A User Centric Security Model for Tamper-Resistant Devices

2.3 Candidates for User Centric Tamper-Resistant Device
2.3.5 GlobalPlatform Trusted Execution Environment (TEE)
The TEE is GlobalPlatform's initiative [23, 54, 65] for mobile phones, set-top boxes, utility
meters, and payphones. GlobalPlatform denes a specication for interoperable secure
hardware, which is based on the GlobalPlatform's experience in the smart card industry.
It does not dene any particular hardware, which can be based on either a typical secure
element or any of the previously discussed tamper-resistant devices. The rationale for
discussing the TEE as part of the candidate devices is to provide a complete picture.
The underlying ownership of the TEE device still predominantly resides with the issuing
authority, which is similar to the GlobalPlatform's specication for the smart card industry
[30].
2.3.6 Trusted Personal Devices
The term Trusted Personal Devices (TPD) was coined by the Integrated secure platform
for the interactive Trusted Personal Devices (InspireD) project [66]. Similar to our proposal,
the architecture for the TPD is based on smart card technology. The architecture
of the TPD is similar to that of the smart card, with the exception that is has dierent
form factors that include SIM cards, Secure Digital (SD) cards, and Universal Serial Bus
(USB) memory sticks [66]. However, the InspireD project recommended that the TPD
to be under the ownership of a centralised authority (i.e. card issuer) and users get the
privilege of choosing whether to use the device or not. Users cannot request installation
or deletion of an application. Therefore, we can say that TPD was in conformance with
the ICOM framework.
2.3.7 Comparative Analysis
In this section, we analyse three questions: i) why use a tamper-resistant device?, ii) why
have a user centric ownership architecture?, and nally iii) why do we not just opt for the
TPM (or other devices discussed above)?
In most of the scenarios, a tamper-resistant device is assumed to be in the possession of
a malicious user [5, 6]. This assumption is natural for banking, transport, and healthcare
cards. Therefore, a tamper-resistant device has a physical protection layer to avoid any
intrusion attacks. In addition, these devices require an adequate hardware protection and
self-protect mechanism to safeguard them from accidental or intentional damage. Therefore,
a tamper-resistant device provides a secure and reliable platform that can remain
trustworthy even in the possession of a malicious user. However, just focusing on the tam-
39