A User Centric Security Model for Tamper-Resistant Devices

7.3 UCTD Firewall
Encrypted and MACed using PBP Keys
Server SC-ID
Client SC-ID
Server AID
Client AID
Sharing Request (Payload)
Encrypted and MACed using ABP Keys
Figure 7.6: Cross-Device Application Sharing message
The provision of whether an application supports cross-device application sharing is at
the sole discretion of the respective SP. The UCTD architecture will provide two levels
of application sharing: a) localised sharing, and b) cross-device sharing. The rst option
restricts the application sharing to the smart card on which the application is installed.
Any client application that is not installed on it will not be able to access the shareable
resources of the server application. This scenario is implemented in traditional smart card
rewalls and supported by the UCTD. The second option allows application sharing with
a client application, whether or not it is installed on the same platform.
In a succinct manner, we can divide the CDAM process into four steps listed as below:
1. Registration: The rst step involves registration of individual applications with their
respective smart cards, and individual smart cards with their respective CAMS.
2. Platform Binding: A new smart card that is recently registered with the CAMS will
ask the CAMS to provide a list of available (registered) smart cards. The CAMS
provides the pseudo identities of other associated smart cards. Each smart card
then initiates a dialogue referred as platform binding with other smart cards in the
network and establishes a secure relationship (e.g. by means of a shared cryptographic
key) that is termed as platform binding key. The platform binding is similar to the
application binding discussed in section 7.3.2 but is between smart cards, rather than
applications. After the acknowledgement of the platform binding, each smart card
will register the other in its list of bound platforms.
3. Application Binding in CDAM: In the third step, client and server applications proceed
with the application binding process that on its successful conclusion binds them
in a way that enables them to share resources in a secure and reliable manner.
4. Application Sharing in CDAM: The client application requests its host smart card
regarding the status of the server application's host smart card. If the server application
is in the network then it will proceed with the application sharing. The
application binding key is used to generate the session key to communicate with the
server application. The structure of the message is illustrated in gure 7.6.
The resource access can be based on two mechanisms: Java Card [28] or Multos [29] interapplication
communication architecture. These two mechanisms represent the synchronous
170