Formal Analysis of Electronic Exams

Jannik Dreier, Rosario Giustolisi, Ali Kassem, Pascal Lafourcade, Gabriele Lenzini, Peter Y. A. Ryan

2014

Abstract

Universities and other educational organizations are adopting computer and Internet-based assessment tools (herein called e-exams) to reach widespread audiences. While this makes examination tests more accessible, it exposes them to new threats. At present, there are very few strategies to check such systems for security, also there is a lack of formal security definitions in this domain. This paper fills this gap: in the formal framework of the applied pi-calculus, we define several fundamental authentication and privacy properties and establish the first theoretical framework for the security analysis of e-exam protocols. As proof of concept we analyze two of such protocols with ProVerif. The first “secure electronic exam system” proposed in the literature turns out to have several severe problems. The second protocol, called Remark!, is proved to satisfy all the security properties assuming access control on the bulletin board. We propose a simple protocol modification that removes the need of such assumption though guaranteeing all the security properties.

References

  1. Abadi, M. and Fournet, C. (2001). Mobile values, new names, and secure communication. In POPL. ACM.
  2. Arapinis, M., Bursuc, S., and Ryan, M. (2013). Privacysupporting cloud computing by in-browser key translation. Journal of Computer Security, 21(6):847-880.
  3. Backes, M., Hritcu, C., and Maffei, M. (2008a). Automated verification of remote electronic voting protocols in the applied pi-calculus. In CSF. IEEE.
  4. Backes, M., Maffei, M., and Unruh, D. (2008b). Zeroknowledge in the applied pi-calculus and automated verification of the direct anonymous attestation protocol. In IEEE S & P'08.
  5. Bella, G., Costantino, G., Coles-Kemp, L., and Riccobene, S. (2011). Remote management of face-toface written authenticated though anonymous exams. In CSEDU (2), pages 431-437. SciTePress.
  6. Blanchet, B. (2001). An efficient cryptographic protocol verifier based on prolog rules. In CSFW. IEEE.
  7. Blanchet, B., Abadi, M., and Fournet, C. (2008). Automated verification of selected equivalences for security protocols. J. Log. Algebr. Program., 75(1):3-51.
  8. Castellà-Roca, J., Herrera-Joancomartí, J., and Dorca-Josa, A. (2006). A secure e-exam management system. In ARES, pages 864-871. IEEE Computer Society.
  9. Copeland, L. (2013). School cheating scandal shakes up atlanta. http://www.usatoday.com/story/news/nation/2013/04/ 13/atlanta-school-cheatring-race/2079327/.
  10. Delaune, S., Kremer, S., and Ryan, M. (2006a). Verifying properties of electronic voting protocols. In Proceedings of WOTE'06.
  11. Delaune, S., Kremer, S., and Ryan, M. (2009). Verifying privacy-type properties of electronic voting protocols. Journal of Computer Security, 17(4):435-487.
  12. Delaune, S., Kremer, S., and Ryan, M. D. (2006b). Coercion-resistance and receipt-freeness in electronic voting. In CSFW'06. IEEE.
  13. Dolev, D. and Yao, A. C. (1983). On the security of public key protocols. Information Theory, IEEE Transactions on, 29(2):198-208.
  14. Dong, N., Jonker, H. L., and Pang, J. (2010). Analysis of a receipt-free auction protocol in the applied pi calculus. In FAST'10, volume 6561 of LNCS. Springer.
  15. Dreier, J., Jonker, H., and Lafourcade, P. (2013a). Defining verifiability in e-auction protocols. In ASIACCS, pages 547-552. ACM.
  16. Dreier, J., Lafourcade, P., and Lakhnech, Y. (2011). Voteindependence: A powerful privacy notion for voting protocols. In FPS, volume 6888 of LNCS. Springer.
