Security Analysis of Electronic Exams Rosario Giustolisi 4 , Ali - - PowerPoint PPT Presentation

security analysis of electronic exams
SMART_READER_LITE
LIVE PREVIEW

Security Analysis of Electronic Exams Rosario Giustolisi 4 , Ali - - PowerPoint PPT Presentation

Security Analysis of Electronic Exams Rosario Giustolisi 4 , Ali Kassem 1 , Gabriele Lenzini 4 , Peter Y. A. Ryan 4 , Jannik Dreier 3 , Ylis Falcone 2 and Pascal Lafourcade 5 1 Univ. Grenoble Alpes, VERIMAG, Grenoble, France 2 Univ. Grenoble


slide-1
SLIDE 1

Security Analysis of Electronic Exams

Rosario Giustolisi4, Ali Kassem1, Gabriele Lenzini4, Peter Y. A. Ryan4, Jannik Dreier3, Yliès Falcone2 and Pascal Lafourcade5

  • 1Univ. Grenoble Alpes, VERIMAG, Grenoble, France
  • 2Univ. Grenoble Alpes, Inria, LIG, Grenoble

3Loria, Equipe Cassis, Inria, Nancy 4SnT/University of Luxembourg 5University Clermont Auvergne, LIMOS

Eurecom, 25th February 2016

1 / 68

slide-2
SLIDE 2

Exam

Filippo Galanti (Sora in Caserta 1852 - Buenos Aires 1953) 2 / 68

slide-3
SLIDE 3

Traditional Exam

3 / 68

slide-4
SLIDE 4

e-exam

Information technology for the assessment of knowledge and skills.

4 / 68

slide-5
SLIDE 5

Reality

5 / 68

slide-6
SLIDE 6
  • Threats. . .

◮ Candidate cheating ◮ Bribed, corrupted or unfair examiners ◮ Outside attackers ◮ . . .

6 / 68

slide-7
SLIDE 7

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

7 / 68

slide-8
SLIDE 8

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ Turkish Public Personnel Selection Exam (2010) ◮ UK student visa tests fraud (2014)

7 / 68

slide-9
SLIDE 9

. . . and their Mitigation

Most existing e-exam systems assume trusted authorities and focus on student cheating:

◮ Exam centers ◮ Software solutions, e.g. ProctorU

Yet also the other threats are real:

◮ Atlanta Public Schools cheating scandal (2009) ◮ Turkish Public Personnel Selection Exam (2010) ◮ UK student visa tests fraud (2014)

So what about security of e-exams?

7 / 68

slide-10
SLIDE 10

Our Results

Secrypt’14 Authentication Properties: Mark Authenticity, Answer Origin Authentication, Form Authorship, Form Authenticity. Privacy Properties: Anonymous Marking, Question Indistinguishability, Anonymous Examiner, Mark Privacy, Mark Anonymity ISPEC’15 Individual Verifiability: Question Validity, Marking Correctness, Exam-Test Integrity, Exam-Test Markedness, Marking Integrity, Marking Notification Integrity Universal Verifiability: Eligibility (Registration), Marking Correctness Exam-Test Integrity, Exam-Test Markedness, Marking Integrity. RV’15 How can we use previous results on real e-exam? Monitoring of reals e-exams.

8 / 68

slide-11
SLIDE 11

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

9 / 68

slide-12
SLIDE 12

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

10 / 68

slide-13
SLIDE 13

E-exam: Players and Organization

Three Roles: Candidate Examination Authority Examiner

11 / 68

slide-14
SLIDE 14

E-exam: Players and Organization

Three Roles: Candidate Examination Authority Examiner Four Phases:

  • 1. Registration
  • 2. Examination
  • 3. Marking
  • 4. Notification

11 / 68

slide-15
SLIDE 15

Model

◮ Processes in the applied π-calculus [AF01] ◮ Annotated using events ◮ Authentication properties as correspondence between

events

◮ Privacy properties as observational equivalence between

instances

◮ Automatic verification using ProVerif [Bla01]

12 / 68

slide-16
SLIDE 16

Model

slide-17
SLIDE 17

Model

  • 1. Registration
slide-18
SLIDE 18

Model

  • 1. Registration

register( )

