Voting method

FIELD OF THE INVENTION

p-0002The present invention relates to the field of ballot paper counting method and more particularly to a method to strengthen an integrity of a voting process when authenticating and counting ballot papers.

BACKGROUND OF THE INVENTION

p-0003They are different methods to maximize the credibility and integrity of the vote counting process when initiating a voting procedure.

p-0004Some of them consist of counting ballots manually, mechanically and/or electronically. In each case, there is a balance between-integrity, accuracy and speed. A common characteristic of these methods is to minimize opportunities for fraud and manipulation and ensuring that the public perception of the counting of votes is a simple, straightforward and non-partisan process.

p-0005A manual method, like the hand counter process, attempts to do the very best to be nonbiased and fair. Such a manual method has a degree of subjectivity that is an extremely important issue in a process where no subjectivity is allowed. Moreover, a manual method is not suitable for counting a large quantity of ballots quickly.

p-0006Today's trend of the voting process uses generally a computerized method for counting votes. Electronic and mechanical methods, whether mixed together or not, can provide an accurate and speedy vote count and announcement of results. Whereas such methods seem to offer a robust identification mechanism, numerous external situations can compromise the privacy of the voter as well as the counting process accuracy.

p-0007One computerized method consists of using a PC compatible with a touch screen especially packaged for voting, like the “Electrovote 2000” voting machine sold by Fidlar-Doubleday (formerly Fidlar and Chambers). Such a system includes a flat panel display screen on the voting machine that has a very poor off axis viewing, so the privacy is a bit better than the minimal booth suggests.

p-0008A more sophisticated system, PC based, incorporates a smartcard interface, like the “Global Election Systems Model <b>100</b> Electronic Ballot Station”. In use, the machine is enabled by entering an ID code on the screen corresponding to the polling place and each voter is given a smartcard that is available for one use. Even if using a smartcard avoids over voting in a voting machine similar to the “Electrovote 2000”, the system has a very poor off axis viewing. Furthermore, the smartcard is considered as a voter's token and does not contain any confidential data related to the candidate/party that minimizes considerably the solution interest.

p-0009Another system, based on direct recording electronic voting machines, incorporates push buttons with associated light, like the “Microvote Electronic Voting Computer”. The system consists of using push buttons adjacent to each ballot item to cast votes, with a light by each button giving positive feedback that the vote has been registered. Such a system contains only 64 buttons. Many voting processes, like elections, would require significantly more than this if the full ballot were to be displayed at once. The system can be extended for displaying more candidates by using a complex ballot paging. A better displaying on a single scroll, side by side is required to the voter that wants to work through the issues on the ballot that seems to be difficult to handle.

p-0010A standardized ballot, punched card based, was first used for vital statistics tabulation before adopted for voting process by using a “Votomatic” technology. The punched card contains a tabulation of pre-printed information representing a matrix of voting positions. Generally, in many systems that use a punched card method, the ballot is pre-scored at each voting position so that punching with a stylus through that position into an appropriate backing will remove a rectangle of chad, leaving a hole that is counted as a vote. Then, the ballot card is held in proper alignment and is inserted into a voting machine. The voting machine checks that a voted ballot paper is legitimate and deposits it in the ballot box for later countering. The counting machine does not recognize circling or underlining ballots and multiple votes are ignored.

p-0011Finally, the ballots are stacked for tabulation and processed by using either a computer equipped with a standard punched-card reader or by an electromechanical punched-card tabulating machine. Unfortunately, in some cases the punched card process may compromise the counting method accuracy.

p-0012Statistically a punched card may contain a dimple in a position instead of a cleanly punched hole. This is due to either a voter hesitation or a pre punched card failure. In addition, some punch positions on the ballot can be directly over internal braces, inside the voting machine mechanism, that can develop undesirable chad jams. The development of chad jams that are accumulated in areas where ballots are being processed may represent votes added to some candidates by accident. It is also possible to obtain a ballot that has a completely removed chad for one candidate but also has a chad with one corner punctured for another candidate in the same race. This ballot has to be counted as a vote. The presence of dimples and undesirable chads initiates a hand recount process and it is difficult for a human by looking a dimple or an incoherent chad to determine the voter's intent.

