2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

An Arbitration System for Student Evaluation based on XML Signature

ROBERT ANDREI BUCHMANN, SERGIU JECAN Business Information Systems Dpt. Faculty of Economic Sciences and Business Administration Babes Bolyai University Cluj Napoca Str. Th. Mihali 58-60, ROMANIA [email protected], [email protected]

Abstract: This paper promotes an e-learning application model for student evaluation, based on AJAX frameworks in order to provide improved user experience and asynchronous data exchange and the XML Signature standard in order to impose message authentications for the test papers. The motivation of this research is the need to arbitrate contestation for e-learning evaluation by providing an authentication and non-repudiation mechanism for both the students’ answers and the teachers’ evaluation criteria and rating, especially in open answer tests.

Keywords: - e-learning, digital signature, AJAX

1 Introduction arose the issue of arbitration in contestation processes, especially in tests based on open E-learning already provides a mature model for questions, but also in multiple choice tests with educational processes. However, the separation no immediate answer validation. The proposed of parties in time and space is bound to solution is an extension to traditional e-learning communication gaps causing situations where an application models, regarding the evaluation arbitration system should provide trust module, based on XML-based digital signature mechanisms between the student and the and improved usability through AJAX teacher. The proposed application model is an frameworks. evolutionary step of the XML-driven e- commerce application previously implemented 3 Problem Solution for Flash 2004 with XML support and currently migrated under an AJAX framework and within 3.1 Instrumentation an e-learning context based on trust managed through XML Signatures. The Flash-XML a. The proposed application model is defined on application model was previously presented in an AJAX framework (Prototype being the [1] and more details are provided on the chosen framework for the prototype mapping of relational data on an XML implementation) with a server-side based on repository in [2]. PHP scripts that build XML documents signed with XML Signature based on session data and 2 Problem Formulation the data provided by the student (questions and answers) and the teacher (proper answers The practical problem approached by the referring questions, the weight of the question in authors’ research effort is the need to arbitrate the average grade and the rating resulted from the evaluation process within an e-learning the teacher’s evaluation). environment, as established popularly in modern AJAX is becoming a mainstream solution for universities. The authors are involved in setting Web applications due to its heavily promoted up and conducting distance learning processes advantages[3]: based on the e-learning platform provided by the • Increased usability and improved user represented institution. Within this context, experience;

ISSN:1790-5109 211 ISBN: 978-960-474-002-4 2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

• AJAX aligns with the trend of evolving )+ 1 or more occurrences usage patterns in Web applications; • Parts of the processing effort is moved () ? 0 or 1 occurrences () * 0 or more occurrences on the client-side, together with parts of the business tier; • The development process does not The components of the signature are embedded involve commercial software and the within two elements: application is easier to deploy compared • contains the list of resources’ with other Rich Client solutions. locations to be covered by the signature each with preliminary hashes (digest); 1 Prototype is one of the most successful • contains the definitive framework providing high level JavaScript hash signature resulted from signing functions that encapsulate and hide most of the . disadvantages of AJAX programming: cross- Additional and optional elements are those browser decisions, try-catch structures and providing information on the key (public key or heavy syntax. Some of the most relevant certificate) and various object-resources advantages brought by the Prototype library are: contained within the signature[5]. • Simplifies the JavaScript syntax; • Provides new functions for accessing The type of signature used by the proposed DOM nodes; application is the detached one. This provides a • Provides new objects for transferring complete separation between the signed and the data and encapsulating signature files, whereas enveloping or enveloped XMLHttpRequest and cross-browser signature requires that the signed document is issues; embedded or embeds, respectively, the • Provides a high-level element signature. positioning system, which is the foundation for the Script.aculo.us 3.2 Application architecture and JavaScript effects library[4]; implementation details • Simplifies the access to form and their fields; Ajax User Interface • Simplifies the snippet insertions in the (on the Prototype framework) user interface, using the Insertion class,

an AJAX pattern encouraged by Rails frameworks.

PHP signature engine PHP Evaluation engine c. The structure of an XML Signature, as - Signature generator - Test generator defined in the W3C recommendation, is the - Signature validator) - XML exam generator following (cardinality explanation on the right - Test sheet formatter side)2:

( 0 or 1 occurrences ()? 0 or 1 occurrences XML Signature XML signed Relational database repository repository (Questions, Answers, Students, (Sig files) (Exam docs) Teacher data)

1 The library is open source and can be downloaded from http://prototypejs.org 2 The latest W3C recommendation for the standard is Fig.1. The 3-tier architecture of the application available at: http://www.w3.org/TR/xmldsig-core/

