to ASCII characters. Each write-in selection is limited as to both number and type of characters that may be entered, e.g., each write-in selection is typically limited to 32 or fewer ASCII characters, and preferably to 16 ASCII characters.

[0099] The one at a time processing of voted ballot packets may be performed on one computer and/or server, or may be performed on a group or cluster of computers or servers for fasted processing by utilizing parallel processing. In each case, each processor performs the complete operation 630 on one ballot packet and verifies that it has not been infected and/or affected by malicious code therefrom, prior to requesting another voted ballot packet for processing, e.g., from a load-balancing server where a cluster thereof are utilized. In addition, each voted ballot packet is preferably copied and stored an archive server for purposes of disaster recovery should any fault or failure, including infection by a malicious code, affect the operating server(s). In the event thereof, the stored voted ballot packets are available for use in investigating the source of malicious code, e.g., assisted by the date-time stamping each voted ballot packet receives from each server that handles it.

[0100] Voter registering and updating of registration information are two activities in which the user (the person registering or updating registration) may provide substantial information that is written in on a registration and/or registration update format. Election security may be provided against malicious code submitted in a voter registration and/or registration update by the separately processing each registration and/or update in like manner to that described above.

[0101] Alternative ways to increase resistance to malicious code during an election include separating the registration processing from the election processing, e.g., by utilizing separate servers and/or by temporal separation, e.g., by ceasing to process registrations and updates during the time period when voting is conducted. This generally is not disruptive because all voters eligible to vote in a particular election typically must be registered prior to an election. Thus, the registration database is closed to new entries and is utilized for verifying eligibility to vote and for authenticating voters until the election is completed. Registration applications and updates received during the time registration is closed may be stored and processed after the election is completed, and the same server(s) may be utilized for registration and voting/election processing.

[0102] Typically, regular voted ballot packets are counted first 630, and then absentee ballots are validated 622 and counted/tabulated 630A and/or provisional voted ballot packets are validated 624 and counted/tabulated 630P. Regular voted ballot packets, absentee voted ballot packets and/or provisional voted ballot packets may be counted in any order, whether separately or mixed together, as may be required, convenient and/or desirable.

[0103] Accordingly, it is seen that plural levels of security is provided for completely and accurately counting the vote and for excluding and/or severely limiting the damage that may be done by any malicious code that may be submitted. In summary, these levels include a limited number (e.g., three) of information packets transmitted, standardized information packet size and/or form, one-way communication of information packets (rather than interactive communication), biometric authentication, PKI and/or other encryption, validating packets and removing invalid packets, separately processing standard ballots and write-in ballots, opening write-in information one at a time, limiting the number and types of characters that may be written in, and/or separating and/or ceasing to process registrations during the time period when voting is conducted.

[0104] Thus it can be said that this approach seeks not only to limit the opportunities for malicious code to be inserted, but also to limit the code that can be inserted, e.g., by limiting the number and types of characters, thereby seeking to contain the threat and limit the damage it may cause, rather than to do the impossible of eliminating it.

[0105] The present invention can be embodied as a computer implemented process or processes and/or apparatus for performing such computer-implemented process or processes, and can also be embodied in the form of a tangible storage medium containing a computer program or other machine-readable instructions (herein computer program), wherein when the computer program is loaded into a computer or other processor (herein computer) and/or is executed by the computer, the computer becomes an apparatus for practicing the invention. Storage media for containing such computer program include, for example, floppy disks and diskettes, compact disks (CD)-ROMs (whether or not writeable), DVD digital disks, RAM and ROM memories, computer hard drives and back-up drives, and any other storage medium readable by a computer. The invention can also be embodied in the form of a computer program, e.g., whether stored in a storage medium or transmitted over a transmission medium such as electrical conductors, fiber optics or other light conductors, or by electromagnetic radiation, wherein when the computer program is loaded into a computer and/or is executed by the computer, the computer becomes an apparatus for practicing the invention. The invention may be implemented on a general purpose microprocessor or on a digital processor specifically configured to practice the invention. When a general-purpose microprocessor is employed, the computer program code configures the circuitry of the microprocessor to create specific logic circuit arrangements.

