A New Remote Authentication Model for Online Examination Systems

European Journal of Scientific Research ISSN 1450-216X / 1450-202X Vol. 125 No 1 September, 2014, pp.115-127 http://www.europeanjournalofscientificresearch.com A New Remote Authentication Model for Online Examination Systems Ghada Ashraf El Sayad Arab Academy for Science and technology and Maritime Transport Cairo, Egypt E-mail: Ghada_elsayad@hotmail.com Moustafa Abd El Aziem Arab Academy for Science and technology and Maritime Transport Cairo, Egypt E-mail: melbaqary@gmail.com Essam El Dien El Fakharany Arab Academy for Science and technology and Maritime Transport Cairo, Egypt E-mail: essam.elfakharany@aast.edu Abstract Online Examination System is the most important component of E-Education because of the security issues. Cheating-free is the main challenge that faces the online examination system versus the traditional paper and pencil exams. This paper proposed an enhancement of Remote Online Examination Model (ROES) that can used remotely to authenticate the test taker remotely and also detect cheating in the online test without regard to online human proctor, fixed place, and fixed time. The ROES model is based on using token (PKI Algorithm and Digital signature) for remotely identification, fingerprint and keystroke dynamics for authentication, and live video/audio surveillance for monitoring examinee during the online exam session. The combination of these techniques aim to three goals: (1) the examinee taking the remote online test doesn't apply with a fake identity, (2) he/she is a valid user who is setting from the beginning to the end of the examination session and (3) the examinee can't use any cheating practice during the examination session. So this model provides a secure remote online examination infrastructure without the need to a fixed place to take it. Keywords: Remote Online Examination System, Authentication, Digital signature, and fingerprint and keystroke dynamics Biometrics authentication. 1. Background Online examination system is a modern method of conducting exams widely accepted and fast increasing in all the sectors education and job. Traditional exams are performed by human examiners based on specific place or class rooms, specific time and selected proctor, but online exams are performed online based on huge question bank without the regard to fixed locations, or fixed time, and sometimes don't need an online proctor.so the examinee can take the online exam at any convinced place has an internet connection (home, office, library …etc.) and at any time. Cheating is the main challenge that faces both of the previous types of examination, but it can be easier in online exams than traditional exams because of the online proctor absence. "In a survey A New Remote Authentication Model for Online Examination Systems 116 conducted to evaluate this issue, 73.6% said that cheating is easier in an e-examination than in its traditional counterpart [1]". The ROES model aims to solve cheating problems either impersonation threats or any other cheating practices by using the following techniques: a) digital signature technique to proof examinee's identity, b) biometrics technique (fingerprint and keystroke dynamics) to proof that the person who attends the test is a valid user and who takes the examination session from the beginning to the end and finally video/audio monitoring to prevent any cheating practices during the examination session and also to be used later as an evidence of cheating. This paper is divided into three sections. Section 2 illustrates the two types of online examination systems and their drawbacks, section 3 discusses the online examination system security threats, security requirements of online examination system, examinee security in online examination system and the different authentication factors. Finally section 4 explains the ROES model which is the proposed model to solve cheating problems in online examination systems. 2. Online Examination System Online Examination System types: Due to the importance of Online Examination Systems, there are two different types of Online Examination Systems: A. Online Examination based on fixed location, time: Online test with an examiner or proctor is conducted at a fixed location that has an internet connection and a computer where test takers are taking the exam (test centers). Also they take the exam at a fixed time and they must attend to take the exam. The test is monitored by a proctor. This model has different drawbacks of this system which are: 1. Fixed location may be a problem to the examinee that may has to travel to attend the online exam (costly and time wasting), 2. fixed time also is a main drawback because of different time zones, 3. the examination session depends on a human proctor who should be honest to prevent cheating practices during the examination session and 4. resource wastage like electricity, computers, room for conducting the exam, and other electronic devices. B. Remote Online Examination Systems: In this type, Examinee can take the exam at any time, and from any convinced place that has an internet connection. The test may or may not be scheduled at a fixed time, assigned a proctor or not. Also the test is restricted with start and end time. The main challenge that faces the remote online examinations is security on which remote online examination depends to be effective. So the absence of security leads to cheating-free during the online examination session especially remote exams without an online proctor. 