Formal analysis of an electronic voting system: An experience report

• Published in: The Journal of systems and software Vol. 84; no. 10; pp. 1618 - 1637
• Main Authors: Weldemariam, Komminist, Kemmerer, Richard A., Villafiorita, Adolfo
• Format: Journal Article
• Language: English
• Published: New York Elsevier Inc 01.10.2011; Elsevier Sequoia S.A
• Subjects: Critical requirements; E-voting; Electronic voting systems; ES&S system; Formal specification and verification; Online voting; Program verification (computers); Programming languages; Proving; Security; Security management; Specifications; Strategy; Studies; Systems development; Voting; Voting machines; United States > US; Formal specification and verification; Electronic voting systems; Critical requirements; ES&S system
• ISSN: 0164-1212; 1873-1228
• DOI: 10.1016/j.jss.2011.03.032

We have seen that several currently deployed e-voting systems share critical failures in their design and implementation that render their technical and procedural controls insufficient to guarantee trustworthy voting. The application of formal methods would greatly help to better address problems associated with assurance against requirements and standards. More specifically, it would help to thoroughly specify and analyze the underlying assumptions and security specific properties, and it would improve the trustworthiness of the final systems. In this article, we show how such techniques can be used to model and reason about the security of one of the currently deployed e-voting systems in the U.S.A named ES&S. We used the ASTRAL language to specify the voting process of ES&S machines and the critical security requirements for the system. Proof obligations that verify that the specified system meets the critical requirements were automatically generated by the ASTRAL Software Development Environment (SDE). The PVS interactive theorem prover was then used to apply the appropriate proof strategies and discharge the proof obligations. We also believe that besides analyzing the system against its requirements, it is equally important to perform an analysis under malicious circumstances where the execution model is augmented with attack behaviors. Thus, we extend the formal specification of the system by specifying attacks that have been shown to successfully compromise the system, and we then repeat the formal verification. This is helpful in detecting missing requirements or unwarranted assumptions about the specification of the system. In addition, this allows one to sketch countermeasure strategies to be used when the system behaves differently than it should and to build confidence about the system under development. Finally, we acknowledge the main problem that arises in e-voting system specification and verification: modeling attacks is very difficult because the different types of attack often cut across the structure of the original behavior models, thus making (incremental or compositional) verification very difficult.