[0106] It is noted that while the voter identifier (VID) and other identifiers and parameters is/are referred to as numbers, each may include numerical, alphabetic, alpha-numeric and other characters and symbols, conventional or arbitrary, as may be desired. Information is typically represented and/or stored in a memory in accordance with a predetermined formula or algorithm or other scheme, either on a character by character basis or on the basis of one or more combinations of the characters or values, for example, binary, binary coded decimal, hexadecimal, or any other digital coding representation thereof. The parity or check number or code is likewise representative of the information represented or stored in the memory in accordance with a predetermined formula or algorithm or other scheme, either on a character by character basis or on the basis of one or more combinations of the characters or values stored in the memory. Suitable formula and algorithms therefor include, for example, binary, binary coded decimal, other digital coding representations thereof, parity checks or other parity representations, sum checks, field relationship checks or any other predetermined relationship between the stored data or information and the parity or check number or code.

[0107] While the present invention has been described in terms of the foregoing exemplary embodiments, variations within the scope and spirit of the present invention as defined by the claims following will be apparent to those skilled in the art. For example, because the biometric digitized signature is a powerful and reliable means for authenticating the identity of a person seeking to vote, the system and method herein may provide to a voter his VID number (which is retrieved from the voter registration database) once his identity has been authenticated by comparison of biometric digitized signature or another biometric identifier.

[0108] It is noted that the method and system described herein is complementary to and compatible with other voting apparatus such as DRE voting machines and/or paper ballots, whether hand marked or read electrically, optically and/or mechanically. A DRE machine such as that described in incorporated U.S. patent application Ser. No. 10/255,348, and/or an optically scanned ballot system such as that described in U.S. patent application Ser. No. 10/260,167 entitled ELECTRONIC VOTING APPARATUS AND METHOD FOR OPTICALLY SCANNED BALLOT filed Sep. 30, 2002, which is hereby incorporated herein by reference in its entirety, for example, may be coupled into the same system with the Internet voting arrangement described.

[0109] In addition, additional privacy protection may be provided by utilizing separated servers and/or other processors for unwrapping and authenticating voted ballot packets. For example, a first (e.g., central) server which lacks any software for opening and/or counting voted ballots may unwrap the marked envelope and authenticate the voted ballot packet from the information of the marked envelope, and then forward only the unmarked voted ballot packet (e.g., in its unmarked envelope) to another (e.g., local) server, i.e. without identifying information so as to ensure voter privacy and vote confidentiality. In such case, the first server will store the voter identifying information in a randomized file which is provided to the second server. Further, election official access may require concerted action by plural election officials each having their own log-on identifier and password, and/or biometric digitized signature, to avoid an individual attempt to tamper with the vote.

[0110] Further, the Internet voting method and system described may be utilized for one form of voting, e.g., absentee voting and/or early voting, where other voting is conducted with conventional DRE machines, optically-read ballots and the like.

[0111] References to a server and/or a computer are not limited to one apparatus in a particular location, but may include plural apparatus in one or plural locations. A server may refer to a single server or to many servers, and/or may refer to a server communicating via any means for communicating, including but not limited to a wire, cable, telephone, optical fiber, optical communication device, radio or other wireless device, local area network, wide area network, Ethernet and/or other network, an Intranet, and/or the Internet. Similarly, references to a central computer, intermediate computer, local computer and/or other computer may include one or more computers in one or plural locations.

[0112] While the invention herein is described in the context and terms of Internet voting, the invention may be employed in other electronic transactions including but not limited to electronic commercial transactions (e-commerce), electronic governmental transactions (e-government), and the like. In such cases, the voter is representative of a purchaser, seller, party or other user, voting is representative of purchasing, selling, participating and the like, and the voter registration database is representative of a database of registered purchasers, sellers, parties and/or other users.

[0113] Further, while plural biometric digitized signatures, PKI security keys, identifiers and/or other security features may be desirable in the context of a transaction wherein a very high level of identification and/or authentication is desired, such as in governmental voting, lesser levels of identification may be acceptable in other transactions, such as low value purchases, opinion surveys and the like conducted via the Internet. An example of the latter may include a single biometric digitized signature and normal Internet encryption techniques.