A User Centric Security Model for Tamper-Resistant Devices

7.2 Application Sharing Mechanism
allows the SPs to control their applications' behaviours, especially in terms of
on-card and o-card communication.
(b) Platform to Application Communication: Java Card (like other multi-application
smart cards) provides global access rights to the platform. The global access
rights mean that an object of the JCRE System Context can access any method
(object) in any of the application contexts. However, the Java Card specication
explicitly notes that the platform should only access certain methods
(select, process, deselect, or getShareableInterfaceObject) from an applet
context [28]. In the UCOM, the rewall should ensure that a platform
cannot have access to methods that are not sanctioned by the application SPs.
Furthermore, it should enable an object or method to verify the requesting
source. For example if the source is the platform, and it is trying to access
an object or method not sanctioned by the corresponding SP, then it should
throw a security exception.
FiR-7 Sharing Revocation: A server (or client) application can revoke a privilege, even
after the server and the client have established a sharing relationship with each
other. In Multos and Java Card, the only way to revoke privileges is to modify the
server and/or client-application code. If a server application does not want to share
resource with the client application, then the server application has to implement
adequate checks to throw an error or exception when the client application accesses
the resources. From the client application's point of view, the SP has to modify the
client application so that it cannot use the shareable resources.
FiR-8 User's Privacy: The rewall mechanism should not allow an application to discover
the existence of other applications, because such a privilege could be used to prole
a user, perhaps for marketing or fraudulent purposes. In Java Card, public static
AID lookupAID can be used to list the installed applications. It is not an issue in
the ICOM as there is a central authority (card issuer) that has prior knowledge
of installed applications and (to some extent)their functionality. However, it is a
potential privacy threat in the UCTD environment.
The comparison between Java Card, Multos and the proposed rewall mechanism is illustrated
in table 7.1.
7.2.3.1 Why Cross-Device Application Sharing?
With increasing interconnectivity between dierent computing environments, applications
installed on dierent UCTDs can enable new service models by having a secure and reliable
resource sharing mechanism. These are referred to as Cross-Device Application Sharing
Mechanism (CDAM). Some of the possible applications of CDAM are listed below:
163