Register

slide-19
SLIDE 19

Model

  • 1. Registration

register( )

Register

  • 2. Examination
slide-20
SLIDE 20

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

slide-21
SLIDE 21

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

slide-22
SLIDE 22

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking
slide-23
SLIDE 23

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

slide-24
SLIDE 24

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

mark( , , , )

Mark

slide-25
SLIDE 25

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

mark( , , , )

Mark

  • 4. Notification
slide-26
SLIDE 26

Model

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

mark( , , , )

Mark

  • 4. Notification

notified( , )

Mark

13 / 68

slide-27
SLIDE 27

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

14 / 68

slide-28
SLIDE 28

Answer Origin Authentication

All collected answers originate from registered candidates, and only one answer per candidate is accepted. Definition: On every trace:

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer preceeded by distinct occurence

15 / 68

slide-29
SLIDE 29

Form Authorship

Answers are collected as submitted, i.e. without modification. Definition: On every trace:

  • 1. Registration

register( )

Register

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer preceeded by distinct occurence

16 / 68

slide-30
SLIDE 30

Form Authenticity

Answers are marked as collected. Definition: On every trace:

  • 2. Examination

Questions

submit( , , ) accept( , , )

Answer

  • 3. Marking

distrib( , , , , )

Form

mark( , , , )

Mark preceeded by dist. occ.

17 / 68

slide-31
SLIDE 31

Mark Authenticity

The candidate is notified with the mark associated to his answer. Definition: On every trace:

  • 3. Marking

distrib( , , , , )

Form

mark( , , , )

Mark

  • 4. Notification

notified( , )

Mark preceeded by distinct occurence

18 / 68

slide-32
SLIDE 32

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

19 / 68

slide-33
SLIDE 33

Question Indistinguishability

No premature information about the questions is leaked. Definition: Observational equivalence of two instances up to the end of registration phase: Exam 1 Exam 2 Question 1 Question 2 ≈l

20 / 68

slide-34
SLIDE 34

Question Indistinguishability

No premature information about the questions is leaked. Definition: Observational equivalence of two instances up to the end of registration phase: Exam 1 Exam 2 Question 1 Question 2 ≈l Can be considered with or without dishonest candidates.

20 / 68

slide-35
SLIDE 35

Anonymous Marking

An examiner cannot link an answer to a candidate. Definition: Up to the end of marking phase: Exam 1 Exam 2 Answer 1 Answer 2 ≈l Answer 2 Answer 1

21 / 68

slide-36
SLIDE 36

Anonymous Marking

An examiner cannot link an answer to a candidate. Definition: Up to the end of marking phase: Exam 1 Exam 2 Answer 1 Answer 2 ≈l Answer 2 Answer 1 Can be considered with or without dishonest examiners and authorities.

21 / 68

slide-37
SLIDE 37

Anonymous Examiner

A candidate cannot know which examiner graded his copy. Definition: Exam 1 Exam 2 Answer 1 Answer 2 Mark 1 Mark 2 ≈l Answer 2 Answer 1 Mark 2 Mark 1 Can be considered with or without dishonest candidates.

22 / 68

slide-38
SLIDE 38

Mark Privacy

Marks are private. Definition: Exam 1 Exam 2 Answer 1 Mark 1 ≈l Answer 1 Mark 2 Can be considered with or without dishonest candidates, examiners and authorities.

23 / 68

slide-39
SLIDE 39

Mark Anonymity

Marks can be published, but may not be linked to candidates. Definition: Exam 1 Exam 2 Answer 1 Answer 2 Mark 1 Mark 2 ≈l Answer 1 Answer 2 Mark 2 Mark 1 Can be considered with or without dishonest candidates, examiners and authorities. Implied by Mark Privacy.

