A User Centric Security Model for Tamper-Resistant Devices

7.3 UCTD Firewall
Firewall
Application A (Client)
Requesting
Permision ResAllocation(ResourceObjectRef, Lifetime)
Component
ACL
Req(ClientAID, EBindingKey(),Access Permission,
Resource Required, Random Number)
RequestService
Application B (Server)
ACL
ARM
Permision
Permision
Shareable Resources
Figure 7.4: Application shareable resource access request process
Subsequently it checks the access permission for the client application (from the server application's
ACL). If the client application is authorised to access the requested resource,
the ARM will return the resource's object reference along with the sharing lifetime.
There are two lifetime modes, permanent grant of access to an object or temporary. In
permanent mode, the server application grants the ownership of the object to the client
application as proposed by the Java Card 3.1 connected edition rewall [16]. In temporary
mode access is limited to individual sessions and ownership of the object is retained by the
server application.
7.3.4 Privilege Modication
The SP of a server application can modify the privileges of a client application by updating
the ACLs. The ARM of the server application veries the initiator's (SP's) identity and
credentials, before allowing the update of the ACL(s). The implementation of the privilege
modication is at the sole discretion of the SP. Such an update could be similar to application
update mechanisms already deployed, notably Over-The-Air updates in (U)SIM
application [6].
7.3.5 Application-Platform Communication
At the time of installation, an application establishes bidirectional resource sharing with the
platform. The application can access those platform APIs that are stipulated in the SP's
Application Lease Policy (ALP) discussed in section 3.4.6, and the platform obtains the
shared resources of the applications that are necessary to initiate the application execution.
The platform security context does not have global access in the UCTDs. This is to avoid
any possible exploitation of the platform that could lead to information leakage (data or
code) from an application. The resource-sharing delegation is disabled in the platformapplication
communication and the rewall will deny such requests to avoid any illegal
access to the APIs by an application through resource sharing delegation.
168