A User Centric Security Model for Tamper-Resistant Devices

9.2 Backup and Migration Framework
9.3. Finally, we conclude the chapter with a discussion on the decommissioning process in
section 9.4.
9.2 Backup and Migration Framework
In this section, we describe two mechanisms: backup and migration. In the contents backup
process, a user archives her smart card's contents to a backup server and then restores it
to the destination smart card. In the migration process, there is no backup server and the
smart card contents are transferred between a source and a destination smart card.
9.2.1 Backup Mechanism
In this proposal, instead of backing up the applications (i.e. data and source code) as we
traditionally do in desktop computing environments. We only backup the authorisation
tokens issued by SPs. The backup package that consists of authorisation tokens should be
stored at a secure location, preferably accessible ubiquitously on demand. When a user
wants to restore the contents of her old smart card, she has to import the backup package;
then the individual applications will be requested from their respective SPs automatically
by the smart card using the authorisation tokens.
In our proposal, a secure o-site backup facility is provided by a secure third party referred
to as a backup server. We do not consider that a backup server has to be an SP and the
only requirement is that users trust the backup server. A backup framework overview is
illustrated in the gure 9.1 and described below.
Service Provider
(SP)
2) Request Application Download Token
Verify the Request and
Generate the Token
3) Response Application Download Token
SP’s App
Smart Card
Backup & Restoration Manager
3b) Response Token
1) Request Registration
1a) BRM Registration
4) Backup Package
Secure Backup
Server (SBS)
Figure 9.1: Overview of the credential backup mechanism
1. A smart card user registers herself to a backup server using the Secure and Trusted
Channel Protocols (STCPs) proposed in chapter 6. After the registration, the backup
& restoration manager (gure 4.1) has the user's credentials and details of how to
connect with the respective backup server. The backup & restoration manager and
backup server will generate a shared secret that they will use in future sessions.
213