one of the MCVs fails, then the other MCV will detect the failure of its companion. If the
memory capacity of ISMCPU exceeds that of HC, then the EMCV may be required to fill
ISMCPU memory during the test, to guarantee that IMCV does not sabotage the test by
spoofing (pretending to be the HC).
SNC must be authenticated. Each must possess an appropriate private key and certificate.
Similarly, the boundary controller itself must be authenticated by the SNC, else a connection
might be made to a counterfeit enclave.
which will use them. The user’s keys and certificates, on the other hand, are usually kept in an
identification token which is carried by the user.
devices contain their own CPUs and software, and (in some cases) their own power sources
(batteries) and clock-calendars. Their main functions are:
key can be read from such a device, then the device could be cloned and would not be a reliable
form of identification. If the clock-calendar were to be changed, then the expiration dates on
certificates could be avoided. Since the token’s CPU must know the keys and certificates to sign
and verify, the CPU itself must also be resistant to tampering and observation.
give them additional information. This additional information might be a secret password or
number, or it might be a digest of the owner’s scanned retina or fingerprint. This precaution
makes it more difficult to impersonate a user by stealing his or her identification token.
arbitrary document to be signed by the user’s token. The token, in turn, will expect the user to
provide the additional secret information (password, number, or scan). Then the token will sign
the document and return it to the remote boundary controller for signature verification.