The paper introduces a formal security model for a microprocessor hardware system. The model has been developed as part of the evaluation process of the processor product according to ITSEC assurance level E4. Novel aspects of the model are the need for defining integrity and confidentiality objectives on the hardware level without the operating system or application specification and security policy being given, and the utilization of an abstract function and data space. The security model consists of a system model given as a state transition automaton on infinite structures and the formalization of security objectives by means of properties of automaton behaviors. Validity of the security properties is proved. The paper compares the model with published ones and summarizes the lessons learned throughout the modeling process.

We present a modified version of the BAN logic which is implemented in PROLOG. The modifications are motivated by the analysis of a lot of protocols. We analyze a challenge-response protocol and its dual version in order to show the advantages of the modified logic. The analysis shows an interesting difference between two protocols which seem to be very similar. Finally, we discuss the inability of the logic to handle parallel protocol runs.>