p-0013Some electronic voting machines allow voters to show their choices and stop them if they try to over vote. These machines allow voters to review their choices and ballots before turning them in. The name of candidates and the text of ballot questions are not printed on ballots that are based on a punch card method. This is a reason why some organizations switch from punch cards to optical scan, in which voters fill in ovals with a pencil. In certain circumstance, it is possible to twist a ballot. Twisting a ballot can produce several “votes” on a punch card ballot that has already been counted by machines three or more times that is considered as over voting. In this case, over voting invalidates the vote.

p-0014To summarize, the aforementioned voting systems and methods present several drawbacks. Some of the main drawbacks are as follows.

p-0015A manual method, like the hand counter process, has a degree of subjectivity that is unacceptable in such a voting process. Moreover, a hand counter process is not appropriate when counting a large quantity of ballots and is subject to mistakes, such as over voting and/or any ballot rigging, that a skilled person in the art can easily imagine.

p-0016A touch screen electronic computerized method compromises the privacy of the voter when using a flat panel display screen on the voting machine that has a very poor off axis viewing.

p-0017A system based on push buttons is too difficult to be manipulated easily by a voter.

p-0018A computerized method, punched card based, when applying in a large range of ballots, generates undesirable chads. The difficulty to recognize a legitimate ballot when some undesirable chads appear on the card and a necessity to hand recount ballots when a ballot fails in conformity are time consuming in a process that needs to provide results quickly.

p-0019As mentioned above, prior art solutions make the existing methods not fully appropriate to achieve an efficient vote counting process while guarantying full integrity, preventing ballot rigging, and allowing full audit.

p-0020The present invention offers a solution to solve the aforementioned problems.

SUMMARY OF THE INVENTION

p-0021The present invention provides a voting method, comprising:

p-0022receiving a ballot paper that includes a recorded vote comprising candidate/party information for an election held on a voting day in a jurisdiction, said ballot paper comprising a burnable radio frequency identification (RFID) tag that includes an on-tag fuse that is not blown, said recorded vote not being revealable while the fuse is not blown and being revealable in response to the fuse being subsequently blown;

p-0023after said receiving, authenticating said ballot paper;

p-0024after said authenticating, blowing the fuse to reveal the recorded vote; and

p-0025after said blowing the fuse, counting the ballot paper and directing the ballot paper to a candidate box.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0026The above and other items, features and advantages of the invention will be better understood by reading the following more particular description of the invention in conjunction with the accompanying drawings.

p-0027<figref idrefs="DRAWINGS">FIG. 1</figref> illustrates by schematic block diagram the relationship between the elements for practicing embodiments of the present invention.

p-0028<figref idrefs="DRAWINGS">FIG. 2</figref> sets out full details of the Ballot Paper as represented in a voting system arrangement, in accordance with embodiments of the present invention.

p-0029<figref idrefs="DRAWINGS">FIG. 3</figref> sets out full details of the Ballot Box as represented in the voting system arrangement, in accordance with embodiments of the present invention.

p-0030<figref idrefs="DRAWINGS">FIG. 4</figref> shows full details of the Ballot counting and sorting machine as represented in the voting system arrangement, in accordance with embodiments of the present invention.

p-0031<figref idrefs="DRAWINGS">FIG. 5</figref> is a flow chart of the Ballot Box process when a voter inserts a Ballot Paper to be authenticated by the Ballot Box, in accordance with embodiments of the present invention.

p-0032<figref idrefs="DRAWINGS">FIG. 6</figref> is a flow chart of the Ballot Sorting and Counting Machine process when voted ballot papers that were preliminarily checked and validated through the Ballot Box process are loaded into the Ballot Counting and Sorting Machine, in accordance with embodiments of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

p-0033Embodiments of the invention are described herein after by way of examples with reference to the accompanying figures and drawings.

p-0034The present invention to provide a system for tracking ballot papers, allowing strengthening of the audit integrity of a voting process by the use of the radio frequency identification (RFID) technology.

p-0035The present invention integrates a wireless apparatus, RFID tag wireless capabilities for monitoring a voting process mechanism, ensuring that all parts involved in the action are completely protected against ballot rigging during operation.

p-0036The present invention uses an on-tag fuse mechanism embedded in the ballot paper to protect the integrity and confidentiality of the voted ballot paper during operation.

p-0037The present invention uses a jurisdiction's private/public signature and its associated checksum mechanism to control dynamically the validity of the ongoing ballot paper.

p-0038The present invention certifies the ongoing ballot paper, in real time, by encoding an assessor's private/public signature key in a field of an RFID tag located in a Ballot Paper.