ISSN:1790-5109 212 ISBN: 978-960-474-002-4 2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

digital signatures were validated on the same By using an AJAX framework, multiple choice data set (document). questions can be easily validated and rated in an automated fashion as the respondent is checking XML Signature permits partial digital signatures his answers, a usability improvement inspired by on element level, in the same XML document or the evolved interaction of validated AJAX multiple documents. The carbon copy version is forms. By handling events such as bluring and obtained in our application model by processing focusing, the server provides instant answers to an XSLT stylesheet over the signed "test sheet" the student, through the Ajax.Updater object document. provided by the Prototype library: The basic use scenario of the application follows argument={ the steps: asynchronous: true, method:"get", • The student user fills and submits a test parameters: data, paper presented as an AJAX form, with onFailure: failurehandler } the possibility of having immediate updtr=Ajax.Updater(element,,argument) evaluation on the multiple choice questions; where: • The server builds dynamically an XML • element is the id of the div tag which will document with the student’s answers have its content replace with the server and digitally signs by building an XML response; Signature via DOMDocument; • url indicates the server script; • The digitally signed document with the • failurehandler is a JavaScript variable of student’s answers is stored in an XML the “function” type, referring a handler; repository and can be formatted with an several such handlers may be defined for XSLT stylesheet; each state of the XMLHttpRequest transfer • The teacher user is able to verify the and each of them have the request object as authenticity of the student’s answers; an implicit argument. • The teacher user signs the part of the document containing his evaluation data Ajax.Updater encapsulates the full functionality (ratings, criteria); of XMLHttpRequest, including cross-browser • The student may authenticate the instantiation, combined with the Prototype teacher’s evaluation; extended class name Insertion, which provides The digital signature is built with a PHP script means of inserting HTML snippets (or formatted by building the XML Signature structures (based XML) at any point of the document relative to on SHA-1 hashing for the prototype in works). other elements or arrays of similar elements Both the student’s and the teacher’s signatures (form fields, table rows, div sets etc.). are stored in separate files. The student and the teacher’s data regarding one “test paper” are However, our main challenge is to define an stored in the same document, which is partially arbitration system based on integrity signed by the two different signatures. XML preservation and message source authentication Signatures allow partial signing of the document during the evaluation process, even in the case (element signing), or multiple signing of the of mixed evaluation (open answers and choice same document. answers). By mimicking real-life formalities, both the student and the teacher should be able The following would be the core structure of a to sign their input (answers and evaluation data, test sheet: respectively) and verify each others signature. In the end, the data set built during an exam should examS111T111.: have a carbon copy version obtained after both

ISSN:1790-5109 213 ISBN: 978-960-474-002-4 2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

The signatures are detached, so they are referencing fragment identifiers from the signed ...... student111signatures.xml: xmlns="http://www.w3.org/2000/09/xmldsig#"> ...... Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n- 20010315" /> question set in order to increase performance, by parsing window (this is kept in perspective, ...... preliminaryhash...... since the current state of the implementation uses DOM). Most elements are using the empty ...... model with attributes also for performance reasons and relational compatibility, as ...... definitivehash...... previous studies[6][7].

All exam files are stored by the server in an teacher222signatures.xml: XML repository with a granularity that defines on document for each exam, and each document identifiers of the student and the teacher also used to identify their signature files. Furthermore, each student and teacher has its ...... preliminaryhash...... own file with XML Signature for the list of all their associated elements from the exam documents: ...... definitivehash...... hashing all his evalset elements, in all test sheets; • Student S111 has a file with signatures Both the signature creation and validation are hashing all his question set elements. handled by PHP through DOMDocument This is possible since XML Signatures uses methods and several encoding functions: double hashing (and consequently, reclaims • hash_algos() – returns the list of PHP- double validation)[8]: registered hashing algorithms • Core validation, for the preliminary (depending on the encryption modules hashing, applied as a digest of each of which are installed); the resources in the list of Reference • hash($algo,$string) – applies the chosen elements; algorithm for hashing; • Signature validation, for the definitive • hash_file($algo,$file) – applies hashing hashing, applied to the list of on a file; preliminary hashes. • sha1($string) is one of the most used hashing algorithms, preferred against md5() due to superior security;

ISSN:1790-5109 214 ISBN: 978-960-474-002-4 2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

