A User Centric Security Model for Tamper-Resistant Devices

4.6 Device Ownership
3. On verication of the credentials, the UCTD checks the mode of platform assurance
and validation selected by the user. The supported modes are oine and online
attestation (section 4.3.5). Depending upon the user's choice the UCTD proceeds
with the security attestation process.
4. Once the assurance validation is communicated to the CAMS, the user can compare
the smart card features with those stated by the card manufacturer at the time
of purchase. If satised, the user will provide her credentials and they are used
to authenticate the user to the UCTD for management operations (e.g. application
installation, deletion, and registration with an administrative authority) discussed in
chapter 5. The credentials can be based on a Personal Identication Number (PIN),
a password, a pass-phrase, or biometric data [137][139] depending upon the card
manufacturer, and user's requirements.
The ownership delegation process is used when a user relinquished control of a UCTD to
re-sell or scrap the device. The process is similar to ownership acquisition but this time the
user requests ownership delegation that will delete the user's space and any applications
she has installed in it.
4.6.4 Key Generation
Individual smart cards have a unique set of cryptographic keys that the card uses for
dierent protocols/mechanisms during its lifetime. Therefore, after the hardware fabrication
and masking of the SCOS is completed [5] the card manufacturer initiates the key
generation process.
Each smart card will generate a signature key pair that does not change for the lifetime of
the smart card. The smart card signature key pair is certied by the card manufacturer,
and it is used to provide oine attestation (section 4.5). Furthermore, in the certicate
hierarchy shown in gure 4.3, the smart card signature key pair is linked with the PAC via
the card manufacturer's certicate. The reason for this is that a malicious user might copy
a PAC that belongs to a genuine device and put it on his tampered device and when an SP
requests security assurance from the tampered device, it provides the (copied) PAC of a
(trusted) genuine device. By ensuring the PAC is tied to genuine devices by the certicate
hierarchy shown in gure 4.3 we can avert such scenarios.
As discussed in section 4.4.2.1, the evaluation authority issues a certicate (e.g. a PAC)
which certies that the signature key of the card manufacturer is valid only for the evaluated
product. If an adversary can get hold of the manufacturer's signature key pairs then he
100