aeb8c911ba267e23a2c1033cffdba28b.ppt
- Количество слайдов: 30
Vo. Te. R Center University of Connecticut Automating Voting Terminal Event Log Analysis Tigran Antonyan, Seda Davtyan, Sotirios Kentros, Aggelos Kiayias, Laurent Michel, Nicolas Nicolaou, Alexander Russell, Alexander A. Shvartsman Voting Technology Research (Vo. Te. R) Center University of Connecticut http: //voter. engr. uconn. edu Presented by Nicolas Nicolaou Work funded by the Connecticut Secretary of the State Office
Vo. Te. R Center University of Connecticut Why Auditing? [http: //www. statehousereport. com] 3/19/2018 EVT/WOTE 09 2
Vo. Te. R Center University of Connecticut Motivation q q Electronic Voting Technologies Ø Direct Recording Electronic (DRE) Ø Optical Scan (OS) tabulator v VVPAT – Voter Verifiable Paper Audit Trail v Used in over 50% of counties in 2008 Terminal Usage in Election Procedures Ø “Safe” Storage v No Interaction (? ) Ø Polling Place v Officials (Before Election) v Voters + Officials (During Elections) v Officials (After Elections) “Safe” storage (No Interaction) Officials Interaction q Officials Interaction Voters+ Officials Interaction Is the interaction with the terminal benign and does it follow the election procedures? 3/19/2018 EVT/WOTE 09 3
Vo. Te. R Center University of Connecticut Question How can someone check the Actions and their Validity, performed on an E-Voting Terminal during an Election Process? Can we devise an Automated Procedure to perform this check? 3/19/2018 EVT/WOTE 09 4
Vo. Te. R Center University of Connecticut The Event Log q What is an Event Log Ø A list of Timestamped Entries v Actions performed on the terminal, and v Time/Date associated with any recorded action v What actions are recorded? q Where an Event Log is found Ø In every E-voting Terminal with Logging Capabilities v Usually Dedicated Memory Space q Event Logs are useful for: Ø Monitoring actions on e-voting terminals v Before, During and After the elections Ø Report environmental effects v i. e. Power Failure 3/19/2018 EVT/WOTE 09 5
Vo. Te. R Center University of Connecticut Why Auditing the Event Log? q Detect Expected Event Histories Ø Compliant with electoral procedures q Detect Irregular Event Histories Ø Deviation form electoral procedures Ø Malfunction of machines Ø Reveal any malicious intent q To Improve Electoral Procedures Ø Minimize procedural uncertainties Ø Increase the chance of detecting malicious actions Event Log Audit is Essential for any Election Process Every E-Voting System should provide an Event Log 3/19/2018 EVT/WOTE 09 6
Vo. Te. R Center University of Connecticut The Need for Independent Log Audit q E-Voting Systems with Logging Capabilities Ø Print Event Log Ø Provide Software to read analyze the Event Log v Usually Developed by the Vendor q Issues Ø Printing Module v Module Defects Ø Wrong Sequence of events v Manual Parse of the printout Ø Time Consuming and Inaccurate Ø Vendor Software v Reliability Ø What are the analysis criteria? v Conflict of Interest? Ø Is it trustworthy? 3/19/2018 EVT/WOTE 09 7
Vo. Te. R Center University of Connecticut Our Approach q Understand Parse the Log Ø Input: Event Log raw data and format Ø Output: Exact Action sequence recorded in the Log q Examine log sequences in light of predefined Action Rules Ø Rules can be customized by v Voting Terminal: Actions it can record v Election Process: Sequence of Actions it contains q Report whether Log Sequences satisfy the Rules 3/19/2018 EVT/WOTE 09 8
Vo. Te. R Center University of Connecticut Case Study: Accu. Vote (AV-OS) q Premier’s Accu-Vote Optical Scan tabulator Ø Provides inherent VVPB/VVPAT Ø But is not perfect: v Tampering with Memory cards [Hursti’ 05], [EVT’ 07] v Firmware manipulations [SAC’ 09] v Reports by others and CA, CT, FL, AL, … q Provides Logging Capabilities Ø Printing the Event Log for Auditing v Print Module is Defective Ø Suffers from other Deficiencies 3/19/2018 EVT/WOTE 09 9
Vo. Te. R Center University of Connecticut Case Study: Accu. Vote OS (AV-OS) q Physical Characteristics Ø Firmware Version 1. 96. 6 Ø Input Devices v Yes/No Buttons v Optical Scanner Output Devices Ø v v q Printer LCD Memory Card Header Ø Contains Election Data Ø Divided in 5 sections Ø Contents of the MC obtained by build-in extraction module Event Log Election Data Bytecode (Accu. Basic) Counters 3/19/2018 EVT/WOTE 09 10