24 / 68

slide-40
SLIDE 40

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

25 / 68

slide-41
SLIDE 41

Application: Huszti & Pethő’s Protocol

“A Secure Electronic Exam System” [HP10] using

◮ ElGamal Encryption ◮ a Reusable Anonymous Return Channel (RARC) [GJ03] for

anonymous communication

◮ a network of servers providing a timed-release service using

Shamir’s Secret Sharing: A subset of servers can combine their shares to de-anonymize a candidate after the exam Goal: ensure

◮ authentication and privacy

in presence of dishonest

◮ candidates ◮ examiners ◮ exam authorities

26 / 68

slide-42
SLIDE 42

Results

Formal Verification with ProVerif [Bla01]: Property Result Time Answer Origin Authentication × < 1 s Form Authorship × < 1 s Form Authenticity × < 1 s Mark Authenticity × < 1 s Question Indistinguishability × < 1 s Anonymous Marking × 8 m 46 s Anonymous Examiner × 9 m 8 s Mark Privacy × 39 m 8 s Mark Anonymity × 1h 15 m 58 s

27 / 68

slide-43
SLIDE 43

Main reason

Given its security definition, the RARC

◮ provides anonymity, but not necessarily secrecy ◮ does not necessarily provide integrity or authentication ◮ is only secure against passive attackers

Corrupted parties or active attackers can break secrecy and anonymity, as the following attack shows.

28 / 68

slide-44
SLIDE 44

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

29 / 68

slide-45
SLIDE 45

Application: Remark! Protocol

A recent protocol [GLR14] using

◮ ElGamal encryption ◮ an exponentiation mixnet [HS11] to create pseudonyms

based on the parties’ public keys ⇒ allows to encrypt and sign anonymously

◮ a public append-only bulletin board

Goal: ensure

◮ authentication and integrity ◮ privacy ◮ verifiability

in presence of dishonest

◮ candidates ◮ examiners ◮ exam authorities

30 / 68

slide-46
SLIDE 46

Results

Formal Verification with ProVerif: Property Result Time Answer Origin Authentication

  • < 1 s

Form Authorship

  • < 1 s

Form Authenticity 1 < 1 s Mark Authenticity

  • < 1 s

Question Indistinguishability

  • < 1 s

Anonymous Marking

  • 2 s

Anonymous Examiner

  • 1 s

Mark Privacy

  • 3 m 32 s

Mark Anonymity

  • 2

1after fix 2implied by Mark Privacy 31 / 68

slide-47
SLIDE 47

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

32 / 68

slide-48
SLIDE 48

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

33 / 68

slide-49
SLIDE 49

Exam model

Very abstract model:

◮ Four sets:

◮ {

}: candidate identities, subset { }r registered candidates

◮ {

}: questions, subset { }g correct questions

◮ {

}: answers

◮ {

}: marks

◮ Three relations:

◮ Accepted ⊆ {

} × ({ } × { })

◮ Marked ⊆ {

} × ({ } × { }) × { }

◮ Assigned ⊆ {

} × { }

◮ A function Correct : ({

} × { }) → { }

◮ An exam protocol is X-verifiable, if we have a sound and

complete test for X.

34 / 68

slide-50
SLIDE 50

Defining Individual Verifiability

Each candidate knows

◮ her identity

,

◮ question

,

◮ answer

,

◮ mark

,

◮ and a log

. Properties: The candidate can verify that...

◮ Question Validity: ...she received questions generated by the

question committee QVIV( , , , , ) ⇔( ∈ { }g)

35 / 68

slide-51
SLIDE 51

Defining Individual Verifiability

Each candidate knows

◮ her identity

,

◮ question

,

◮ answer

,

◮ mark

,

◮ and a log

. Properties: The candidate can verify that...

◮ Question Validity: ...she received questions generated by the

question committee QVIV( , , , , ) ⇔( ∈ { }g)

sound & complete

35 / 68

slide-52
SLIDE 52

Defining Individual Verifiability Cont’d

The candidate can verify that...

◮ Marking Correctness: ...the mark attributed to her answer is

correct. MCIV( , , , , ) ⇔ (Correct( , ) = )

◮ Exam-Test Integrity: ...her answer was accepted and marked

as submitted. ETIIV( , , , , ) ⇔

  • (

, ( , )) ∈ Accepted ∧ ∃m′ : ( , ( , ), m′) ∈ Marked

  • ◮ Exam-Test Markedness: ...her answer was marked.

