A User Centric Security Model for Tamper-Resistant Devices

6.5 Application Acquisition and Contractual Agreement Protocol
The ActApp acts as an application activation message and it will be included in message six
as an optional parameter (OP). In this scenario, the last two messages will be redundant
and will not be executed. The session keys k SP −AD and mk SP −AD are generated from
long terms keys shared between the SP and AD. Similarly, the session key k SC−AD is also
generated from the long term key shared between the SC and AD
The SP will generate the contract message (spc) that certies to the SC that the SP is
satised with the current state of the SC and the downloaded application.
The SC will verify the spc. Subsequently, if the SP is a member of the AD syndicate,
then it will verify the OP. If the SP is not a member of the AD syndicate then the SC
will proceed with the following messages.
STCP ACA -7. SC : mE = ek SC−AD (AD i ||SC i ||U i ||AppDoD||N ′ SC )
SC → AD : SC i ′||mE||f mkSC−AD (mE)||SID AD−SC
When the SP is not a member of the AD, the user requires the AD to issue the ActApp.
The SC will request the AD to issue ActApp by sending message seven. The SC will use a
one-time pseudo card identity (SC i ) so that an eavesdropper would not be able to retrieve
the SC i . The SC will encrypt the message containing the identities of AD, SC, and user.
It then appends the application details (AppDoD) and a new random number generated
by the SC. The AppDoD will not have any details of the application that can help the AD
to uniquely identify either the SP or the application. It will include the memory occupied
by the application along with a pseudo identity, and if the AD charges the user according
to the space usage then this data will be used to calculate the charge. Finally, the SC
uses the one-time SID AD−SC that is generated in previous protocol runs with the AD,
to provide authentication credentials and possibly avoid a DoS attack on the AD's server.
The SID is an abbreviation for session identier and we have discussed it in section 4.7.5.
On receipt, the AD veries the SC i ′ and associated SID AD−SC . After verication, it will
retrieve the long-term shared keys, verify the MAC, and decrypt the message. Depending
upon the AD's policy, it will proceed with the charge that might include billing the user's
account or credit/debit card.
STCP ACA -8. AD : ActApp = AppDoD||AD i ||SC i ||U i ||N AD ||N
SC
′
AD : pd = chm||chv||pm
AD : tc = Sign AD (pd||ActApp)
AD : SC i ′ = h(AD i ||SC i ||N ′ SC ||N AD)
AD : SID ′ SC−AD = f k AD
(SC i ′||AD i ||SC i )
AD : mE = ek SC−AD (tc||CertS AD ||SC i ′||SID ′ AD−SC )
AD → SC : mE||f mkSC−AD (mE)||SID AD−SC
145