3. Online Examination System Security 3.1 Online Examination System Security Threats Cheating- free to get a high score (in college courses or to get any type of certificates) is one of the most common challenges that should be considered in any online examination systems. Cheating in online exams can be divided into three types: 1. Cheating in authentication and identification (impersonation threats): 117 Ghada Ashraf El Sayad, Moustafa Abd El Aziem and Essam El Dien El Fakharany Impersonation threats in online examinations are the most vital risks which might be occurred before and during the examination process (as shown in Fig. 1). Figure 1: Impersonation threats [2] User Security Identity Who are you? = username = Digital Examinee Invigilator Authentication Secure? Is that really you? = password = Biometrics E- Impersonation threats can be divided into the following types [3]: a. Examinee may register with fake identity to get the exam instead of another person. b. Impersonation occurs when one examinee passes his/her security information to another, who uses to answer the exam on his/her behalf. c. The examinee may just login to an exam, and let another one answer the exam on his behalf. 2. Traditional cheating practices, as follows: a. An examinee might look around at the available resources or use storage devices from his/her personal computer. b. An examinee may use the internet utilities; either to use web browsers to search the answers of the exam questions, or to communicate with others using chat rooms or messengers. c. Also an examinee may get help from someone besides him/her when he/ she are taking the online exam. d. An examinee can use his/her cell phone to communicate with others or to use the internet or to take an image or answer of the exam questions. e. Where an examinee logins and answers the exam but with an assistant giving him the answers. 3. Others: There are some other methods in the way of establishing the online examination content which may lead to cheat in online examinations [4], which are: a. Examinee can obtain exam questions if there are not frequent questions (similar questions) in each exam or there is no huge question bank. So, an examinee can make questions file and distribute it to others. b. If the problem set appears at one time, an examinee may disconnect his internet connection as if there is an internet crash, getting the answers, and then coming back to solve the exam. 3.2 Security Requirements of Online Examination Systems The following security requirements have been used to measure security of any online examination system [5] [6]: • Accessibility: online exams should be available at anytime and anywhere. A New Remote Authentication Model for Online Examination Systems • • • • • 118 Authenticity: the online exam should be available only for valid examinees, also the examinee must be verified in every step of the online exam process to ensure that the examinee who is setting from the beginning of the online exam is the same person who is setting till the end of the exam. Monitoring: the absence of proctoring in online exams may relax and encourage examinee to cheat in order to get high scores. Secrecy: ensure that the data of the exam is private; only the authorized user who is allowed to take it. Also the problem set should be available to the examinees only during the exam period. Copy Detection: getting help from others, surfing the internet …etc., is a type of cheating which is used to copy the question and answer. Privacy: "The exam score process should be blind in order to obtain a maximum impartiality. Then, the teacher should not know the student identity of an exam answer. However, the teacher must be convinced that the answer belongs to the valid student" [7]. 3.2.1 Examinee Security Examinee security is a main issue in online exams to ensure that the test taker is the valid person who answers the online exam. Examinee security divides into two parts (Authentication and Identification) [2]. Identification is a subset of authentication, but as shown in fig 2; authentication does not act as identification. Identification is the process of determining whom the test taker is actually, which may be achieved by using a unique factor to verify user identity such as tokens, smart cards, dongles…etc. Authentication refers to the process of making sure that the examinee who takes the online exams from the beginning to the end is the same person. Figure 2: Existing e- assessment user security [2] Identity Authenticati on Who are you? Is it really you? • [3]". Authentication factors: Authentication is divided into three factors; as follows [8] [9]: a. Knowledge Factors: which prefers to something examinee knows (e.g. a password) which others should not know b. Ownership Factors: something examinee has; examinee should own