A User Centric Security Model for Tamper-Resistant Devices

Businesses
Governments
Privacy
Preserving
Services
Online
Banking
2.4 The User Centric Tamper-Resistant Device
card that supported the ICOM; therefore, it does not support as many requirements as a
UCOM-based smart card. We can say that table 2.1 also provides a comparison between
UCOM- and ICOM-based smart cards and their suitability for the UCTD initiative.
2.4 The User Centric Tamper-Resistant Device
As is apparent from the comparison in table 2.1, a multi-application smart card architecture
has the potential to serve as the underlying framework for the UCTD. The crucial point
that has to be taken into account is that smart card architecture is traditionally under
a stringent centralised control, whereas the UCTD requires a more diverse architecture
which also accommodates the user's ownership. Therefore, the concept of the User Centric
Smart Card Ownership Model (UCOM) becomes synonymous with the UCTD. In addition
to the UCOM framework for smart cards, for the UCTD initiative the form factor of smart
cards is also diversied as shown in gure 2.3.
Industry Sectors
Applications Areas
User Centric Tamper-Resistant Devices
E-
Commerce
Healthcare
Access
Identification
Retail
Ticketing
Hotels
Security
Transport
Internet
Identity
Banks
Biometric
Data
Universities
Online Entertainment
Mobile Network Operator
Figure 2.3: Illustration of UCTD form factors, application areas, and industry sectors
Figure 2.3 shows dierent possible form factors for the UCTD, various applications that
it can host, and dierent industries that can use the provided functionality. In subsequent
sections, we briey introduce multiple application smart cards along with dierent
management architectures. This discussion serves as a foundation for the concept of multiapplication
smart cards, their management architecture, and potential issues with them.
Before we dive into the UCOM proposal in chapter 3, in subsequent sections we briey
survey dierent management initiatives in the smart card industry and also discuss some
earlier attempts at user centric smart card management.
43