Vo. Te. R Center University of Connecticut Applying Our Approach: AV-OS Logs q Design and Implement a Procedure for Accu. Vote OS Event Log Audit Ø Parse, analyze and evaluate event logs v Automated Log Analyzer Ø General for other E-Voting Systems q Discover AV-OS event log Defects and Deficiencies q Used in the Event Log Audit in the CT Presidential Elections of November 2008 3/19/2018 EVT/WOTE 09 11
Vo. Te. R Center University of Connecticut Log Audit Procedure at a Glance 1. Understand the contents of the AV-OS Event Log 2. Model AV-OS as a finite state machine (FSM) Ø AV-OS states Ø State transitions (Actions) Ø Logged Events 3. Specify the electoral process Ø Augment FSM Actions with Time-Sensitive information based on the definition of the electoral process. 4. Develop Analysis Tool Ø Parse AVOS Event Log Ø Compare the Event Action Sequence over Time. Sensitive Action Sequence Rules 3/19/2018 EVT/WOTE 09 12
Vo. Te. R Center University of Connecticut AV-OS Event Log Entries q Log entries: 512 Ø Circular Buffer q AV-OS Event Log has two types of entries: Ø Action entries Ø Date entries q Action entries consist of Ø Ø q Time of occurrence Action name Date entries only follow: Ø INITIALIZED action Ø SESSION START action 3/19/2018 EVT/WOTE 09 13
Vo. Te. R Center University of Connecticut Event Types Recorded by AV-OS Action Name Action Description AUDIT REPORT Appears when an Audit Report is printed. BAL COUNT END After the ender card is inserted in an election, this action appears. BAL COUNT START Appears when the first ballot is cast in an election. BAL TEST START Records the beginning of a test election. CLEAR COUNTERS Appears when the counters are set to zero. COUNT RESTARTED Appears if the machine is reset during an election, after at lea DOWNLOAD END Recorded during the download of data is ended. DOWNLOAD START Recorded during the download of data is started. DUPLICATE CARD Appears when a card is duplicated. Present in the master car ENDER CARD Records when an ender card is inserted, signifying the end of an electi INITIALIZED The 1 st action in the Log. Date action appears when one programs the MEM CARD RESET A memory card reset returns a card in ’not set’ status, if it wa OVERRIDE Records an override by a poll worker. Used for the insertion of overvot POWER FAIL If the machine is unplugged or a power failure occurs, this action is rec PREP FOR ELECT Recorded when the card is set for election. SESSION START Date action. Appears every time you reset the machine. TOTALS REPORT Appears when a Totals Report is printed. UNVOTED BAL TST Appears when an unvoted ballot test is performed. UPLOAD END When an upload is completed, this action is recorded. UPLOAD ERROR Appears when an upload error is detected. UPLOAD STARTED Marks the beginning of an upload. VOTED BAL TEST Appears when an voted ballot test is performed. ZERO TOT REPORT Appears when a Zero Totals Report is printed. 3/19/2018 EVT/WOTE 09 14
Vo. Te. R Center University of Connecticut Modeling AV-OS as a FSM q States: Ø Preserved after a restart v Blank State v Loaded Election State v Set for Election with Zero Counters v Set for Election with Non-Zero Counters v Print Totals Report v Election Closed Ø Not preserved after restart v Voted Ballot Test v Unvoted Ballot Test v Test Election with Zero Counters v Test Election with Non-Zero Counters q Transitions denoted by a triple < U || A || L > Ø U: User action Ø A: Ensuing Sequence of Machine Actions Ø L: Sequence of Logged Events 3/19/2018 EVT/WOTE 09 15
Vo. Te. R Center University of Connecticut Example – Set For Election State Restart Machine || Print Zero Totals Report || Session Start, Zero Totals Report Ender Card || End Election, Print Totals Report || Ender Card, Bal Count Start, Ballot Count End Set For Election / Zero Counters Cast Ballot || Cast Vote || Bal Count Start Override || Cast Vote || Override, Bal Count Start 3/19/2018 Print Totals Report EVT/WOTE 09 Set For Election / Non-Zero Counters 16
Vo. Te. R Center University of Connecticut Specify the Election Process 3/19/2018 EVT/WOTE 09 17
Vo. Te. R Center University of Connecticut Time-Sensitivity of the Election Process q Card Programming and Pre-Election testing by Provider Ø 3 -4 weeks before the elections q Pre-Election Testing and Setting for Election in the Precincts Ø 1 -2 weeks before the elections q Expected Sequence of timed events on Election Day: Ø SESSION START-DATE, ZERO TOTALS REPORT v Before the polls open Ø BALLOT COUNT STARTS v After the polls open Ø Any number of OVERRIDE events v While the polls are open Ø ENDER CARD, BALLOT COUNT END, TOTALS REPORT v When the polls close 3/19/2018 EVT/WOTE 09 18
