Editing P2p mobile carriers (section)

== 12.1. Low-latency service sharing contract ==

* In this secret contract a '''seller''' wants to sell access to mobile credit on their plan to an unknown '''buyer.'''
* The '''buyer''' doesn’t trust the '''seller''' to provide this service faithfully and assumes they will attempt to degrade service where ever possible.
* Likewise– the '''seller''' doesn’t trust the buyer to pay for it.

'''The following contract can be used:'''

# '''Seller''' pays a small amount into a contract to register an account. They will use this as a sybil-proof identity in future agreements.
# '''Seller''' and '''Buyer''' agree on the terms of the exchange such as (credit / price, and expiry time.)
# A new secret contract (SC) is created that houses the agreement code.
# '''Seller''' inputs credit amount, SIM key, IMEI, IMSI, and T-IMSI -&gt; SC.
# '''Buyer''' calls SC.deposit(credit * price (T)). The contract is now pending '''buyer''' acceptance and has a timeout (T.)
# '''Buyer''' uses SC.get_auth_response(rand) to login to GSM. Carrier-specific codes are now sent out to check the balance remaining on the account and expiry dates. These messages must be generated through SC as the '''Buyer''' doesn’t yet have the integrity key.
#* IF the balance == '''Seller''' credit AND expiry == '''Seller''' expiry, then the buyer calls SC.accept() and the contract proceeds to step 7.
#* ELSE, '''Buyer''' calls SC.decline(gsm_received_credit_details) which checks the integrity of the input (if it can) using the internal SIM secret to compute an integrity key.
#** IF input is a valid message then the '''Sellers''' account is '''BANNED''' from the network for wasting the '''Buyers''' time.
#*** '''Buyers''' deposit bond is fully released.
#* IF T elapses without an accept() or decline() from the '''Buyer''', the '''Buyer''' receives a small penalty from their deposit bond for wasting the *Sellers** time and the rest of their bond is released.
# When T elapses AND SC has been accepted, the integrity key is released to a trusted processor on '''Buyers''' mobile. Running within this processor will be software that restricts the '''Buyer.''' Controlling:
#* LOCATION UPDATES
#* Browser and network activity.
#* Service access on GSM
#* [[File:P2p mobile carriers 6.png|thumb]]Billing
#* Etc
# If the '''Buyer''' wants to update their location they must do the following to avoid race conditions with the '''Seller''':
#* Indicate an intention to update the VLR in SC. The SC.state changes to pending and a timer starts, LT. SC releases an integrity stamped update message to '''Buyer'''. During this time the secure processor doesn’t allow other messages to be signed.
#* Issue a VLR update on the GSM network and obtain the ack values.
#* Wait for the timer to elapse.
#* Send a GSM status message to check if still connected:
#** Processor returns signed_remaining_credit -&gt; RC.
#** If not OR LT timeout, processor restricts the '''Buyers''' access and buyer calls SC.finish(RC). SC won’t allow re-auth from '''Buyer''' in this state, either. The channel has now closed.
#*** The SC.state changes to finished.
#** ELSE call SC.continue(VLR proof value, RC).
#*** Return failure if VLR proof value has a bad integrity value and isn’t a valid response using the old T-IMSI.
#*** Change SC.state to “locked-in.”
# When the '''Buyer''' is done using the service, they may call SC.finish(RC) to close the channel. SC.state changes to finished.


<span id="detecting-contract-breach-by-a-seller-algorithm"></span>