p-0039The present invention interprets the information encrypted in the ballot paper by beaming the RFID tags located in the ballot paper.

p-0040The present invention blows the on-tag fuse of a burnable RFID tag to free the confidential candidate information when initiating the sorting and counting process.

p-0041The present invention rejects a ballot paper non-compliant with the jurisdiction's expectations loaded in a dedicated RFID tag to an external compartment.

p-0042The present invention rejects a ballot paper that is not certified by an assessor's signature key loaded in a dedicated RFID tag.

p-0043The present invention rejects a ballot paper that has already been blown, from the voting process, which indicates the non-integrity of the ongoing ballot paper.

p-0044The present invention uses a wireless tracking system by mixing both reading and writing a RFID tag in real time in concert with the stating of an on-tag fuse RFID tag, all of them implemented either on the surface or embedded in the substrate of a Ballot Support.

p-0045A first aspect, the present invention tracks ballots and performs method allowing strengthening of the audit integrity of a voting process by using the RFID technology.

p-0046RFID is suitable for high technology wireless electronic systems based on message identification. The wireless systems allow a readable machine to pick up messages stored on the tag device. The readable machine reads the notification message, identifies the device, and then performs an action which is indicated in the stored message.

p-0047The present invention is suitable for various countries where an election process in a jurisdiction occurs as well as in areas where cast and count is a necessity to legitimatize a vote.

p-0048Even if some solutions offer a wide variety of different RFID standards, an implemented embodiment of the present invention is motivated by the need to provide a high-quality voting system at low cost. This is accomplished through a voting system approach using passive RFID tags.

p-0049In an embodiment of the present invention, the disclosed RFID system uses RFID technology that is compatible with ISO standards, including but not limited to ISO14443, ISO15693, ISO 18000 series.

p-0050<figref idrefs="DRAWINGS">FIG. 1</figref> illustrates a schematic block diagram depicting the relationship between the elements for practicing embodiments of the present invention. A voting system (<b>100</b>) uses the RFID technology and its associated facilities are methodically implemented. The voting system (<b>100</b>) combines a Ballot Paper (<b>102</b>) and a Ballot Box (<b>104</b>) that work in concert with a Ballot counting and sorting Machine (<b>106</b>).

p-0051The Ballot Paper (<b>102</b>) contains confidential authentications that are stored in embedded electronic devices and interact directly with the Ballot Box (<b>104</b>). The Ballot Box (<b>104</b>) receives a Ballot Paper (<b>102</b>) that a voter rolls into for inspection. The Ballot Box (<b>104</b>) controls the authentication of the inserted Ballot Paper (<b>102</b>) by screening the electronic content previously encoded and confirms its authentication by generating a conformity electronic key and storing the generated conformity electronic key in an electronic device present in the Ballot Paper (<b>102</b>). The Ballot Box (<b>104</b>) rolls out the correct Ballot Papers (<b>102</b>). A series of Ballot Papers (<b>102</b>) are inserted into the Ballot counting and sorting Machine (<b>106</b>) to be checked before initiating a vote counting process. The Ballot counting and sorting Machine (<b>106</b>) verifies the authentication of the inserted Ballot Paper (<b>102</b>) by screening the electronic content previously encoded and initiates a vote sorting and counting process accordingly.

p-0052<figref idrefs="DRAWINGS">FIG. 2</figref> sets out full details of the Ballot Paper as represented in a voting system arrangement, in accordance with embodiments of the present invention.

p-0053The design layout of the Ballot Paper (<b>200</b>) is similar to a classic ballot paper. It provides a voter with clear printed instructions for facilitating the choice of candidates in a valid manner as well as symbols or/and candidate pictures and essential information that printed ballot papers should contain.

p-0054The difference resides in the inclusion of two electronic devices represented by a basic passive RFID tag (<b>202</b>) and a burnable passive RFID tag (<b>204</b>). The inclusion of such RFID tags (<b>202</b>, <b>204</b>) allows the Ballot Paper (<b>200</b>) to be safely authenticated and easily tracked all along the voting process. The RFID tags (<b>202</b>, <b>204</b>) can be implemented either on the surface or embedded in the substrate of a Ballot Support (<b>206</b>).

p-0055The electronic personalization of the Ballot Paper (<b>200</b>) is defined by its instruction set, which is encoded in the basic passive RFID tag (<b>202</b>), at a configuration step, when emitted by the jurisdiction. The basic passive RFID tag (<b>202</b>) works differently from the burnable passive RFID tag (<b>204</b>). The basic passive RFID tag (<b>202</b>) requires two data fields (<b>208</b>, <b>210</b>) both working in write once and read multiple modes.

