# SPCL: A Smart Access Control System That Supports Blockchain
## 2 SPCL Overview
### Security Model  
We utilize the eCK security model [26] to analyze our proposed scheme. Let \(A,B,C,\cdots\) represent the communicating parties; \(n\) represents the total number of parties; \(sid\) represents the session identifier of a completed session; and \(msg_{\mathcal{A}},msg_{\mathcal{B}},\cdots\) represent the messages sent by \(A,B,\cdots\). The eCK security experiment is conducted by an adversary \(\mathcal{M}\) against an AKE protocol \(\pi\) with a challenger \(\mathcal{C}\), which captures real-world attacks through the queries issued by \(\mathcal{M}\):  
* \(Send(A,B,msg_{\mathcal{A}},msg_{\mathcal{B}})\): This query allows \(\mathcal{M}\) to run the protocol by sending message \(msg_{\mathcal{B}}\) to the session \((\mathcal{A},\mathcal{B},*,*)\). It returns the next message according to the protocol conversation so far.
* \(E\)_E_p_em_eral_Key_Revel(\(sid\)): This query returns the ephemeral private keys held by the session \(sid\) to \(\mathcal{M}\).
* \(SessionKeyRevel(\(sid\)): This query return the session key for a session \(sid\) to \(\mathcal{M}\).  
Figure 1: System architecture of SPCL.  
* _LongTermKeyReveal(A)_: This query returns the long-term private key of party \(A\) to \(\mathcal{M}\).
* _Test(sid)_ : At some point, \(\mathcal{M}\) selects one session _sid_ for a _Test_ query. This session _sid_ must be fresh. (defined in Definition 1).  
**Definition 1** (Fresh Session).: _Let sid owned by an honest party \(\mathcal{A}\) with peer \(\mathcal{B}\), and \(\mathcal{B}\) is also honest. Let sid\({}^{*}\) be the session identifier of the matching session (defined in Definition 2) of sid, if it exists. The session sid is fresh if none of the following conditions hold:_  
1. \(\mathcal{M}\) _is issues SessionKeyReveal(sid) or SessionKeyReveal(sid\({}^{*}\)) query (if sid\({}^{*}\) exists);_
2. \(\mathit{sid}^{*}\) _exists and_ \(\mathcal{M}\) _makes one of the following queries:_ * \(\quad\)__\(\bullet\quad\)__\(\mathit{LongTermKeyReveal(A)}\) _and_ \(\mathit{EphemeralKeyReveal(sid)}\)_, or_ * \(\quad\)__\(\bullet\quad\)__\(\mathit{LongTermKeyReveal(B)}\) _and_ \(\mathit{EphemeralKeyReveal(sid^{*})}\)_;_
3. \(\mathit{sid}^{*}\) _does not exist and_ \(\mathcal{M}\) _makes one of the following queries:_ * \(\quad\)__\(\bullet\quad\)__\(\mathit{LongTermKeyReveal(A)}\) _and_ \(\mathit{EphemeralKeyReveal(sid)}\)_, or_ * \(\quad\)__\(\bullet\quad\)__\(\mathit{LongTermKeyReveal(B)}\)__  
**Definition 2** (Matching session).: _The party executing the session is called the owner of the session and the other party is called the peer. Two sessions: sid owned by \(A\) with peer \(B\) and sid\({}^{*}\) owned by \(B\) with peer \(A\), are matching sessions if all messages sent (or received) by \(A\) are identical to those received (or sent) by \(B\)._  
In the eCK security experiment, \(\mathcal{M}\) plays with a challenger \(\mathcal{C}\) of a hard problem as follows:  
* Queries: \(\mathcal{M}\) makes queries as defined aforementioned at will.
* Test: \(\mathcal{M}\) chooses a fresh session as the _Test_ session.
* Queries after test: \(\mathcal{M}\) makes queries as in _Queries_ step but cannot query the _Test_ session.
* Guess: \(\mathcal{C}\) flips a fair coin \(b\in\{0,1\}\), and returns \(\mathcal{M}\) with the session key held by _sid_ if \(b=1\), or a random string of the same length otherwise. \(\mathcal{M}\) outputs \(b^{\prime}\in\{0,1\}\). \(\mathcal{M}\) wins the eCK experiment if \(b^{\prime}=b\).  
**Definition 3** (eCK security).: _An AKE protocol \(\pi\) is eCK-secure if the advantage for all probabilistic polynomial time (PPT) adversary \(\mathcal{M}\) against \(\pi\) in winning the eCK experiment, denoted by_  
\[\mathbf{Adv}_{\pi}^{\mathrm{AKE}}(\mathcal{M})=\mathit{Pr}[\mathcal{M}\ \mathit{ wins}]-\frac{1}{2},\]  
_is negligible._