A User Centric Security Model for Tamper-Resistant Devices

B.6 Application Binding Protocol Local
SKey : Agent -> SecretKey
realAgent : Server -> Bool
{math}InverseKeys = (ksc, ksc), (abKsc, abKsc), (ServerKey, ServerKey),(VKey, SKey)
emph{}
#Actual variables
CApp, SApp, MAppl : Agent
TM : Server
Nc, Ns, Nm : Nonce
Ksc, ABKsc : SessionKey
InverseKeys = (Ksc, Ksc), (ABKsc, ABKsc)
emph{}
#Processes
INITIATOR(C, TPM, S, nc) knows f(S), ServerKey(C), SKey(C), VKey
RESPONDER(S, TPM, C, ns, abKsc) knows f(C), ServerKey(S), SKey(S), VKey
SERVER(TPM, ksc) knows ServerKey
emph{}
#System
INITIATOR(CApp,TM, SApp, Nc)
RESPONDER(SApp,TM, CApp, Ns, ABKsc)
SERVER(TM, Ksc)
emph{}
#Protocol description
0. -> C : S
1. C -> S : C, S, {C, S, nc, {C, S, nc}{ServerKey(C)} % mTPM}{SKey(C)}
2. S -> TPM : S, TPM, C, {S, C, ns}{ServerKey(S)}, mTPM % {C,S,nc}{ServerKey(C)}
[realAgent(TPM)]
3. TPM -> S : TPM, S, {f(S), ksc, nc}{ServerKey(C)} % tpmC
[realAgent(TPM)]
3a. TPM -> S : TPM, {f(C), ksc, ns}{ServerKey(S)}
4. S -> C : S, C, tpmC % {f(S), ksc, nc}{ServerKey(C)}
4a. S -> C : {abKsc, nc, ns}{ksc},{S, C, nc(+)ns}{abKsc}
5. C -> S : C, S, {nc(+)ns}{abKsc}
emph{}
#Specification
StrongSecret(TPM, ksc, [S,C])
Aliveness(S, C)
Aliveness(C, S)
StrongSecret(S, abKsc, [C])
Agreement(S, C, [abKsc])
Agreement(C, S, [abKsc])
emph{}
#Inline functions
symbolic ServerKey
symbolic VKey, SKey
realAgent(TM)=true
realAgent(_)=false
emph{}
#Intruder Information
Intruder = MAppl
IntruderKnowledge = {CApp, SApp, MAppl, Nm, ServerKey(MAppl), SKey(MAppl),VKey}
248