p-0056The first data field (<b>208</b>) contains a jurisdiction's signature (<b>212</b>) that identifies a genuine versus counterfeited ballot paper. The jurisdiction's signature (<b>212</b>) is encrypted with a private key belonging to an emitting authority to be disclosed on the voting day. The emitting authority is associated with the jurisdiction.

p-0057The jurisdiction's signature (<b>212</b>) is generated and stored during the configuration of the Ballot Paper (<b>200</b>) and cannot be modified. The jurisdiction's signature (<b>212</b>) allows keeping track of the authentication integrity of the Ballot Paper (<b>200</b>) and thereby warrants that the voting processing operates in a secure protocol.

p-0058The second data field (<b>210</b>) stores an assessor's signature key that is composed of a hashing of the assessors individual secret keys (<b>214</b>). The assessor's signature key (<b>214</b>) is generated during the vote processing of the Ballot Paper (<b>200</b>). Like the first data field (<b>208</b>), the second data field (<b>210</b>) is unchangeable.

p-0059The assessor's signature key (<b>214</b>) is put on the second data field (<b>210</b>) after authenticating the Ballot Paper (<b>200</b>), once inserted in the Ballot Box. It is noted that the assessor's signature key (<b>214</b>) can concatenate different information that form a secure encrypted message, like an assessor identification, via a personal key, when validating the voter's act and/or a ballot number. Depending on the voting strategy, the assessor's signature key (<b>214</b>) can also contain a voter's voting choice, like the name of the candidate if the Ballot Paper has not been personalized yet.

p-0060In contrast with the basic passive RFID tag (<b>202</b>), the burnable passive RFID tag (<b>204</b>) includes an on-tag fusing facility and its associated electronic circuitry (<b>216</b>).

p-0061Such technique includes developing, implementing and manufacturing on-tag extra circuitry which is capable of handling a predefined action, if needed. An external fuse blowing system is required to set the on-tag fuse in any manner known in the art, (i.e. laser fuse blow, electrical fuse blow and so on). In one embodiment of the present invention, the burnable passive RFID tag is a chipless tag.

p-0062Once the on-tag fuse is blown, the internal circuitry of the burnable passive RFID tag (<b>204</b>) works differently than before and is capable to present other data to the RFID reader.

p-0063When initiating an election process, it is very important to protect the integrity of a Ballot Paper (<b>200</b>) and track any potential violation occurring during the voting cycle. To meet these requirements, the burnable passive RFID tag (<b>204</b>) has a hard-coded ballot paper identification (<b>218</b>) embedded in its data field (<b>220</b>).

p-0064The burnable passive RFID tag (<b>204</b>) operates in twofold.

p-0065Firstly, the non-blowing of the on-tag fuse (<b>216</b>) warrants the Ballot Paper (<b>200</b>) integrity including the confidentiality of the name of the candidate/party during the voting process until the final counting and sorting are initiated. The embedded hard-coded ballot paper identification (<b>218</b>) cannot be accessible by a RFID reader, a RFID tag cleaner/eraser, or an eavesdropping mechanism allowing undesirable rigging. The hard-coded ballot paper identification (<b>218</b>) hosts unchangeable data related to information on candidate/party, at least the party or candidate name or any other information that a skilled person in the art can easily imagine. Non-blowing on-tag fuse (<b>216</b>) preserves Ballot Paper (<b>200</b>) authenticity. A masking code (<b>222</b>) hides the content of the embedded hard-coded ballot paper identification (<b>218</b>) until the on-tag fuse (<b>216</b>) is intact.

p-0066Secondly, the blowing of the on-tag fuse (<b>216</b>) frees the hard-coded ballot paper identification (<b>218</b>) hosted in the RFID tag data field (<b>220</b>) that reveals the candidate/party information to be identified by the Ballot counting and sorting Machine (<b>106</b>). Blowing on-tag fuse (<b>216</b>) is irreversible and makes the Ballot Paper (<b>200</b>) unique and not reusable. An adequate mechanism (not shown here) reads, controls, and validates the hard-coded identification at the counting and sorting step.