something unique that others do not have, such as tokens, dongles, keys or cards. Unauthorized parties cannot access users’ information unless they obtain this token. c. Inherence Factors: they have two main methods: o Something examinee is: something authenticates the examinee in the online exam such as fingerprint, voiceprint, retinal pattern and DNA sampling...etc. o Something examinee does: this type depends on examinee's behavior Such as handwriting and typing rhythm which called keystroke dynamics. "Inherence factors are efficient for continuous examinee authentication in online examination 119 Ghada Ashraf El Sayad, Moustafa Abd El Aziem and Essam El Dien El Fakharany A Password Authentication (something examinee knows) The username & password are used mostly for basic authentication to authenticate the examinee to access the examination session. But this method is very poor and unsecured as they can be easily stolen or passed to another person to access the exam instead of the original examinee. Only online exams at test centers can use this method to authenticate test taker, because there is the human proctor who is responsible for verifying the test taker identity & authenticity [8]. B Token Authentication (something examinee owns) Token is a device that is used to identify the examinee by his/her digital signature certificate. Digital signature certificate looks like license that is used for digitally signing and encrypting documents, or for emails and online transactions. The digital signature certificate contains information about both of the user and the Certificate Authority (CA) that issues this certificate (owner name, e-mail, country, CA's name, the date that the certificate issued in, expiration date of this certificate, public key of the owner). The benefits of using this technique are: (1) proof of the identity of the sender, (2) proof of the integrity of the message that it has not been altered after sending it, and (3) the sender can not deny that he/ she sends this message. C Biometrics Authentication (Something examinee is, and Something examinee Does) Biometrics is an accurate method to verify examinee authenticate before and during the online exam. There are two types of biometrics; physical biometrics: physical characteristics such (fingerprint, face recognition, iris scan…etc. and behavioral biometrics which are means such as keystroke dynamics and voice recognition [10]. • Fingerprint Authentication; is the mostly used method in different domains. In enrollment process, examinee applies his/her fingerprint scan as an authentication template to be able to access the online exam. It is impossible to find two persons have the same fingerprint, so it is a trusted method of authentication [11]. • Keystroke dynamics Authentication; means the behavior of the examinee in typing the text on the keyboard. As known, every person has his own way to type on the keyboard keys. Examinee typing behavior can be stored as a signature or an authentication template stored in the database and used for later verifying his/her authentication [12]. 4. ROES Model The Remote Online Examination System (ROES) model is an enhancing model from a previous proposed model called Interactive and Secure E-Examination Unit (ISEEU) model [3]. 4.1 ISEEU Model Interactive and Secure E-Examination Unit (ISEEU) model combines live video surveillance for monitoring the test taker and a bimodal biometrics authentication (Fingerprint combined with keystroke dynamics) for continuous authentication. There are limitations of this model which are: a. ISEEU model that can be used in test centers where the examinee can proof his/her identity. So the model does not achieve the first security requirement which is accessible. b. At the final stage of the examination (grading process), the instructor knows the identity of the examinee who answered the online exam; which means the model also does not achieve the privacy as a secure requirement of the online examination system. A New Remote Authentication Model for Online Examination Systems 120 4.2 The ROES Model The ROES model focuses on the second type of online examination system types (remote online examination system). Also ROES model depends on fingerprint and keystroke dynamics as biometric authentication techniques. The ROES model structure consists of a combination of the three authentication factors; password technique, token, bimodal biometrics (fingerprint and keystroke dynamics) and live video surveillance for monitoring the examination session as shown in fig. 3. Figure 3: ROES model structure Send the authentication feature to the server to be compared with the stored features Error message No Authenticatio n engine Examinee Yes Comparison Succeed Exam generation engine Token data, fingerprint, and keystroke processing server Student data Question Bank & correct answers Grading system Monitoring system Admin Question generation engine Examinee Admin/ Instructor The (ROES) model is proposed mainly to authenticate test taker remotely to allow him/her to take the online exam without regarding to a specific place or time. Also the model prevents examinee cheating before, during and after the remote online examination without using a human proctor. So the proposed model must achieve the following three objectives: 1. Identification issue: the model must verify the examinee's identity (who the test taker actually is). 