A User Centric Security Model for Tamper-Resistant Devices

10.1 Summary and Conclusions
concept of the UCOM that enables a smart card to become a UCTD. The structure of the
rest of the thesis was closely aligned with the lifecycle stages of a smart card, including
manufacture, downloading applications, application execution, and nally the deletion of
the applications and decommissioning of the smart card.
As previous frameworks including GlobalPlatform, Java Card, and Multos mainly support
the ICOM initiative; therefore, we rst analysed whether these can support the user ownership
proposal. During the design of the UCOM-based smart card architecture, the strategy
that we opted for was to adopt, modify, and introduce new components where required to
existing ICOM-based smart card architectures in a way that supports the proposed user
ownership. This idea became the root of all of our proposals in this thesis.
We dened a short list of services, based on the GlobalPlatform architecture, which support
the user ownership, smart card, and application management operations. A major issue
introduced by the UCOM was decentralisation of the trust architecture that has been
deployed in the smart card industry. Traditionally, in the ICOM framework, the trust
resided in the card issuer and an application provider was only required to trust the card
issuer, and vice versa. Whereas, by giving the ownership of the smart cards to their
users we removed the card issuers altogether, leaving a vacuum in the traditional trust
architecture. We replaced the traditional trust architecture that relied on the card issuer,
and moved it to the smart card itself.
We proposed a security assurance and validation mechanism based on third party independent
security evaluation and a platform-independent trustworthy component on a smart
card. Both of these proposals enable a remote application provider (that we refer to as
Service Provider (SP) in the UCOM) to ascertain the security assurance of a smart card.
The platform-independent trustworthy component on a smart card is referred to as the
Trusted Environment & Execution Manager (TEM), which is similar to the TPM. The
TEM provides an attestation mechanism that certies that the state of the smart card is
as it was at the time of evaluation (i.e. in a trustworthy state). To do so, we proposed two
attestation mechanisms termed as online and oine attestation mechanisms. To support
each type of the attestation mechanism we also proposed two self-test mechanisms based
on the Pseudorandom Number Generators (PRNGs) and Physical Unclonable functions
(PUFs). Furthermore, as the name suggests the online attestation mechanism requires
an entity to vouch for the trustworthiness of a smart card. In our proposal, it is the
card's manufacturer. Therefore, to support the online attestation mechanism we proposed
a protocol that we referred to as the attestation protocol.
Once a smart card is manufactured, evaluated, and acquired by a user, the framework that
comes next is the smart card management architecture. The management architecture
is responsible for establishing a relationship with SPs and acquiring their applications by
226