The Secure Transaction Protocol (STP) is a two party protocol that provides
authentication, integrity, privacy,
atomicity, isolation and
causality.
In STP, a process
may engage in many concurrent transactions with
other system processes.
Each process in the system has a
unique identity (UID) and a set of identity certificates.
The identity certificate used for a transaction is a
function of the UID of the other process in the transaction.
Logically, an identity certificate for a process contains the UID and a signature verification key for that process. The identity certificate is also used to derive the signature key used by the process itself for the transaction. The sender uses the signature key to sign (authenticate) each message, while the receiver uses the verification key to validate that signature. The concepts of signature key and signature verification key map easily to either asymmetric or symmetric cryptography.
Each transaction in the system has a unique identifier (TID). For each transaction in which a process participates, the process stores the UID of the other process, the data messages sent and received during that transaction and the state of the transaction. The process also stores the other process's signature verification key to be used during the transaction.
Last, the process maintains the context for each active transaction. It is computed as the signed, cryptographic message digest of all data sent or received thus far in the transaction. It is included in all data messages so that the data being sent is effectively represented as the result of previous messages.
During the initialization phase of a normal transaction, one process attempts to begin a transaction with another. The second process may accept or reject the transaction.
If the second process accepts, the transaction enters the exchange phase. The processes begin transmitting data alternately, using a half duplex protocol controlled by a send token.
When the data transfers are complete, the transaction enters the termination phase. If the process with the token wishes to commit the transaction, it sends the other process a commit message. If the second process agrees, it returns its own commit message and the transaction is terminated successfully.
These message transfers are depicted in Figure 1.
This protocol assumes that the underlying message transport mechanism will provide reliable, ordered communication except in the presence of persistent media failures or in the event of an adversarial attack. If the communication channel cannot confirm the correct delivery of a message, it will return a fault exception to the process. Messages deleted by an adversarial process will be detected by the channel, while inserted or altered messages must be detected by the receiving process.
In the following sections, we define STP in terms of protocol messages, state and transitions. Messages define the state which can be communicated between processes, state defines discrete and specific points in protocol processing, and transitions define the relationship between messages and state. Lastly, we define the protocol itself, using the Abstract Protocol language, from [4].