2. Authentication issues: it has to ensure his/her authentication validity (the examinee who is taking the online exam at the beginning, is the same person during and at the end of the exam). 3. Continuous Monitoring issue which prevent test taker from cheating during the examination process. Also Continuous authenticated presence ensures that only correctly authenticated 121 Ghada Ashraf El Sayad, Moustafa Abd El Aziem and Essam El Dien El Fakharany students are continually present (from start to finish) for the duration of the test and taking the test un-assisted. The ROES model is operated by three main stages: Stage 1: Before the online exam (enrollment process) Before taking the online exam, the examinee has to register first to proof his/her identity by the following phases: • Phase 1: Request the online exam In this phase examinee does the following: a. Examinee downloads a soft copy of examination request form the examination portal. This form contains a private data about the test taker (a still photo of the examinee, examinee's name, mail, address, phone number…etc.). b. After filling in the exam request form, examinee attaches a scan of his/her governmental issued ID and signs them with his/her digital signature; by hashing the message content to reduce it to a fixed size to generate the message digest and then sign the message digest using his/her private key to generate the examinee's digital signature as shown in fig. 4. c. Then the examinee sends the signed content to the admin by mail. In this case a digital signature certificate is sent to the admin automatically. This certificate contains; owner name, e-mail, certificate authority that issued this certificate, the date in which the certificate issued, certificate expiration date, and owner’s public key. Figure.4: Examinee signs the examination form using his/her digital signature Registration form Encrypt using examinee's private key + + Examinee Hash Function Message Digest Scan of governmentalissued ID Examinee's digital signature Digital Envelop • Phase 2: Verify examinee's digital signature The admin does the following: a. When the admin receives the mail, he verifies examinee’s digital signature using examinee’s public key which located in the digital signature certificate as shown in fig 5. b. If verification succeeds, the admin stores examinee’s data in the database and creates a temporary username and password for the examinee to access his/her profile. Otherwise, failure mail. c. The admin signs the mail content with his digital signature using his private key as shown in fig. 5 and then sends the signed content to the examinee. A New Remote Authentication Model for Online Examination Systems 122 Figure 5: Admin verifies examinee's digital signature and then signs examinee's username & password using admin's digital signature + Admin Registration Governmental form -issued ID Examinee's digital signature Digital Envelop Hash Function Decryption Function Examinee public key Message Digest Message Digest Compare Yes Create examinee's username & No Succeed Failure mail Hash function Message digest Message content Encrypt using admin private key Admin digital signature Digital Envelope Phase 3: Apply examinee authentication In this process the examinee authenticates him /her to the system. He/she first verifies admin's digital signature and then signs into his/her profile using the temporary username and password. Then the following procedures are done: a. Examinee is asked to apply his/her fingerprint using a fingerprint mouse scanner attached to his/her PC to extract examinee's fingerprint feature and store it in the database. b. A still photo is captured by a high resolution camera and stored in the database. The webcam also used for video monitoring and also used to identify examinee's abnormal head motions, moving out from his/her place, or looking and focusing in out-of-site...etc. • 123 Ghada Ashraf El Sayad, Moustafa Abd El Aziem and Essam El Dien El Fakharany c. Some challenge questions (security questions) are asked to extract the examinee's keystroke dynamics feature and then it is stored in the database. After authentication succeeds, the examinee is moved to the next stage. Stage 2: During the online exam This stage is divided into four phases, as following: • Phase 1: Initialize the examination session After complete the registration process, the examinee is instructed to do the following: a. Insert his/her token. Token data is compared with the stored data in the database, if comparing succeeds, then the examinee is allowed to move to the next step. Otherwise, error message is appeared and exit. b. Examinee is asked to apply his/her fingerprint with the fingerprint scanner mouse to capture his/her imprint feature. The captured imprint is compared with the stored one in the database. If succeeds, the examinee is moved to the next step. Otherwise, error message is appeared and exit. c. A blank video window is appeared and then a