A User Centric Security Model for Tamper-Resistant Devices

7.2 Application Sharing Mechanism
In Multos, application delegation is implemented to enable application resource sharing.
The application that initiates the process is called the delegator and the application that
is initiated is called the delegate. The process of delegation works as described below and
shown in gure 7.2:
Application A
(Delegator)
Multos Firewall
Application B
(Delegate)
Public Memory (RAM)
4
1
Command APDU
INS
CLA
P1
P2
Lc
Le
Data
SW1
SW2
Data
Response
APDU
2
3
Figure 7.2: The Multos card rewall mechanism
1. Application A (delegator) creates an APDU in the public memory and invokes the
delegate command. The APDU consists of application B's AID, requested data or
function and the delegator's AID.
2. The Multos COS initiates the execution of B that looks for the APDU in the public
memory. It reads the APDU and processes it.
3. On completion, B creates a response APDU within the public memory.
4. The Multos COS switches back to A that then retrieves B's APDU.
7.2.3 Rationale for User Centric Smart Card Firewall
Traditional smart card rewall mechanisms are t-for-purpose in the ICOM environment
but they do not provide adequate security to the UCTD environment. The operational
and security requirements a UCOM rewall has to satisfy are:
FiR-1 No O-card Security Assumption: The rewall mechanisms discussed in previous
sections are designed with the implicit assumption that the smart card will be under
the card issuer's control. The security of the platform is ensured not only by the oncard
mechanisms but most importantly by the o-card agreements, which prevent
installation of a malicious application and prevent unauthorised application access.
161