Recipient access point

Three types of access points at the user interface are common to all signature schemes (see Section 5.1.2, Granularity of Entities ) signer access points, recipient access points, and court access points. 

The most common transaction is authentication. The events at the signer access point and the recipient access point that form such a transaction are now described in detail. They are summarized in Figiure 5.4, and some reasons for the decisions follow after the figure. (Remember that an example of what may happen under the interface was shown in Figure 5.1.)... 

A dispute involves events at two or three access points a recipient access point, a court access point, and possibly the access point of the supposed signer. The supposed signer is defined as the one whose identity the court enters the adjective supposed is sometimes omitted in the following. The events described now are summarized in Figure 5.5, and some reasons for the decisions follow after the figure. 

An access point of a recipient or a court handles all the identities of signers. With simple signature schemes, this means that an entity of a recipient or a court handles all the public keys. This has the advantage that the administration of the relation between identities of signers and public keys is hidden inside the system. 

If related inputs at several access points are necessary, for instance the signer s command to sign and the recipient s command to test in Figure 5.1, they are assumed to occur in the same round. 

Disputes are between one recipient, one court, possibly one signer, and possibly all the centres. Thus all the access points of all new types may take part. The court s conclusion in a dispute may not only be that the message was or was not authenticated, but also that a certain subset of the centres is to blame. 

Secondly, from a purely theoretical point of view, consider what would happen if the identity was an input in such a service If the specification would really permit all identities at all access points, everybody could enter the identity of somebody else. Hence there would be no security in the intuitive sense of the real world. (This cannot be avoided by declaring something as the identity that someone else cannot enter, such as a password or biometric information The recipient and the court have to know an identity of the signer, and it is this very identity this paragraph deals with, because the requirements have to express facts like if a signer with a certain identity did not authenticate a message, no court should believe that the signer with this identity did .)... 

For the case where a user can sign under several identities, one might have defined access points that handle a certain number of identities and where the currently used identity is an input (whereas in the definition above, such a user needs several access points — of course, they can be implemented on the same device). However, in practice, a signer would not want to input an identity, i.e., the string under which recipients and courts know her, but a local identifier such as sign for bank or sign for credit card . This corresponds to the way access points are selected in software. 

One could have distinguished inputs init as signer , init as recipient , and init as court however, the same information is implicit in the types of the access points. 

Formal predicates. The first predicate models that the user with identity id tries to start initialization for the signer idg in the current round. It reflects that initializations for id cannot be attempted at signer access points other than idg. The parameters ids if and N are the set of possible recipients and the message bound that this user wants. 

Local transactions, i.e., transactions involving only one access point, can be added quite easily to most schemes. For instance, a transaction where the signer asks how many messages can still be authenticated at a certain access point is useful. Recipients might also be interested to know with which signers they have already carried out initialization and what authenticated messages they have received. 

Generalization. Both models presented above consider active attacks on all types of access points, i.e., not only on signers, but also on recipients and courts. 

The other reason is that, as mentioned in Section 5.2.9, a fiill fail-stop signature scheme is closely related to a scheme with special risk bearers where each user who acts as a signer, recipient, or court, also has a risk bearer s access point available. In fact, if a scheme is given where an arbitrary number of risk bearers can take part, one can constract a fiill fail-stop signature scheme as follows Each entity of the new scheme consists of two parts one part acts like a risk bearer s entity and the other like an entity of a signer, recipient, or court, respectively, from the underlying scheme. As risk bearers entities only take part in initialization, this only concerns the program parts for initialization (if those can be identified statically). The outer parts of all entities must handle the fact that the two parts share their ports. 

Actually, the difference could not be seen at all in previous definitions and constructions, because there was no notion of entities and access points, only of algorithms and people. However, this often led to the notions of recipients and risk bearers being mixed up. 

Taking into account the conclusions of the analysis of literature study area (reliability system) was assumed to have not been shown explicitly complex mathematical relationships that could be used to estimate the state of airworthiness man-machine system. There are grounds to conclude that the commonly used commercial solutions and research and implementation for many years used a piecemeal approach to achieve and maintain the declared level of airworthiness technical object (the system and its component) for continuoustime ability to implement services. The attention is focused on the analysis and synthesis of selected aspects of the research problem. Not defining numerical indicators and not taking into account technical and functional capabilities CTS and the effects of the conditions and environmental exposures and human origin. In addition, notes the lack of a clearly definite influence are methods of access to the system, data transport mechanisms and guarantee the level characteristics (i.e., reliability, safety, quality, efficiency, etc.) are important from the point of view of the system and the user who is the recipient of its products. This type of approach, particularly in the structures of the system, is focused on one or a few acquaint criteria. 

---