still photo is captured to be compared with the stored one in the database. If comparing succeeds, then the examinee is moved to the next step. Otherwise, error message is appeared and exit. d. A training set of text is appeared and the examinee is asked to type it to extract s/her keystroke dynamic feature and then it is compared with the stored one in the database. If comparing succeeds, the start exam icon will be appeared to allow the user starting the online exam. Otherwise, error message is appeared and exit. • Phase 2: Start the online exam In this phase, the examinee is actually allowed to start the online exam. Examinee's PC must be lockdown just when the online test begins to prevent the examinee from trying to get help from the internet, Chat messengers, external or internal storage devices…etc. The following continuous authentication is done during the online examination process to assure that the examinee who starts the online exam is the same person who answers the questions and submits his/her answers: a. During answering the MCQ, or match questions (questions that need the mouse to answer them), examinee's imprint is captured and compared. b. In the case of answering essay questions, or complete questions (questions that need the keyboard to be answered), examinee's keystroke dynamics is extracted and compared. • Phase 3: Violations There are two types of violations, as following: a. System violation: occurs when there is any device does not respond or the internet is disconnected, so the online exam is paused for a defined time. If the examinee solves the problem, the exam is resumed. Otherwise the exam is ended. b. Examinee violation: occurs when the examinee violates in the exam rules; unmatched fingerprint with the stored one, unmatched keystroke dynamics, abnormal movements, the imprint or the keystroke dynamics not captured for a predefined time…etc. In this case the institution can limit the number of violates time after that the exam automatically ends with a zero grade. • Phase 4: Exam Ending The exam can be terminated by two ways: a. Normal termination: which occurs when the examinee submits his/her answers normally. b. Abnormal termination: occurs when the examinee violates more than the number of allowed times and the exam automatically ends with a zero grade. Stage 3: After the examination process (Grading process) After examinee's normal submission, there are two ways to grade the exam as the following: a. Auto grading the exam: occurs in the case of MCQ, matching questions that their answers are stored in the database. A New Remote Authentication Model for Online Examination Systems 124 b. Manual grading: it is difficult to expect how the examinee answers the essay questions, or even the incomplete questions (no specific answer can be stored in the database for auto grading these types of questions). So grading process depends on the instructor. The weakness of this case is that the instructor is assumed to be absolutely honest. To solve this challenge, using the PKI algorithm and the digital signature may play an important role to blind examinee's identity from the marker, so the grading process will be more honesty and efficient. 4.3 ROES Security Analysis We can apply security requirements of the ROES model and measured as following: • Accessibility: the examinee can take the online exam at anywhere and anytime that convinced him/her as mentioned in stage 2 (phase 1 and 2). • Authenticity: examinee can remotely proof his/her identity (using the digital signature with the governmental-issued ID) in stage 1 (phase 1 and 3) and authenticity (fingerprint, keystroke dynamics and face recognition features) as mentioned in stage 2 (phase 1). Also in stage 2 (phase 2) the system is continuous authenticate the examinee during the online exam to ensure that the examinee who is taking the online exam from the beginning to the end is one person. • Secrecy: the examinee is asked to insert his/her token which he/she has registered with to allow him/her to open his profile and then in stage 2 (phase 1) the exam session is initialized to ensure the authenticity of the examinee (fingerprint, keystroke dynamics and face recognition features), so only the valid examinee who can obtain the online exam questions at the allowed period of examination time. • Monitoring: the examination session is recorded during the examinee takes the online exam, so the examinee is monitored the online examination session by using the webcam to prevent him/her from using any cheating practices (such as using search browsers to get the answers of exam questions, chat messengers to communicate with others, getting help from someone around, using storage devices to get more information about the exam answers …etc.) that may be done to get high score. Also examinee's PC is locked down once the examination session begins. • Privacy: only the valid examinee can see his/her score, also in phase 2 of stage 3, the instructor or the marker receives the answers without identity and can't obtain the identity of the examinee who answers the exam. • Copy detection: before beginning the examination session, examinee's PC is locked down to prevent any cheating practices that may be done during the examination session include opening any search browser or chat messenger. 