p-0067<figref idrefs="DRAWINGS">FIG. 3</figref> describes details of the Ballot Box, in accordance with embodiments of the present invention. The Ballot Box (<b>300</b>) comprises a RFID Reader Module (<b>302</b>), an Authentication and Validation Checker (<b>304</b>), an Assessor Key Matrix (<b>306</b>), a Signature Key Generator (<b>308</b>), a Fuse Blowing Checker (<b>310</b>), a Decision Handler (<b>312</b>) and a Ballot Paper RFID tag Writer (<b>314</b>).

p-0068The process starts when a voter inserts a Ballot Paper (<b>102</b>) in the Ballot Box (<b>300</b>). It is to be noted that, alternatively, the Ballot Paper may be inserted first in an envelope to make the voter's act more confidential.

p-0069The RFID Reader Module (<b>302</b>) beams the inserted ballot paper, reads data from RFID tag registers, and transmits the inserted ballot paper beaming data to the Authentication and Validation Checker (<b>304</b>).

p-0070The Authentication and Validation Checker (<b>304</b>) receives the inserted ballot paper beaming data from the RFID Reader Module (<b>302</b>) and initiates an authentication procedure. Typically, the authentication procedure decrypts the jurisdiction's signature with a jurisdiction public key and compares the jurisdiction's decrypted signature to the jurisdiction's specific fixed number which is a jurisdiction code constant. The emitting authority discloses the jurisdiction's specific fixed number on the voting day. Both the jurisdiction's specific fixed number and the jurisdiction's public key are stored during the configuration of the Ballot Box.

p-0071The Authentication and Validation Checker (<b>304</b>) is coupled to the Assessor Key Matrix (<b>306</b>) and interfaces with the Decision Handler (<b>312</b>). The Decision Handler (<b>312</b>) receives data from the Signature Key Generator (<b>308</b>) and the Ballot Paper RFID tag Writer (<b>314</b>) and interacts with the Fuse Blowing Checker (<b>310</b>).

p-0072The Assessor Key Matrix (<b>306</b>) allows an assessor to enter the confidential jurisdiction code constant (i.e., the jurisdiction's specific fixed number) before starting the voting process. The jurisdiction delivers the confidential jurisdiction code constant. It is just valid for a day, like the current voting day, and cannot be modifiable by a third party.

p-0073The Authentication and Validation Checker (<b>304</b>) runs the jurisdiction's signature (<b>212</b>) located in the first data field (<b>208</b>) of the basic RFID tag (<b>202</b>) through its checker. Then, it compares the jurisdiction's signature with the confidential jurisdiction code constant previously entered by the assessor, starts authentication of a valid ballot paper, and sends the authentication result to the Decision Handler (<b>312</b>).

p-0074The Decision Handler (<b>312</b>) identifies the ballot paper that corresponds to a valid result and rejects the other ones to a bin (Bin) outside the ballot box.

p-0075To authenticate a voted ballot paper in regards to the jurisdiction, the identified ballot paper receives an assessor's signature key (<b>214</b>) from an assessor, via the Signature Key Generator (<b>308</b>).

p-0076The Signature Key Generator (<b>308</b>) inputs the assessor data entered by the use of the Assessor Key Matrix (<b>306</b>) and generates the assessor's signature key (<b>214</b>), authenticating the voted ballot paper, accordingly. Then, Ballot Paper RFID tag Writer (<b>314</b>) writes the signature key into the second data field (<b>210</b>) of the basic RFID tag (<b>202</b>).

p-0077There exist different possibilities for creating such signature key (<b>214</b>), including: either a removable keyboard for keying the encrypted key; a memory plug interface, like USB or memory or smartcard, for connecting a personal encrypted key module holding an individual code; or by using other electronic apparatus that a person who is skilled in the art can easily imagine.

p-0078Then the Decision Handler (<b>312</b>) transmits the voted ballot paper to the Fuse Blowing Checker (<b>310</b>). The Fuse Blowing Checker (<b>310</b>) checks that a voted ballot paper is still blank, meaning that the fuse is not blown. The Fuse Blowing Checker (<b>310</b>) operates by stating the non-blowing of the on-tag fuse of the burnable passive RFID tag (<b>204</b>) and by reading the information hosted in the RFID tag data field. The Fuse Blowing Checker (<b>310</b>) communicates results to the Decision Handler (<b>312</b>).

