A User Centric Security Model for Tamper-Resistant Devices

6.6 Analysis of the Proposed Protocols
with the activation of the downloaded application only after this message is received by
the smart card.
The SP will only register the leased application to access the SP's services once it is
activated by the smart card. On activation, the application dials back to the SP's server.
On receipt of the conrmation that the application is active, the SP will sanction the
application to access the provided services. The contractual agreement messages provide
the assurance that a smart card and an SP have communicated with each other through
the STCP ACA . During this protocol, the smart card assures the SP about its security
and reliability mechanisms, and they are accepted by the SP. The SP has then leased its
application, which was downloaded onto the smart card without any error.
6.6.2 CasperFDR Analysis of the Proposed Protocols
The intruder's capability modelled in the Casper scripts (appendices B3, B4, and B5) for
the proposed protocol is as below:
1. An intruder can masquerade as any application's identity in the network.
2. An intruder is not allowed to masquerade as an SP or TEM.
3. An intruder application has a trust relationship with the TEM.
4. An intruder can read the messages transmitted by each entity in the network.
5. An intruder cannot inuence the internal processes of a communicating entity (agent)
in the network.
The security specication for which the CasperFDR evaluates the network is as shown
below. The listed specications are dened in the #Specication section of appendices B3,
B4, and B5:
1. The protocol run is fresh and both applications were alive.
2. The key generated by the SP and SC is not known to the intruder.
3. Entities undergo mutual authentication and key assurance at the conclusion of the
protocol.
4. The long term keys of communicating entities are not compromised.
5. The user's identity is not revealed to the intruder.
151