ETMIV( , , , , ) ⇔ (∃m′ : ( , ( , ), m′) ∈ Marked))

36 / 68

slide-53
SLIDE 53

Defining Individual Verifiability Cont’d

The candidate can verify that...

◮ Marking Integrity: ...her registered mark is the one assigned by

the examiner MIIV( , , , , ) ⇔ ∃m′ :

  • (

, ( , ), m′) ∈ Marked ∧ ( , m′) ∈ Assigned

  • ◮ Marking Notification Integrity: ...she received the assigned

mark MNIIV( , , , , ) ⇔ ( , ) ∈ Assigned

37 / 68

slide-54
SLIDE 54

Universal Verifiability

An outside auditor only has access to some evidence . The auditor can verify that... Properties:

◮ Registration: ...all the accepted answers were submitted by

registered candidates. RUV( ) ⇔ { }r ⊇ i : (i, x) ∈ Accepted

◮ Marking Correctness: ...all the marks were calculated correctly.

MCUV( ) ⇔ ∀(i, x, m) ∈ Marked, Correct(x) = m

38 / 68

slide-55
SLIDE 55

Universal Verifiability Cont’d

The auditor can verify that...

◮ Exam-Test Integrity: ...all and only accepted test answers

were marked. ETIUV( ) ⇔ Accepted = (i, x) : (i, x, m) ∈ Marked

◮ Exam-Test Markedness: ...all accepted test answers were

marked. ETMUV( ) ⇔ Accepted ⊆ (i, x) : (i, x, m) ∈ Marked

◮ Marking Integrity: ...all and only the marks assigned to test

answers were registered. MIUV( ) ⇔ Assigned = (i, m) : (i, x, m) ∈ Marked

39 / 68

slide-56
SLIDE 56

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

40 / 68

slide-57
SLIDE 57

Case Study I: Grenoble Exam

◮ Paper-based exam system at the University Joseph Fourier ◮ Goal: Privacy (Anonymous Marking) ◮ Special exam paper with corner that is folded and glued:

41 / 68

slide-58
SLIDE 58

Case Study I: Grenoble Exam

◮ Paper-based exam system at the University Joseph Fourier ◮ Goal: Privacy (Anonymous Marking) ◮ Special exam paper with corner that is folded and glued:

41 / 68

slide-59
SLIDE 59

Grenoble Exam: Results

Individual Verifiability:

◮ Input: the candidate’s values ◮ Assumptions: Correct is published after the exam, and

candidates can consult their copies

◮ Verification using ProVerif:

Property Sound Complete Question Validity × (EA)

  • Test Answer Integrity

× (EA, E)

  • Test Answer Markedness

× (E)

  • Marking Correctness
  • Mark Integrity

× (EA, E)

  • Mark Notification Integrity

× (EA)

  • ◮ No guarantee that the records are correct.

42 / 68

slide-60
SLIDE 60

Grenoble Exam: Results Cont’d

Universal Verifiability:

◮ Assumption: the auditor gets access to the EA’s and Es’

records and the function Correct.

◮ Verification using ProVerif:

Property Sound Complete Registration × (EA)

  • Exam-Test Integrity

× (EA, E)

  • Exam-Test Markedness

× (EA, E)

  • Marking Correctness

× (E)

  • Mark Integrity

× (EA, E)

  • ◮ No guarantee that the records are correct, EA and E can make

up fake records as long as they are coherent.

43 / 68

slide-61
SLIDE 61

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

44 / 68

slide-62
SLIDE 62

Remark!: Results

Individual Verifiability:

◮ Input: the candidate’s values and the messages on the bulletin

board

◮ Assumption: Correct is published after the exam ◮ Verification using ProVerif:

Property Sound Complete Question Validity × (EA)

  • Test Answer Integrity
  • Test Answer Markedness
  • Marking Correctness

× (EA)

  • Mark Integrity
  • Mark Notification Integrity
  • 45 / 68
slide-63
SLIDE 63

Remark!: Results Cont’d

Universal Verifiability:

◮ Input: the messages on the bulletin board, the function

Correct, as well as additional data from the EA

◮ Verification using ProVerif:

Property Sound Complete Registration

  • Exam-Test Integrity
  • Exam-Test Markedness
  • Marking Correctness

× (EA)