Vo. Te. R Center University of Connecticut Automating the Event Log Analysis q Define a set of Time Sensitive Rules Ø Derived from FSM and Election Process Ø Rules defined in an XML file v Easily customizable q Analysis Tool Ø Input: Set of Rules and AV-OS Event Log Ø Output: Return “Expected” or “Irregular” 3/19/2018 EVT/WOTE 09 19
Vo. Te. R Center University of Connecticut Examples of Flagged Events A. Expected Election Run B. Restart During the Election Process C. Power Failure and Restart During the Election Process 3/19/2018 EVT/WOTE 09 20
Vo. Te. R Center University of Connecticut AV-OS Event Log Defects/Deficiencies q Printing an Overflowed Event Log q “Totals Report” Recording Deficiency q Date recording Deficiency 3/19/2018 EVT/WOTE 09 21
Vo. Te. R Center University of Connecticut Printing Defect Demonstration q Printing Enumerates Events q Let an action event be denoted as Ø q Let assume #entries=522 Date Entries = 11 Action Entries = 511 10 first entries overwritten Ø Ø Ø v Print starts from 11 th entry
Vo. Te. R Center University of Connecticut “Totals Report” Recording Deficiency q Closing Election Ø Ender Card Ø Totals Report Ø Another Copy? q Totals Report Event Ø Not logged unless “NO” is pressed Ø Single appearance in the log event q Effects Ø Event is not logged v Controversy on the validity of printed totals report Ø Single appearance of the event affects v Auditing Process v Electoral Process 3/19/2018 EVT/WOTE 09 23
Vo. Te. R Center University of Connecticut Date recording Deficiency q Deficiency Entries followed by date Ø v v Ø q INITIALIZE SESSION START If >24 hours elapse from the date recording without any actions occurring v Cannot determine whether the next event occurred on the same date. Effects Ø 3/19/2018 Modification of the results v I. e. , leave the terminal ON for a day, cast more votes and close it the next day at the expected time EVT/WOTE 09 Did these events happen on Nov 04, 2008? ?
Vo. Te. R Center University of Connecticut Our Log Audit Procedure in Practice q Connecticut Nov 2008 Presidential Elections q We collected Event Logs from 421 AV-OS memory cards Ø 279 used in the elections v Corresponding to random selection of 30% of all precincts Ø 142 from back-up cards not used in the elections 3/19/2018 EVT/WOTE 09 25
Vo. Te. R Center University of Connecticut Findings q 314 out of 421 contain the expected sequences q 15 (3. 6%) had >10 SESSION START events q 41 (9. 7%) contained card duplication events q 29 (6. 9%) had a ZERO TOTALS REPORT printed before the date of the election. q 24 (5. 7%) were initialized between 10/27/2008 and 10/30/2008. Ø Our pre-election audit included only cards programmed until 10/26/2008 q 2 event logs had an additional ZERO TOTALS REPORT event during the election day. 3/19/2018 EVT/WOTE 09 26
Vo. Te. R Center University of Connecticut Findings (Cont…) q 1 event log had ELECTION CLOSE event at 22: 08. q 6 event logs had PREP ELECTION event the day of the election. q 4 event logs had a MEMORY CARD RESET event. q 1 event log had an UPLOAD STARTED event. q 2 event logs had test elections on 10/31/08 and 1 event log showed a test election on 11/03/08. q 1 event log had a test election on 11/26/08 and an election executed on 12/04/08. q Findings Suggest Ø No serious security problem or malicious intent Ø Prescribed procedures are not followed uniformly 3/19/2018 EVT/WOTE 09 27
Vo. Te. R Center University of Connecticut Summary q Proposed and Developed an Automated Procedure for Event Log Analysis Ø Modeling AV-OS in terms of FSM Ø Time-Sensitive Action Rules Ø A tool to compare the actions in the logs over the defined rules v Our tool may be adjusted and used with other systems q Discovered some defects and deficiencies in AV-OS logging procedures Ø Printing an Overflowed Event Log Ø “Totals Report” Recording Deficiency Ø Date recording Deficiency q Used the automated tool in log analysis for CT Nov 2008 elections Ø Findings suggest no malicious intent but reveal non-uniformity in the electoral procedures 3/19/2018 EVT/WOTE 09 28
Vo. Te. R Center University of Connecticut Conclusions q Our Results Suggest Ø Full scale event log analysis is feasible v It provides information about Ø Usage of the machines Ø Deviation from procedures. Ø Should included in any procedural audit v Part of Post-Election Audit Ø Event Logs should be a part of any EVoting Terminal 3/19/2018 EVT/WOTE 09 29
Vo. Te. R Center University of Connecticut Thank You. Questions?