• base64_encode($string) provides the $root=$doc->appendChild($elem); $root->setAttribute("xmlns", conversion of hashed binaries to "http://www.w3.org/2000/09/xmldsig#"); characters that will be actually stored as $root->setAttribute("ID","S111Sign"); $elem=$doc->createElement('SignedInfo'); hash values; $si=$root->appendChild($elem); • c14n($string) is a custom function that $elem=$doc->createElement('CanonicalizationMethod'); provides canonicalization of the XML $cm=$si->appendChild($elem); $cm->setAttribute("Algorithm", code, in order to obtain a minimal "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"); logically unaffected document; $elem=$doc->createElement('SignatureMethod'); canonicalization is important since $sm=$si->appendChild($elem); $sm->setAtribute("Algorithm", every bit-level change affects the "http://www.w3.org/2000/09/xmldsig#".$alg); hashing process and the XML flexibility $elem=$doc->createElement('SignatureValue'); $sv=$root->appendCild($elem); makes it possible for XML documents $sv->appendChild($doc->CreateTextNode("0")); that are syntactically different (ex: } containing white spaces) to be logically ...... equivalent; • PEAR packages for signing and The next steps of the script would be: verifying raw digital signatures such as • to access the fragment of the exam file Crypt_RSA and Crypt_DSA, the latter to be signed; being still a proposal package3; these • using the functions previously provide the value for the SignatureValue enumerated, to build the hash value for element (based on a custom key and the fragment and the signature for the formatted through base64 encoding), SignedInfo converted to string; as the which is the definitive signature for the standard suggests, the hashes are finally canonicalized form of the string converted to base64; obtained from the SignedInfo element. • to insert through DOM the values as text nodes of the DigestValue and Based on these functions, the PHP signature SignatureValue elements. engine suggested by Fig.1 provides several high- level functions: Signature verification follows the steps: • Signature creation (see code below); • opens the exam file and the two • Adding new test sheets to the signature associated signature files; (opens the signature file and rehashes • checks the integrity of the signature it); files, by rehashing its SignedInfo • Signature verification, by accessing the element and comparing the result with XML exam file and validating its the signature; associated signatures from the teacher • checks the integrity of the exam file by and the student. rehashing its two parts (identified by ID via fragment identifiers) and comparing The next example provides details regarding the them to the preliminary hashes from signature creation script through DOM ($alg both parties. holds the name for the algorithm of choice, currently selected through a form by the signer): 4 Conclusions

.... E-learning, as any other e-activity, covers a if (file_exists('student111signatures.xml')) $doc->load('student111signatures.xml'); segment of the Semantic Web pyramid by else reaching the higher levels of trust and proof in { $doc->formatOutput = true; practical scenarios such as test contestation. The $elem=$doc->createElement('Signature'); XML Security package of standards provide a flexible set for implementing these levels. 3 The RSA PEAR package is available at Reference is the core element that brings to the http://pear.php.net/package/Crypt_RSA

ISSN:1790-5109 215 ISBN: 978-960-474-002-4 2nd EUROPEAN COMPUTING CONFERENCE (ECC’08) Malta, September 11-13, 2008

XML Signature superior functionality over the Transactions on Information Science traditional binary methods. This element and Applications, Issue3, Vol.4, 2007, identifies the signed resource and provides the pp.545-551 preliminary hash value for signature generation. [2] 2. Buchmann Robert, XML Databases in Its strengths reside in the fact that it can refer E-commerce Applications, Workshop-ul any format of data, not only binary and not only Informatica Economica si Societatea XML, either as a detached signature or by Informationala, Timisoara 2006, p.60- referring elements that contain Base-64 65 encoding of the resource. Thus, XML Signature [3] 3. Dave Crane, Eric Pascarello, AJAX in proves to be a universal signature tool rather Action, Manning, 2006 than an XML-specific solution. However, it is [4] 4. Blake Dournaee, XML Security, optimized for node set processing, this being the mcgraw-Hill, 2002 case of any well-formed XML resource. Our [5] 5. Dave Crane, Bear Bibeault, Prototype research continues on two parallel directions: the and Scriptaculous in Action, Manning development of a full XML Security library for 2007 PHP and the potential in isolating the signature [6] 6. Buchmann Robert, Modeling relational files behind a trust management Web Service. data with XML, Infobusiness 2006 – Proceedings of the International 5 Aknowledgement Conference on Business Information Systems, 2006, p.386-395 This paper contains results of the research [7] 7. Buchmann Robert Andrei – Rolul XML efforts supported by the following grants in interoperabilitatea sistemelor financed by the Romanian Research Authority informatice pentru afaceri, Ed. Risoprint, through CNCSIS: 2007 • the doctoral grant TD270/01.10.2007 [8] 8. Buchmann Robert Andrei, Jecan code 169, managed by Ph. D. Student Sergiu, On XML-based digital signature, Jecan Sergiu; Studia Mathematica (Proceedings of the • the research grant 91-049 PNII International Conference on Knowledge developed within the author's Engineering, Principles and Techniques), department. 2007, pp.30-38

References: [1] 1. Buchmann Robert, XML as a Backbone in Web Applications, WSEAS

ISSN:1790-5109 216 ISBN: 978-960-474-002-4