A User Centric Security Model for Tamper-Resistant Devices

2.6 Summary
Furthermore, to perform online monetary transactions the user does not have to register her
credit card with Company A which would then have to invest a huge amount to safeguard
its security. In our case study, the user also has a banking application (issued by her bank)
installed on the UCTD. When a user makes a purchase online, the UCTD application of
Company A will communicate the purchase request to the banking application that will
then process the transaction (e.g. 3D-Secure [75] but it asks the user to enter her password,
not at the bank's website, but to the UCTD application). This removes any need to register
the card on Company A's website.
In this case study, we have decentralised the data storage that is related to the user's
identication and online payment (i.e. credit card details). It is comparatively easy to
embed a (small) secure application and get it certied by an independent third party
rather than having to implement and secure a large database of user's credit card details.
We do not suggest that in our proposed case study all attacks are eliminated. Adversaries
can perform attacks, but the nancial rewards of such attacks are limited and in comparison
less attractive than the invasion of a centralised database (in the breach of Sony's Servers
in April 2011, data related to approximately 70 million users was compromised).
2.6 Summary
In this chapter, we discussed the motivation behind the User Centric Tamper-Resistant
Device (UCTD). The motivation came from three distinct but continuously converging
technologies: smart cards, hand-held devices, and general purpose computing platforms.
We briey discussed dierent architectures for tamper-resistant devices that can be considered
as possible candidates for the UCTD architecture. We then compared these architectures
with the smart card technology in dierent stated aspects of the UCTD. Finally,
we discussed the UCTD and its requirements that compel modication to certain aspects
of smart card technology. We briey introduced the concept of multi-application smart
cards, its related management models, and its issues. This was followed by a description of
selected case studies that utilise UCTDs to provide security and privacy services to existing
frameworks.
50