A User Centric Security Model for Tamper-Resistant Devices

1.5 Structure of the Thesis
traditional smart card ownership model and associated architectures, we move on to discuss
the concept of giving control of application selection to cardholders. We then discuss the
major components of the UCOM framework.
To provide a secure and reliable architecture for the UCTD we need to make adequate
modications to the smart card platform. Therefore, in chapter 4, we discuss the security
and operational architecture of the UCOM-supported platform, termed as the User Centric
Smart Card (UCSC). We detail the reasons behind the architectural changes to the
traditional smart card which are needed to accommodate the philosophy of the UCOM.
Subsequently, we discuss the mechanism that provides security assurance of the UCOM
platform to the requesting entity. We also describe the ownership acquisition process
through which a user takes ownership of an UCSC and how she can verify the claims
articulated (e.g. assurances about security and reliability) by the UCSC.
After describing the smart card platform architecture, we move to a description of the
framework that supports the application acquisition and management. Hence, in chapter
5, we discuss the card management architectures that are widely accepted and deployed in
the smart card industry: GlobalPlatform and Multos. We explain why these architectures
are not fully compatible with the user centric architecture. Subsequently, we describe the
card management architecture for the UCOM. Finally, we discuss two new issues raised by
the proposed architecture.
Chapter 6, begins with a discussion on the secure channel protocols that are used for entity
authentication and key establishment. We discuss the security and operational goals that
a secure channel protocol has to accomplish in the UCTD environment. Subsequently, we
discuss dierent protocols which have been proposed for Internet and smart card environments,
and these protocols are used to provide a comparison to the ones we propose. We
propose two protocols that closely adhere to the UCOM philosophy and a protocol related
to the CASC model. An informal analysis is provided of all proposed protocols. For the
sake of completeness, we subject the proposed protocols to mechanical formal analysis using
CasperFDR. Finally, we discuss the test implementation and performance measures of
the proposed protocols.
After an application is installed on a smart card, it might want to communicate with other
applications or services available on the card. To do so, an application will utilise the
provision of an application sharing mechanism. In chapter 7, we begin the discussion with
a description of the two contrasting frameworks for application sharing deployed by Java
Card and Multos, followed by an explanation for why we need to extend the existing techniques
for the UCOM framework. Subsequently, we discuss the architectural framework
of an application sharing mechanism for the UCTD. Later, we extend the proposed application
sharing mechanism between applications installed on dierent UCTDs, referring
29