Citation Context

...gain or political interest (e.g., see Jones (2003), Lambrinoudakis et al. (2003) and Sastry (2007)). We consider the following goals: compromising data integrity (e.g., produce incorrect vote counts), compromising the availability of a system causing a denial of service attack (e.g., block some or all voters from voting in key polling site, delay the announcement of election results), compromising the confidentiality of the system (e.g., allow voters to cast doubt on the legitimacy of the election results). The dimensions of attacks we considered are those described in Kohno et al. (2004) and Balzarotti et al. (2008). 2.1.1. Asset threats and attacks By assigning each asset a value and a location we can highlight in a model where a threat may be implemented and how much harm it can cause. A denial of service, for instance, could be caused by deleting a valuable asset (an asset whose content value is not null) when the asset is in a given location. The notation used previously, however, does not allow to represent the how, e.g., the flow of actions causing termination of the procedures in some undesired Fig. 3. The Delete threat Action and an Example. (a) The Delete Threat-action. It changes the state of t...

Citation Context

... (SDE). The PVS interactive theorem prover was then used to apply the appropriate proof strategies and discharge the proof obligations. Keywords-Electronic Voting Systems, ES&S system, Formal Specification and Verification, Critical Requirements. I. INTRODUCTION Electronic voting systems are increasingly replacing the traditional paper-based voting systems. These systems can make the voting process more convenient and may, therefore, lead to improved turnout. Electronic recording and counting of votes could be faster, more accurate, and less labor intensive. However, as witnessed in [1], [2], [3], [4], [5], evoting systems often share critical failures in their design and implementation, which render their technical and procedural controls insufficient to guarantee trustworthy voting. In California, these studies resulted in the Secretary of State allowing the use of e-voting machines only in special situations and with various changes to the electoral procedures. Several such changes shift the implementation of security requirements from e-voting systems to poll workers. For instance, [6] states that “no poll worker or other person may record the time at which or the order in which v...

Citation Context

...vantages that electronic voting (e-voting) might bring to the polling station, such as accessibility for impaired people, improved accuracy, and faster operations, its adoption in various countries has been slow and/or the cause of great debates and controversies. One of the reasons is that e-voting machines are complex real-time embedded systems that are required to operate in a (possibly) hostile environment. Another and more relevant reason is the poor design and poor implementation of (some of) the systems currently deployed for elections in various countries. See, for instance, [1], [2], [3], [4], for related matters. There are a number of ways in which the integrity and assurance of a complex and safety-critical system’s correct behavior with respect to a specification can be achieved. Among them, formal verification has been shown to improve the security and quality of complex systems (e.g., [5], [6], [7], [8]). These approaches allow designers to prove, test, or otherwise examine interesting properties of a complex process whose behavior is specified abstractly, and then interactively refine the behavioral specification to be as close to an implementation as appropriate for a ...

Citation Context

...lectronic ballots could lead to inconsistent counts, and this would certainly compromise the users’ trust in the correct functioning of the system as a whole. We are aware that voting machine security=-=[28]-=- cannot normally be added-in after a system has already been built — it must be incorporated into the system design as early as possible. In the case of e-voting, security weaknesses are usually addre...

Citation Context

...aws Lost votes; Duplicate votes Herrnson [12] 4 Firmware replacement, viral Vote stealing; Hursti [13]; Feldman [9]; Blaze [6]; propagation, and WinEDS election manipulation McDaniel [18]; Balzarotti =-=[5]-=- 6 Tampering with cartridges Vote stealing; 2 votes for 1 button Blaze [6][18] 7 Naive crypto. authentication cartridge tampering Kohno [17] 8 Program bugs Wrong primary ballot various 5 Buffer overru...

Citation Context

...es but also deleted any signs that the votes had been cast at all (Zetter, 2008). Voter-verifiable paper ballot records used by some electronic voting machines are not error- and tamper-proof either (=-=Balzarotti et al., 2008-=-) because machines can be programmed to produce apparently matching counts and paper reports that can be difficult to identify as fraudulent. Over the last decade or two, there has been renewed intere...

Citation Context

...ems. Keywords-Electronic Voting, E-Democracy, Experiments, Security, Assessment I. INTRODUCTION The development of fair and secure e-voting machines is complex (see, e.g., [1], [2], [3] and [4], [5], =-=[6]-=- for some discussion on the matter). We have been involved in the development and evaluation of an e-voting system called ProVotE. During the project we developed a DRE-VVPAT mainly driven by the poss...