5. Implementation and Discussion of Experimental Result An experiment has been done on 100 students of AAST college students. Students noticed that there are many scenarios that may be done at before, during, and after the online examination process (which mentioned in the previous section), as following: 5.1 Security Attacks or Cheating Scenarios There are some security attacks which may be done in each stage of the online examination system stages as following: Stage 1: Before the online exam (Registration process) The security attack that may be done is the attack in authenticity, which called impersonation threat. Impersonation threats have several methods that the examinee can be used to cheat to get high 125 Ghada Gh Ashraf af El Sayad, Moustafa M Abbd El Aziem and Essam E El Dien Ell F Fakharany score (men entioned abo bove in sectio tion 3.1). The he impersona nation threatt that may oc occur in this is stage by several waays as follow ws: 1. The examin inee may regi gister with fak fake identityy and a fill fake ke data in the he online exam am request form to take ke the exam instead in of ano nother person. n. 2. One examin inee logs in using u his/he her security information in ((token, usern ername, and ppassword) and let ano nother comple lete the regis gistration proc rocess (applyi lying examine inee authentic tication) on his/her beha half to get thee online exam am instead off him/her. h Sta tage 2: Durin ing the online ne exam The here are sever eral securityy attacks a mayy be occurred ed in as follow ws: 1. Continuouss authenticity ity attack; occ ccurs either w when there is any authent ntication featu ature (video monitoring, g, fingerprint nt, or keystr stroke dynam mics) does not respond nd during the th online examination on session, or the authent ntication feat ature is not similar si withh the stored oone in the database. 2. Monitoring M attack; occu curs when the he examineee uuses traditio ional cheating ng practices to get high score (use search s brow owsers, chatt m messengers, rs, looks arou ound to gett iinformationn from the available resources, res gets ets help from pperson aroun und …etc.). 3. Attack in Secrecy, Se whic hich means tha that only thee vvalid examin inee who iss aallowed too oobtain the online exam m questions. Sta tage 3: After er the examina nation process ss Aft fter completi eting the exam amination ses ession, the ex exam is auto to graded inn case of the he MCQ or incomplete ete questionss which w havee a defined or possible an answers thatt ccan be stored ed in the datab tabase. And in case off tthe essay questions, qu a ma marker or teac acher is neede ded to mark this th type of qquestions. The he security attack a of thi his stage is th the attack in privacy which wh means ns that the ex exam score process sh should be blin lind in orderr to obtain a m maximum im impartiality,, sso the marke ker or teacher er must not know thee identity i of the th examinee ee who answer ers the exam.. 5.2 Experi erimental Res esult Each stude dent tried diff ifferent scena nario of secur urity attackss once o as an examinee e tak taking the onl nline exam and tryingg to cheat and nd other as a marker m whoo tries to know ow examinee' ee's identity.. T The following ing result is generatedd aand based on examineee aactivities: 56 49 0 55 40 60 50 40 30 20 10 0 Security Attacks Stag 3 Stage Stage 2 Number of failed Figure 6: Experimentaal result of number nu of stud tudents who tries tri to attackk oor cheat befo fore, during an and after the online exam mination proce cess Stage tage 1 The he previous figure fi explain ains the conclu clusion of this his experiment ent that explain ains that there re are three stages off the th online examination exa system. sy A New Remote Authentication Model for Online Examination Systems 126 In sage 1 (registration stage) there were 40 students tried to cheat in authenticity either by registering with fake identity, or logging in using the security information (token, username, and password) and let another complete the registration process (applying examinee authentication) on his/her behalf to get the online exam instead of him/her. In stage 2 (the system initialization and during taking the online exam process), there were three types of security attacks which are Secrecy (only valid examinee who can obtain the online exam questions), continuous Authenticity (proof that the examinee taking the online exam from the beginning to the end is the valid examinee that is allowed to take that exam) and Monitoring attack (using cheating practices as mentioned before). There were 49 students who failed in trying to take the online exam instead of another person. That means that either the token that connected did not coincide within the one that the student registered with. There were 55 students that either did not apply his/her authentication (examinee picture, finger print, or keystroke dynamics) during the online examination session, or the applied authentication feature was not similar with the stored one in the database. In addition, there