  • Mark Integrity
  • 46 / 68
slide-64
SLIDE 64

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

47 / 68

slide-65
SLIDE 65

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

48 / 68

slide-66
SLIDE 66

Event Based Model

slide-67
SLIDE 67

Event Based Model

  • 1. Registration
slide-68
SLIDE 68

Event Based Model

  • 1. Registration

register( )

Register

slide-69
SLIDE 69

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination
slide-70
SLIDE 70

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination

begin( )

slide-71
SLIDE 71

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination

begin( ) get( , )

Question

slide-72
SLIDE 72

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination

begin( ) get( , )

Question

change( , , )

slide-73
SLIDE 73

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination

begin( ) get( , )

Question

change( , , ) submit( , , ) accept( , , )

Answer

slide-74
SLIDE 74

Event Based Model

  • 1. Registration

register( )

Register

  • 2. Examination

begin( ) get( , )

Question

change( , , ) submit( , , ) accept( , , )

Answer

end( )

49 / 68

slide-75
SLIDE 75

Event Based Model

  • 3. Marking
slide-76
SLIDE 76

Event Based Model

  • 3. Marking

corr( , )

Correct Answer

slide-77
SLIDE 77

Event Based Model

  • 3. Marking

corr( , )

Correct Answer

mark( , , , )

Evaluation

slide-78
SLIDE 78

Event Based Model

  • 3. Marking

corr( , )

Correct Answer

mark( , , , )

Evaluation

  • 4. Notification
slide-79
SLIDE 79

Event Based Model

  • 3. Marking

corr( , )

Correct Answer

mark( , , , )

Evaluation

  • 4. Notification

assign( , )

Mark

50 / 68

slide-80
SLIDE 80

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

51 / 68

slide-81
SLIDE 81

Quantified Event Automata (QEAs)

◮ Properties expressed as QEAs: event automaton with

quantified variables.

◮ An event automaton is a finite-state machine with

transitions labeled by parametric events.

◮ Transitions may include guards and assignments. ◮ We extend the initial definition of QEAs by:

  • 1. variable declaration and initialization before reading the trace
  • 2. global variable shared among all event automaton instances.

◮ event(parameters)

[guard] assignment

52 / 68

slide-82
SLIDE 82

Candidate Eligibility

No answer is accepted from an unregistered candidate ∀i 1 2 register(i) Σ = {register(i), accept(i, q, a)}

slide-83
SLIDE 83

Candidate Eligibility

No answer is accepted from an unregistered candidate ∀i 1 2 register(i) Σ = {register(i), accept(i, q, a)} Σ 3 accept(i, q, a)

53 / 68

slide-84
SLIDE 84

Candidate Eligibility with Auditing

All candidates that violates the requirement are collected in a set F. Initially: I : ˆ = ∅ 1 2 register(i) I:=I∪{i} accept(i, q, a)

[i / ∈I] F:ˆ ={i}

register(i) I:=I∪{i} accept(i, q, a)

[i / ∈I] F:=F∪{i}

54 / 68

slide-85
SLIDE 85

Properties

Candidate Registration: an unregistered candidate tried to take the exam.

55 / 68

slide-86
SLIDE 86

Properties

Candidate Registration: an unregistered candidate tried to take the exam. Answer Authentication:

◮ an unsubmitted answer was considered as accepted; or ◮ more than one answer were accepted from a candidate.

55 / 68

slide-87
SLIDE 87

Properties

Candidate Registration: an unregistered candidate tried to take the exam. Answer Authentication:

◮ an unsubmitted answer was considered as accepted; or ◮ more than one answer were accepted from a candidate.

Questions Ordering:

◮ a candidate got a question before validating the previous ones.

55 / 68

slide-88
SLIDE 88

Properties (continued)

Exam Availability: an answer was accepted outside exam time.

56 / 68

slide-89
SLIDE 89

Properties (continued)

Exam Availability: an answer was accepted outside exam time. Exam Availability with Flexibility:

◮ supports different duration and starting time between

candidates.