p-0079The Decision Handler (<b>312</b>) identifies the ballot paper that corresponds to a legitimate voted ballot paper and rejects the other ones to a bin (Bin) outside the ballot box. The legitimate voted ballot is output from the Ballot Box (<b>300</b>) to be counted and sorted by using the Ballot counting and sorting Machine (<b>106</b>). As mentioned above, the legitimate voted ballot paper is generally inserted in an envelope to make the voter's act confidential.

p-0080Referring now to <figref idrefs="DRAWINGS">FIG. 4</figref>, details of the “Ballot Counting and Sorting Machine” is described, in accordance with embodiments of the present invention. The “Ballot Counting and Sorting Machine” (<b>400</b>) comprises a RFID Reader Module (<b>402</b>), an Authentication and Validation Checker (<b>404</b>), an Assessor Key Matrix (<b>406</b>), a Fuse Blowing Checker (<b>408</b>), a Fuse Blowing Engine (<b>410</b>), a Decision Handler (<b>412</b>), and a counting-sorting mechanism (<b>414</b>).

p-0081The process starts when ballots to be counted, that were preliminarily checked and validated through the Ballot Box (<b>104</b>), are loaded into the Ballot Counting and Sorting Machine (<b>400</b>).

p-0082The RFID Reader Module (<b>402</b>) beams the loaded ballot paper (voted-ballot), reads data from RFID tag registers in the ballot paper, and transmits the loaded ballot paper beaming data to the Authentication and Validation Checker (<b>404</b>).

p-0083The Authentication and Validation Checker (<b>404</b>) receives the loaded ballot paper beaming data from the RFID Reader Module (<b>402</b>) and initiates an authentication procedure.

p-0084The authentication procedure decrypts the jurisdiction's signature with a jurisdiction public key and compares the jurisdiction's signature to a jurisdiction's specific fixed number (i.e., confidential jurisdiction code constant). The emitting authority discloses the jurisdiction's specific fixed number on the voting day.

p-0085The Authentication and Validation Checker (<b>404</b>) is coupled to the Assessor Key Matrix (<b>406</b>) and interfaces with the Decision Handler (<b>412</b>), the Fuse Blowing Checker (<b>408</b>) and the Fuse Blowing Engine (<b>410</b>).

p-0086The Decision Handler (<b>412</b>) interacts with the Fuse Blowing Checker (<b>408</b>), receives data from the Fuse Blowing Engine (<b>410</b>), and initiates the Counting-Sorting Mechanism (<b>414</b>).

p-0087An assessor enters both a confidential jurisdiction code constant and a confidential assessor code constant by the use of the Assessor Key Matrix (<b>406</b>). Both code constants allow the Ballot Counting and Sorting Machine (<b>400</b>) to be initialized, protected and locked during the current voting process.

p-0088The jurisdiction delivers the confidential code constants. They are just valid for a day, like the current voting day, and cannot be modified by a third party.

p-0089The Authentication and Validation Checker (<b>404</b>) works in twofold.

p-0090Firstly, it runs the jurisdiction's signature (<b>212</b>) located in the first data field (<b>208</b>) of the basic RFID tag (<b>202</b>) through its checker. Then, it compares the jurisdiction's signature with the confidential jurisdiction code constant, starts authentication of voted ballot paper and sends the authentication result to the Decision Handler (<b>412</b>).

p-0091Secondly, it runs the assessor's signature key (<b>214</b>) located in the second data field (<b>210</b>) of the basic RFID tag (<b>202</b>) through its checker. Then, it compares the assessor's signature key with the confidential assessor code constant, which starts authentication of voted ballot paper and sends result to the Decision Handler (<b>412</b>).

p-0092It is aforementioned here, that both the confidential jurisdiction code constant and the confidential assessor code constant are inputs that the assessor pre-sets before the process starts.

p-0093The Decision Handler (<b>412</b>) authenticates the voted ballot papers that correspond to a valid result, transmits the valid ballots to the Fuse Blowing Checker (<b>408</b>) and rejects the other ballots to a bin (Bin) outside the Ballot Counting and Sorting Machine (<b>400</b>).

p-0094The Fuse Blowing Checker (<b>408</b>) checks that a voted ballot paper is still blank. The Fuse Blowing Checker (<b>408</b>) operates by stating the non-blowing of the on-tag fuse of the burnable passive RFID tag (<b>204</b>) and by reading the information hosted in the RFID tag data field. The Fuse Blowing Checker (<b>408</b>) communicates results to the Decision Handler (<b>412</b>).