were 56 students tried to use any of cheating practices that mentioned before. In stage 3, students acted as markers or teachers to mark the essay questions in the online exam. No student could know the identity of the examinee who answered the online exam that he/she marked it. 5.3 Comparative Study between ROES Model and Top 3 of the Existing Systems in the Market There are three top online proctoring systems in the market ("Kryterion", "Software Secure", and "ProctorU") [13]. Any institution can use these systems to get a high secure environment in its online exams. The following is a briefly matrix that defines the features of each system and compares these systems with ROES model. This comparison matrix is based on using the authentication methods and the monitoring methods: Table 1: Comparison Matrix between the three top Online Proctoring Systems in the market and the ROES model Comparison feature Authentication Factors Digital Signature Username/ password login Government-issued ID Photo comparison Keystroke Analytics Facial recognition Fingerprint Monitoring Methods Online proctor Video and audio recording for later review System lockdown Kryterion Software Secure ProctorU √ √ √ √ √ √ √ √ √ √ √ √ √ ROES √ √ √ √ √ √ √ √ √ √ √ √ As shown in the previous comparison, these systems are either useful only for test centers, where the examinee can proof his/her identity, or for universities that has large database stored data for their examinees (Accessibility limitation). The ROES model adds remote authentication model for remote online exams which serve both of the examinees and institutions that publish online exams. The examinees will be allowed to take the online exam remotely without regard to the fixed place or time. Also it will be less of cost, time, and resources and it will provide effective online examinations for the institutions to publish the online exams remotely in a secure environment. 127 Ghada Ashraf El Sayad, Moustafa Abd El Aziem and Essam El Dien El Fakharany 6. Conclusion This paper describes the ROES model which provides a secure online examination model that allows the examinee to take the online exam remotely (at anywhere that is convenient to him/her) and at any time by proofing examinee's identity, authenticity, and monitoring him/her remotely without the regard to an online human proctor either during registration stage or the examination session process. This model avoids the drawbacks of traditional (paper and pencil) exams such as cheating practices, wasting time, wasting resources …etc. The ROES model may be useful not only for university exams, but also may serve the other institutions that publish job exams or training exams for getting training certificates. References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] King, C.G., Guyette, R.W., & Piotrowski, C. "Online exams and cheating: An Empirical Analysis of Business Students Views", The Journal of Educators Online, 6(1), 2009. Kikelomo Maria Apampa, Gary Wills, David Argles, "User Security Issues in Summative EAssessment Security", International Journal of Digital Society (IJDS), Volume 1, Issue 2, June 2010. YousefSAB, ImaneSAROIT and AmiraKOTB, "Synchronous Authentication withBimodal Biometrics for e-Assessment: A Theoretical Model", 6th international conference on sciences of electronics, technologies of information and telecommunications (SETIT), sousse 21-24 March 2012. Cluskey Jr., G. R.; Ehlen, Craig R.; Raiborn, Mitchell H., "Thwarting online exam cheating without proctor supervision", Journal of Academic & Business Ethics, Vol. 4,Jul 2011. Naresh.Chiranji, 2CH.Deepthi, 3T.P.Shekhar, "A Novel Approach to Enhance Security for Online Exams", International Journal of Computer Science and Technology, IJCST Vol. 2, Issue 3, September 2011. B.Persis Urbana Ivy, A.shalini, A.Yamuna, "Web Based online Secured Exam", International Journal of Engineering Research and Applications (IJERA), Vol. 2, Issue 1,Jan-Feb 2012. Castell`a-Roca.J, Herrera-Joancomarti.J and Dorca-Josa.A, "A Secure E-Exam Management System", "Proceedings of the First International Conference on Availability, Reliability and Security", 2006. Lawrence O’Gorman, "Comparing Passwords, Tokens, and Biometrics for User Authentication", Proceedings of the IEEE, Vol. 91, No. 12, Dec. 2003.. Dr. R. Shesha dri 1 T.Chalama Reddy 2 N.Ashok kumar 3, "Web-based-secure Online Nonchoice –based Examination System (WONES) using Cryptography", International Journal on Computer Science and Engineering (IJCSE), ISSN : 0975-3397 Vol. 3 No. 10 October 2011. K P Tripathi, "A Comparative Study of Biometric Technologies with Reference to Human Interface", International Journal of Computer Applications (0975 – 8887) Volume 14– No.5, January 2011. Liu Wei, Zhou Cong, Ye Zhiwei, "Fingerprint Based Identity Authentication for Online Examination System", 2010 Second International Workshop on Education Technology and Computer Science, 2010 IEEE. Eric Flior, Kazimierz Kowalski, "Continuous Biometric User Authentication in Online Examinations", 2010 Seventh International Conference on Information Technology, 2010 IEEE. David Foster, Harry Layman, "Online Proctoring Systems Compared", March 2013.