A User Centric Security Model for Tamper-Resistant Devices

6.2 Secure Channel Protocols
SOG-16. Simulator Attack Resilience: This attack discussed in [85] allows a malicious user
to masquerade as a smart card platform on a computer (as a simulation). Such
a possibility would enable the malicious user to download an application onto
a simulated platform and then perform reverse engineering on the downloaded
application, revealing proprietary and sensitive data of the application. Therefore,
the proposed protocols should take into account the simulator attack and support
countermeasures.
SOG-17. Platform & Application User Separation (PAU) Attack Resilience: This attack is
discussed in [85]. A malicious user provides the access credentials of a genuine user
to an SP and downloads an application onto his or her smart card. Any protocol
should tie a platform with its card-owner (user) to avoid platform & application
user separation attack.
SOG-18. Contractual Agreement: On the successful execution of the protocol, the communicating
entities will mutually sign a contractual agreement. This will act as
proof that a particular application was installed on a smart card.
SOG-19. Proof of Transaction: The smart card will notify the TSM about the application
installation. Depending upon the TSM's policy, it will charge the user's account
and notify the smart card to activate the application so it can execute.
For a formal denition of the terms (italicised) used in the above list, readers are advised
to refer to [146]. The requirements listed above are later used as a point of reference to
compare the proposed protocols in table 6.2 (section 6.6.3). From an operational point
of view, an STCP for the user management architecture (section 5.4.2) for the UCTD
environment has two variants: STCP SP and STCP SC discussed in sections 6.3 and 6.4,
respectively. On the other hand, in an STCP for the CASC, the administrative management
architecture (section 5.4.1) requires the inclusion of an administrative authority and
to accommodate this, we propose an Application Acquisition and Contractual Agreement
STCP (STCP ACA ) in section 6.5.
6.2.4 Protocol Notation and Terminology
The notation used in the protocol description is listed in table 6.1 below. This notation is
an extension of the notation described in table 4.2.
Table 6.1: Protocol notation and terminology
Notation Description
U Denotes a smart card owner (user).
AD Denotes the administrative authority (section 5.4.1).
133