A User Centric Security Model for Tamper-Resistant Devices

7.1 Introduction
7.1 Introduction
Multi-application smart cards enable the co-existence of interrelated and cooperative applications
that augment each other's functionality. This enables applications to share their
data as well as their functionality with other applications, achieving optimised memory
usage, and data and service sharing between applications [14].
A major concern arising from application sharing mechanisms is the possibility of unauthorised
inter-application communication. A framework that ensures that application sharing
is secure and reliable even in adverse conditions (i.e. malicious applications, developer's
mistakes, or design oversight, etc.) is referred as a smart card rewall [185]. In this chapter,
the terms rewall and smart card rewall are used interchangeably.
The dynamic and decentralised nature of the UCOM may lead to unauthorised application
communication and the associated privacy concerns. Existing techniques deployed by the
smart card industry are not adequate to provide security and reliability to the application
sharing mechanism on a user centric device. The issues involved are: a) an inability to
dynamically authenticate an application on a smart card, b) diculty in ascertaining the
security and reliability of the current state of an application, c) an inability to verify and
restrict application sharing (privilege-based access), d) no provision for privacy preservation
for cardholders, and e) no cryptographic binding between applications. Therefore, in this
chapter, we discuss the proposed rewall mechanism [186] that provides an extension to
the traditional mechanisms deployed in Multos and Java Card, in order to deal with the
listed issues.
There may also be a requirement to allow applications executing on dierent UCTDs to
intercommunicate. Thereby, we further extend the architecture of the proposed rewall
[186] to accommodate application sharing among applications that are installed on dierent
UCTDs. This extension is referred as the Cross-Device Application Sharing Mechanism
(CDAM).
To meet the requirements for a UCOM rewall mechanism, we propose three protocols,
analyse them against a predened set of stated goals, validate them using mechanical
formal analysis using CasperFDR, and nally describe a prototype implementation and
performance measurements.
Structure of the Chapter: Section 7.2 discusses the application sharing mechanisms
deployed by Java Card and Multos, along with the rationale behind the proposal for a
UCOM rewall mechanism. In section 7.3, we describe the architecture of the proposed
rewall mechanism. To provide entity authentication, application state assurance, and
secure application binding we propose an Application Binding Protocol (ABP) in section
158