56 / 68

slide-90
SLIDE 90

Properties (continued)

Exam Availability: an answer was accepted outside exam time. Exam Availability with Flexibility:

◮ supports different duration and starting time between

candidates. Marking Correctness: an answer was marked in a wrong way.

56 / 68

slide-91
SLIDE 91

Properties (continued)

Exam Availability: an answer was accepted outside exam time. Exam Availability with Flexibility:

◮ supports different duration and starting time between

candidates. Marking Correctness: an answer was marked in a wrong way. Mark Integrity:

◮ an accepted answer was not marked; or ◮ a candidate was not assigned the corresponding mark.

56 / 68

slide-92
SLIDE 92

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

57 / 68

slide-93
SLIDE 93

E-exam at Université Joseph Fourier (UJF)

Registration:

◮ 2 weeks before the exam. ◮ Using login/password.

58 / 68

slide-94
SLIDE 94

E-exam at Université Joseph Fourier (UJF)

Examination in a supervised room Authentication and answers questions as follows:

◮ In a fixed order. ◮ Once validates the current question, he gets the next one. ◮ He can change the answer unlimited times before validating. ◮ Once he validates, then he cannot go back and change any of

the validated answers.

59 / 68

slide-95
SLIDE 95

E-exam at Université Joseph Fourier (UJF)

Marking:

◮ For each question, the professor specifies the correct answer(s). ◮ For each question, all the answers provided by the candidates

are collected.

◮ Each answer is evaluated by an examiner to 0 or 1. ◮ The mark for each candidate is calculated as the summation of

all the scores attributed to his answers. Notification:

◮ The marks are notified to the candidates. ◮ A candidate can consult his submission and check the marking.

60 / 68

slide-96
SLIDE 96

Analysis

Verification of two real e-exam executions using MarQ tool [RCR15]. From the logs: register(i), change(i, q, a), submit(i, q, a), accept(i, q, a).

4 Properties

◮ Candidate Registration ◮ Candidate Eligibility ◮ Answer Authentication ◮ Exam Availability

61 / 68

slide-97
SLIDE 97

5 new properties

◮ Answer Authentication ∗:

◮ All accepted answers are submitted by candidates. ◮ Allow the acceptance of the same answer again. ◮ But, still forbids the acceptance of a different answer. 62 / 68

slide-98
SLIDE 98

5 new properties

◮ Answer Authentication ∗:

◮ All accepted answers are submitted by candidates. ◮ Allow the acceptance of the same answer again. ◮ But, still forbids the acceptance of a different answer.

◮ Answer Authentication Reporting: Collects in a set F every

candidate from which more than one answer are accepted.

62 / 68

slide-99
SLIDE 99

5 new properties

◮ Answer Authentication ∗:

◮ All accepted answers are submitted by candidates. ◮ Allow the acceptance of the same answer again. ◮ But, still forbids the acceptance of a different answer.

◮ Answer Authentication Reporting: Collects in a set F every

candidate from which more than one answer are accepted.

◮ Answer Editing: A candidate cannot change an answer after

validation it.

62 / 68

slide-100
SLIDE 100

5 new properties

◮ Answer Authentication ∗:

◮ All accepted answers are submitted by candidates. ◮ Allow the acceptance of the same answer again. ◮ But, still forbids the acceptance of a different answer.

◮ Answer Authentication Reporting: Collects in a set F every

candidate from which more than one answer are accepted.

◮ Answer Editing: A candidate cannot change an answer after

validation it.

◮ Question Ordering ∗: A candidate cannot changes the answer

to a future question before validating the current question.

62 / 68

slide-101
SLIDE 101

5 new properties

◮ Answer Authentication ∗:

◮ All accepted answers are submitted by candidates. ◮ Allow the acceptance of the same answer again. ◮ But, still forbids the acceptance of a different answer.

◮ Answer Authentication Reporting: Collects in a set F every

candidate from which more than one answer are accepted.

◮ Answer Editing: A candidate cannot change an answer after

validation it.

◮ Question Ordering ∗: A candidate cannot changes the answer

to a future question before validating the current question.

◮ Acceptance Order: A candidate has to validate the questions

in order, but he can skip some questions.

