A User Centric Security Model for Tamper-Resistant Devices

10.2 Recommendations for Future Work
10.2 Recommendations for Future Work
Our intention in this work was to analyse the feasibility of giving the ownership of a
security- and reliability-critical device like a smart card to its user. We aimed to explore
the possibilities that it would bring, and new application scenarios that might open up
for the smart card-based services deployment. We have achieved our goals by providing a
pathway for UCTDs and user centric smart cards, which not only provides security and
reliability assurance to SPs but also give users freedom of choice. However, we consider
that there is a long journey ahead for the user centric smart card proposal and there are
many suggestions for possible improvements and directions for future research.
There can be possible improvements in the hardware protection and remote attestation
mechanism for the UCOM framework. An attestation mechanism that not only provides
the assurance that the current state of the smart card is secure as stated by the appropriate
evaluation authority, but also the uses hardware that will simplify the remote assurance
mechanism. Furthermore, we need to provide security and reliability characterisation,
classication, and formalisation of smart card / application services. We might employ
mechanisms similar to those implemented in service-oriented computing architecture, taking
smart cards and applications as two services that need to ascertain whether they can
support each other's requirements. This work may lead to devising a language (semantics)
to describe the above mentioned features as is done in Web Service Description Language
(WSDL). Such a language can be used to create third party evaluation certicates, which
in our proposal is the CC authority.
An application tagging mechanism tags segments of an application with security and/or
reliability levels, which instruct the runtime environment to apply adequate checks during
the execution of the application. To support the application tagging mechanism in the
UCOM, we need to have an on-card mechanism that can verify the security and reliability
tags. Therefore, an adversary cannot take advantage of such a framework to subvert
a smart card's runtime protection. We refer to on-card analysis as on-card application
behavioural analysis, which is similar to bytecode analysis but is focused on the nature of
an application segment and its associated tag.
One of the major future research directions is the smart card runtime environment, and
its security and reliability in the presence of malicious applications, fault, and combined
attacks. As discussed above, we need to look into the design of the virtual machine and
build the protection from there, rather than implementing them in a piecemeal manner.
This requires the study of existing virtual machines and language architectures, to nd
out a balance between performance, and runtime-protection. This work may reduce the
number of opcodes assigned in the Java virtual machine, and/or redening the execution
structure.
229