A User Centric Security Model for Tamper-Resistant Devices

6.3 Secure and Trusted Channel Protocol Service Provider
The SP generates a random number N SP and computes the Die-Hellman exponential
g r SP . The SPSup deals with the capabilities of the SP along with the details of how it
will authenticate the user (e.g. password, biometric, or token based authentication, etc.).
These details communicate to the smart card the way the SP would like to perform the user
authentication. The MAC f kSP (g r SP
||N SP ||SC IP ) serves as a session cookie (SI), and it
is appended with each subsequent message sent by the smart card. It indicates the session
information and facilitates protection against DoS attacks. Finally, the SP will request the
smart card to provide an assurance that its current state is the same as it was at the time
of third party evaluation by sending the V R. The V R indicates whether the SP requires
an oine or online attestation (section 4.5) to be performed by the smart card.
If the smart card does not support the Die-Hellman group selected by the SP (SP Sel ),
then it will send a rejection message, including a list of groups supported by the smart card
(SC Sup ). If the smart card supports the selected group (i.e. SP Sel ), then it will proceed
with the second message. The SC generates a random number, and a Die-Hellman
exponential g r SC . It can then calculate the K which is the shared secret from which the
rest of session keys (k SC−SP and mk SC−SP ) will be generated. Furthermore, in a similar
manner, we can generate more session keys for the application download protocol [170].
STCP SP -2. SC : hs = h(SC i ||SP i ||g r SC
||g r SP
||N SP ||N SC )
SC : AU SC = Sign SC (SC i ||SP i ||V M||hs)
SC : mE = ek SC−SP (AU SC ||Cert SC )
SC → SP : g r SC
||N SC ||SC Config ||mE||f mkSC−SP (mE)||SI
The type of validation mechanism the TEM executes will depend upon the choice of the
SP, which will generate a (valid) signed message if the attestation is successful. In the case
of online attestation, the SC receives a validation message (V M) from the respective CM,
and it will include V M in the AU SC message. If the SP selects oine attestation, then
the V M will not be included. Beside VM, the signed message also includes the identities
of the smart card and the SP, along with the hs. The hs includes the identities of the
communicating entities, the generated Die-Hellman exponentials and random numbers.
The hs veries to the SP that SC has used the same values (e.g. Die-Hellman exponentials
and random numbers) as the SP, thereby avoiding potential man-in-the-middle
attacks. The signed message AU SC will be dierent if the state of the platform is modied;
therefore, by verifying the signature the SP can ascertain the current state of the platform
(in oine attestation mode). In the case of online attestation, the CM will not issue V M
to the SC and the SC will not be able to proceed with the protocol. In the message, the
SC includes SC config that provides the SP with the conguration of the SC including
supported cryptographic algorithms and APIs.
On receipt of message two, the SP will check the hs to avoid main-in-the-middle and replay
attacks, and it will then check whether the SC Config satises SP's ALP. Subsequently, it
137