p-0095The Decision Handler (<b>412</b>) authenticates the voted ballot papers that are still blank, transmits the blank ballots to the Fuse Blowing Engine (<b>410</b>) and rejects the other ballots to a bin outside the Ballot Counting and Sorting Machine (<b>400</b>).

p-0096The Fuse Blowing Engine (<b>410</b>) receives the authenticated voted ballot paper and starts an on-tag fuse blowing operation of the burnable passive RFID tag (<b>204</b>).

p-0097The on-tag fuse blowing operation is irreversible and frees the hard-coded identification hosted in the RFID tag field that reveals the candidate/party information. Thus the on-tag fuse blowing operation enables the voted ballot paper to be read by the Ballot counting and sorting Machine (<b>400</b>). Methods and systems to blow such on-tag fuses are well known in the art and will not be further described.

p-0098The authentication of the voted ballot papers is complete and the Decision Handler (<b>412</b>) enables the Counting-Sorting Mechanism (<b>414</b>) to initiate the counting and sorting process. The Counting-Sorting Mechanism (<b>414</b>) reads the voted ballot papers, counts the voted ballot papers, and directs the envelopes containing a voted ballot paper to the pertinent candidate box.

p-0099<figref idrefs="DRAWINGS">FIG. 5</figref> is a flow chart of the Ballot Box process when a voter inserts a Ballot Paper to be authenticated by the Ballot Box, in accordance with embodiments of the present invention.

p-0100Before the Ballot Box process starts (<b>500</b>) a ballot paper configuration is required in which an acquisition of the jurisdiction's parameters belonging to the election are to be entered in step <b>502</b>.

p-0101After completion of the Ballot Box process in step <b>520</b>, the process enters the Ballot Sorting and Counting Machine process described infra with reference to <figref idrefs="DRAWINGS">FIG. 6</figref>.

p-0102Step <b>502</b> (Ballot Paper Configuration): Jurisdiction configures a blank ballot paper. Design layout and RFID tag electronic personalization of the ballot paper is defined. Jurisdiction's signature is hard-coded in the dedicated field of the basic RFID tag. On-tag fuse of the burnable RFID tag is intact. Then, the process goes to step <b>504</b>.

p-0103Step <b>504</b> (Ballot Box initialization): Assessor enters the Jurisdiction's specific fixed number, as well as the jurisdiction's public key by the use of the Assessor Key Matrix (<b>306</b>). Then, the process goes to step <b>506</b>.

p-0104Step <b>506</b> (Ballot Paper Screening): Voter inserts a ballot paper in the ballot box. The RFID Reader Module (<b>302</b>) beams the inserted ballot paper (ballot-Paper), reads the ballot paper beaming data from RFID tag registers and transmits the ballot paper beaming data to the Authentication and Validation Checker (<b>304</b>). Then, the process goes to step <b>508</b>.

p-0105Step <b>508</b> (Ballot Paper authentication): The Authentication and Validation Checker (<b>304</b>) runs the jurisdiction's public/private signature (<b>212</b>) located in the first data field (<b>208</b>) of the basic RFID tag (<b>202</b>) through its checker. Then, it compares the jurisdiction's signature with the confidential jurisdiction code constant previously entered by the assessor at step <b>504</b>, starts authentication of a valid ballot paper and sends result to the Decision Handler (<b>312</b>). Then the process goes to step <b>510</b>.

p-0106In step <b>510</b>, a status is made to check the integrity of the voted ballot paper. The Decision Handler (<b>312</b>) checks the result delivered by the checker computation at step <b>508</b>. If the result is valid then the corresponding ballot paper is valid and the process goes to step <b>514</b>; otherwise the ballot paper is not valid and the process goes to step <b>512</b>.

p-0107Step <b>512</b> (Ballot paper rejection): Ballot paper is not valid and is rejected by the Decision Handler (<b>312</b>). The rejected ballot paper rolls out to a bin outside the ballot box. Then the process loops back to step <b>506</b>.

p-0108Step <b>514</b> (Assessor voted ballot authentication): Assessor enters the Assessor's signature key by the use of the Assessor Key Matrix (<b>306</b>) that initiates the Signature Key Generator (<b>308</b>). A signature key is generated accordingly. Then, the process goes to step <b>516</b>.

p-0109Step <b>516</b> (Writing assessor key to RFID tag): Assessor validates the voted ballot paper that enables the Ballot Paper RFID tag Writer (<b>314</b>) for writing the computed signature key into the second data field (<b>210</b>) of the basic RFID tag (<b>202</b>). Then the process goes to step <b>518</b>.

