PROPOSING A SECURE ELEARNING SYSTEM BASED ON BIOMETRIC AUTHENTICATION AND HOMOMORPHIC ENCRYPTION

As the technology advances fast, the educational and learning environments need to keep up with the trends. Cloud computing is adopted more and more by companies due to its benefits, like availability, cost reduction, on-demand self-service etc. This is also the case of learning environments, because it has been proposed many cloud-based eLearning systems. Still, there are some concerns within such systems, regarding two perspectives: user’s perspective and learning provider’s perspective. A user needs to be sure that its progress or grades or other personal data is accessed by himself or another authorized users (like teachers/instructors). A helpful tool for the user would be a tool that predicts if he/she would pass a final exam, based on past data of user’s behaviour. On the other way, the learning provider needs to be sure that exams are taken by the real user, not by another person on behalf of the real user. In this paper we propose an eLearning system dedicated to mobile devices, such as smartphones or tablets, provided as service, which will focus on analysis of user’s behaviour (based on biometric data, as pulse) in order to determine if he/she is prepared for the course final exam. In this system, the confidentiality of data is assured by homomorphic encryption, in which analysis is done over encrypted data, such that the output will be decrypted only by the user. An additional level of security is represented by authentication method, in which the user’s fingerprint will be used. Also, fingerprint authentication will avoid fraud for situations when the final exam will not be held by the real user. Our proposed system could be used in many areas, like governmental institutions or educational systems.

随着技术飞速迭代，教育与学习环境亟需紧跟时代发展潮流。云计算（Cloud Computing）凭借高可用性、降本增效、按需自助服务等诸多优势，正被企业愈发广泛地采用。学习场景亦是如此，目前已有诸多基于云的电子学习（eLearning）系统被提出。但此类系统仍存在双视角下的隐忧：用户视角与学习服务提供商视角。对于用户而言，其学习进度、成绩及其他个人数据，仅应由本人或经授权的使用者（如教师/授课者）访问。一款基于用户过往行为数据、可预测其能否通过期末考核的工具，将对用户大有裨益。另一方面，学习服务提供商则需确保考试由考生本人完成，而非他人替考。本文提出一款面向移动设备（如智能手机、平板电脑）的电子学习系统，以服务形式交付，其核心聚焦于基于用户行为数据（包括脉搏等生物特征数据）的分析，以判断用户是否已为课程期末考核做好准备。该系统通过同态加密（homomorphic encryption）保障数据机密性：所有分析操作均在加密数据上执行，最终结果仅可由用户本人解密。此外，系统还增设了另一重安全保障：采用用户指纹进行身份验证。指纹身份验证亦可有效避免替考行为，确保期末考核由考生本人完成。本研究提出的系统可广泛应用于诸多领域，例如政府机构或教育系统中。