62 / 68

slide-102
SLIDE 102

Results: Exam 1

233 students, 40875 events Property Result Time (ms) Candidate Registration

  • 538

Candidate Eligibility

  • 517

Answer Authentication × 310 Exam Availability

  • 518

Answer Authentication ∗

  • 742

Answer Authentication Reporting ×[1] 654 Answer Editing

  • 641

Question Ordering ∗ × 757 Acceptance Order

  • 697

63 / 68

slide-103
SLIDE 103

Results: Exam 2

90 students, 4641 events Property Result Time (ms) Candidate Registration

  • 230

Candidate Eligibility

  • 214

Answer Authentication

  • 275

Exam Availability ×[1] 237 Answer Authentication ∗

  • 223

Answer Authentication Reporting

  • 265

Answer Editing × 218 Question Ordering ∗ × 389 Acceptance Order

  • 294

64 / 68

slide-104
SLIDE 104

Plan

Introduction Security Authentication Properties Privacy Properties Huszti & Pethő’s Protocol Remark! Protocol Verifiability Model Grenoble Exam Remark! Protocol Monitoring Model Properties Case Study: UJF E-exam Conclusion

65 / 68

slide-105
SLIDE 105

Conclusion

◮ Formal model for security and verifiability ◮ Security Analysis of 2 e-exams and one “real” exam ◮ Trust parties are required for verifiability ◮ Monitoring analysis of 2 real e-exams at UJF using MarQ tool ◮ Discovering some misbehaviours and flaws

66 / 68

slide-106
SLIDE 106

Conclusion

◮ Formal model for security and verifiability ◮ Security Analysis of 2 e-exams and one “real” exam ◮ Trust parties are required for verifiability ◮ Monitoring analysis of 2 real e-exams at UJF using MarQ tool ◮ Discovering some misbehaviours and flaws

Designing secure protocols is difficult

66 / 68

slide-107
SLIDE 107

Conclusion

◮ Formal model for security and verifiability ◮ Security Analysis of 2 e-exams and one “real” exam ◮ Trust parties are required for verifiability ◮ Monitoring analysis of 2 real e-exams at UJF using MarQ tool ◮ Discovering some misbehaviours and flaws

Designing secure protocols is difficult Use formal methods !

66 / 68

slide-108
SLIDE 108

Future Work

◮ Analyze more existing e-exams from other universities. ◮ Perform on-line verification with our monitors during live

e-exams.

◮ Study more expressive and quantitative properties that can

detect colluded students through similar answer patterns.

◮ Automatic transformation from verifiability to monitors.

67 / 68

slide-109
SLIDE 109

Thank you for your attention!

Questions? pascal.lafourcade@udamail.fr

68 / 68

slide-110
SLIDE 110
  • M. Abadi and C. Fournet.

Mobile values, new names, and secure communication. In POPL, pages 104–115. ACM, 2001. Bruno Blanchet. An efficient cryptographic protocol verifier based on prolog rules. In CSFW, pages 82–96. IEEE Computer Society, 2001.

  • P. Golle and M. Jakobsson.

Reusable anonymous return channels. In Proc. of the 2003 ACM workshop on Privacy in the electronic society, WPES ’03, pages 94–100, New York, NY, USA, 2003. ACM.

  • R. Giustolisi, G. Lenzini, and P.Y.A. Ryan.

Remark!: A secure protocol for remote exams. In Security Protocols XXII, LNCS. Springer, 2014.

68 / 68

slide-111
SLIDE 111

to appear. Draft http://apsia.uni.lu/stast/codes/exams/preSPW14.pdf.

  • A. Huszti and A. Pethő.

A secure electronic exam system. Publicationes Mathematicae Debrecen, 77:299–312, 2010.

  • R. Haenni and O. Spycher.

Secure internet voting on limited devices with anonymized dsa public keys. In Proc. of the 2011 Conference on Electronic Voting Technology/Workshop on Trustworthy Elections, EVT/WOTE’11. USENIX, 2011. Giles Reger, Helena Cuenca Cruz, and David E. Rydeheard. MarQ: Monitoring at runtime with QEA. In Tools and Algorithms for the Construction and Analysis of Systems - 21st International Conference, TACAS, London, UK, pages 596–610, 2015.

68 / 68