p-0110In step <b>518</b>, a status is made to check that the voted ballot paper is blank. The Fuse Blowing Checker (<b>310</b>) receives the voted ballot paper and states the on-tag fuse of the burnable passive RFID tag (<b>204</b>). If the Fuse Blowing Checker (<b>310</b>) detects a non-blowing of the on-tag fuse then the voted ballot paper is valid and the process goes to step <b>520</b>; otherwise the voted ballot paper is not blank and the process goes to step <b>512</b>.

p-0111Step <b>520</b> (Ballot Box process completion): The success of the jurisdiction's private/public key identification, the non-blowing of the on-tag fuse, and the insertion of the assessor's private/public key certification into the RFID tag authenticate the integrity of the inserted ballot paper. The voted ballot paper is output from the Ballot Box (<b>300</b>) to be counted and sorted by using the Ballot Counting and Sorting Machine (<b>106</b>). The Ballot Box process is complete then the process loops back to step <b>506</b> for authenticating the next ballot paper that a voter inserts in the Ballot Box (<b>300</b>).

p-0112<figref idrefs="DRAWINGS">FIG. 6</figref> is a flow chart of the Ballot Sorting and Counting Machine process (<b>600</b>) when voted ballot papers that were preliminarily checked and validated through the Ballot Box process are loaded into the Ballot Counting and Sorting Machine, in accordance with embodiments of the present invention.

p-0113Step <b>602</b> (Voted ballot counting-sorting machine initialization): Assessor enters the Jurisdiction's specific fixed number, as well as the jurisdiction's public key by the use of the Assessor Key Matrix (<b>406</b>). Then, the process goes to step <b>604</b>.

p-0114Step <b>604</b> (Voted Ballot Paper Screening): Ballots to be counted, that were preliminarily checked and validated through the Ballot Box (<b>104</b>) are loaded into the Ballot Counting and Sorting Machine (<b>400</b>). The RFID Reader Module (<b>402</b>) beams the loaded ballot paper, reads ballot paper beaming data from all RFID tag registers and transmits the ballot paper beaming data to the Authentication and Validation Checker (<b>404</b>). Then, the process goes to step <b>606</b>.

p-0115Step <b>606</b> (Voted Ballot Paper authentication): The Authentication and Validation Checker (<b>404</b>) runs the jurisdiction's public/private signature (<b>212</b>) located in the first data field (<b>208</b>) of the basic RFID tag (<b>202</b>) through its checker. In addition, it runs the assessor's signature key (<b>214</b>) located in the second data field (<b>210</b>) of the basic RFID tag (<b>202</b>) through its checker. Then, it compares the jurisdiction's signature and the assessor's signature key with the confidential jurisdiction code constant and the confidential assessor code constant, respectively, which starts authentication of voted ballot paper and sends result to the Decision Handler (<b>412</b>). Then the process goes to step <b>608</b>.

p-0116In step <b>608</b>, a status is made to check the integrity of the voted ballot paper. The Decision Handler (<b>412</b>) checks the result delivered by the checker computation at step <b>606</b>. If the check results are valid then the corresponding ballot paper is valid and the process goes to step <b>612</b>; otherwise the ballot paper is not valid and the process goes to step <b>610</b>.

p-0117Step <b>610</b> (Voted Ballot paper rejection): Voted ballot paper is not valid and is rejected by the Decision Handler (<b>412</b>). The rejected voted ballot paper rolls out to a bin outside the Ballot Counting and Sorting Machine (<b>400</b>). Then the process loops back to step <b>604</b>.

p-0118In step <b>612</b>, a status is made to check that the voted ballot paper is blank. The Fuse Blowing Checker (<b>408</b>) receives the voted ballot paper and states the on-tag fuse of the burnable passive RFID tag (<b>204</b>). If the Fuse Blowing Checker (<b>408</b>) detects a non-blowing of the on-tag fuse then the voted ballot paper is valid and the process goes to step <b>614</b>; otherwise the voted ballot paper is not blank and the process goes to step <b>610</b>.

p-0119Step <b>614</b> (Unlocking Voted ballot paper): The Fuse Blowing Engine (<b>410</b>) initiates the on-tag fuse blowing operation of the burnable passive RFID tag (<b>204</b>). This operation frees the hard-coded identification hosted in the RFID tag field that reveals the candidate/party