Data Management for a Digitally-supported Examination Process - - PowerPoint PPT Presentation

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Data Management for a Digitally-supported Examination Process

Bachelor’s Thesis – Final Talk Kaloyan Zdravkov

30.09.2015 Chair for Network Architectures and Services Department of Informatics Technische Universit¨ at M¨ unchen

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 1

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Outline

Introduction The exam support system Authentication and encryption Data management Data transfer

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 2

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Introduction

Approaching the digitalization of the examination process

Related Work:

◮ Fully digital exams ◮ Multiple choice hand-written exams with digital grading ◮ Systems for handling events before an exam, e.g.

registration and finding rooms This thesis is about:

◮ Digitally-identifying exam papers ◮ Digitally-supporting the events during a classical

pen-and-paper exam

◮ Attendance checking ◮ Logging breaks ◮ Exam hand in ◮ Supervising students Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 3

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Introduction

Motivation

A digitally-supported examination process advantages:

◮ Reducing errors when assigning grades ◮ The names of the students are not disclosed ◮ Harder to impersonate someone else ◮ Faster counting of exam papers at the end of the exam ◮ Pinpointing a student who did not hand in his exam ◮ Exam protocols will become fully electronic, thus easier to

manage

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 4

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Introduction

Digitally-identifying an exam paper with a QR code

A QR code uniquely identifies the subject, date and student. →

◮ IN0010-20150612-

S0003 Why a QR Code?

◮ Built-in error correction

recovers data loss as high as 30%

◮ 2-Dimensional -

conveys 200 times more data than a 1-Dimensional code

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 5

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Introduction

Goals of the thesis

The task of digitizing the whole examination process was split in two parts. This thesis covers:

◮ The task of data management for events during the exam ◮ Developing the server application ◮ Developing the data management functionality of the client

application The thesis Inspection and Privacy Aspects for a Digitally-supported Examination Process by Stefan Aicher approaches:

◮ Digitizing the events after the exam – digitally scanning

and grading a corrected exam

◮ Developing GUI for the client application ◮ Detailed view of the data privacy aspects

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 6

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

The exam support system

Architecture

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 7

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

The exam support system

Legal aspects

Mobile phones are:

◮ Untrusted ◮ Deal with sensitive data – identifiers, linkable to persons

The German law states that:

◮ If a mapping exists, between an identifier and a person –

the identifier is a pseudonym

◮ Encryption is also pseudonymization – the encrypted data

can be mapped to a person with the key

◮ Only depending on the context a pseudonym can be

considered as personal data

◮ If the mapping is substantially complicated, then the

pseudonyms are not considered personal

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 8

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Authentication and encryption

The crypto library libsodium

Libsodium’s advantages

◮ High-level crypto API ◮ Small and proven set of algorithms

Public-key authenticated encryption in libsodium

◮ Encryption – stream cipher XSalsa20 ◮ Mutual authentication – Diffie–Hellman key exchange

Curve25519

◮ Data integrity and authenticity – HMAC function Poly1305

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 9

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Authentication and encryption

Pairing of phones

◮ Sever’s public key should only be accessible from the

phones

◮ Embed the key in a QR code, displayed on the exam laptop

Additional security measures

◮ Show a list of every authenticated/paired phone with

identifying information

◮ Log which phone triggered the respective event in the

database

◮ Assign aliases to every phone for quick discovery

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 10

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Authentication and encryption

Phone overview

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 11

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Data Management

Object-relational mapping

Requirements:

◮ Data model easily modifiable ◮ Database exchangeable

Solution: The ORM framework for Java – Hibernate

◮ Mapping objects from OOP language to tables in an

RDBMS

◮ The developer only writes java classes - the underlying DB

schema is created automatically

◮ The data model is changed only in the Java classes ◮ The application is fully database-independent

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 12

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Data transfer

Consistency

Every triggered exam event should reach the server

◮ Wi-Fi connectivity lost - with a system event messages are

re-sent when the network is up again

◮ Server is down - messages are timeouted and retried ◮ The client app has crashed - all messages are stored,

encrypted with the established shared key

◮ If there are unsent messages at the end of the exam, they

can be uploaded to the server via cable It is important when the exam event was triggered

◮ Timestamping should be done on the clients ◮ Clients may not have correct time, so they should be

synchronized

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 13

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

Data transfer

Time synchronization

It is assumed that the server will have precise time reference which the clients will synchronize to.

• 1. The time of the client is acquired
• 2. A request for the server’s time is sent and the time when

the response arrived is stored

• 3. The transmission delay is calculated by subtracting the

time in step 1 from step 2 and divided by two

• 4. The time difference of client and server is calculated and

the transmission delay is added.

• 5. Steps 1 through 4 are repeated for 3-5 times and the

median delay is calculated

• 6. Iterations with a higher delay than one standard deviation

are discarded

• 7. The results are averaged with arithmetic mean

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 14

Chair for Network Architectures and Services Technische Universit¨ at M¨ unchen

DEMO

Kaloyan Zdravkov – Data Management for a Digitally-supported Examination Process 15