  17. Dreier, J., Lafourcade, P., and Lakhnech, Y. (2012a). Defining privacy for weighted votes, single and multi-voter coercion. In ESORICS, LNCS. Springer.
  18. Dreier, J., Lafourcade, P., and Lakhnech, Y. (2012b). A formal taxonomy of privacy in voting protocols. In ICC, pages 6710-6715. IEEE.
  19. Dreier, J., Lafourcade, P., and Lakhnech, Y. (2013b). Formal verification of e-auction protocols. In POST, volume 7796 of LNCS, pages 247-266. Springer.
  20. Elgamal, T. (1985). A public key cryptosystem and a signature scheme based on discrete logarithms. Information Theory, IEEE Transactions on, 31(4):469-472.
  21. Furnell, S., Onions, P., Knahl, M., Sanders, P., Bleimann, U., Gojny, U., and Röder, H. (1998). A security framework for online distance learning and training. Internet Research, 8(3):236-242.
  22. Giustolisi, R., Lenzini, G., and Bella, G. (2013). What security for electronic exams? 8th Int. Conf. on Risk and Security of Internet and Systems (CRiSIS).
  23. Giustolisi, R., Lenzini, G., and Ryan, P. (2014). Remark!: A secure protocol for remote exams. In Security Protocols XXII, LNCS. Springer. to appear. Draft http://apsia.uni.lu/stast/codes/exams/preSPW14.pdf.
  24. Golle, P. and Jakobsson, M. (2003). Reusable anonymous return channels. In Proc. of the 2003 ACM workshop on Privacy in the electronic society, WPES 7803. ACM.
  25. Haenni, R. and Spycher, O. (2011). Secure internet voting on limited devices with anonymized dsa public keys. In WOTE'11. USENIX.
  26. Herrera-Joancomartí, J., Prieto-Blázquez, J., and Castellà- Roca, J. (2004). A secure electronic examination protocol using wireless networks. In ITCC. IEEE.
  27. Hjeltnes, T. and Hansson, B. (2005). Cost Effectiveness and Cost Efficiency in E-learning. QUIS - Quality, Interoperability and Standards in e-learning, Norway.
  28. Huszti, A. and Petho?, A. (2010). A secure electronic exam system. Publicationes Mathematicae Debrecen, 77:299-312.
  29. Ryan, M. and Smyth, B. (2011). Applied pi calculus. In Formal Models and Techniques for Analyzing Security Protocols, chapter 6. IOS Press.
  30. Ryan, P. Y. A. and Schneider, S. A. (2001). Process algebra and non-interference. J. Comput. Secur., 9(1-2).
  31. Ryan, P. Y. A., Schneider, S. A., Goldsmith, M., Lowe, G., and Roscoe:, A. W. (2000). The Modelling and Analysis of Security Protocols: The CSP Approach. Addison-Wesley Professional, first edition.
  32. Shamir, A. (1979). How to share a secret. Commun. ACM, 22(11):612-613.
  33. Watson, R. (2014). Student visa system fraud exposed in BBC investigation. http://www.bbc.com/news/uk26024375.
  34. Weippl, E. (2005). Security in E-learning, volume 6 of Advances in Information Security. Springer Science + Business Media.
Download


Paper Citation


in Harvard Style

Dreier J., Giustolisi R., Kassem A., Lafourcade P., Lenzini G. and Y. A. Ryan P. (2014). Formal Analysis of Electronic Exams . In Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014) ISBN 978-989-758-045-1, pages 101-112. DOI: 10.5220/0005050901010112


in Bibtex Style

@conference{secrypt14,
author={Jannik Dreier and Rosario Giustolisi and Ali Kassem and Pascal Lafourcade and Gabriele Lenzini and Peter Y. A. Ryan},
title={Formal Analysis of Electronic Exams},
booktitle={Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014)},
year={2014},
pages={101-112},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005050901010112},
isbn={978-989-758-045-1},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 11th International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2014)
TI - Formal Analysis of Electronic Exams
SN - 978-989-758-045-1
AU - Dreier J.
AU - Giustolisi R.
AU - Kassem A.
AU - Lafourcade P.
AU - Lenzini G.
AU - Y. A. Ryan P.
PY - 2014
SP - 101
EP - 112
DO - 10.5220/0005050901010112