A User Centric Security Model for Tamper-Resistant Devices

3.2 Issuer Centric Smart Card Ownership Model (ICOM)
3.2.1 Advantages of the ICOM
Since the inception of smart card technology, issuers have adopted the ICOM as their
model of preference for smart card based services. The advantages of this approach are
presented below:
Issuance Control. Only a legitimate issuer (organisation) can oer smart cards to its
customers. The card issuer controls the availability of the cards and the card/application
management lifecycle. The centralised control of applications and the card management
lifecycle stand out as crucial elements in the acceptability of the ICOM. Centralised control
has meant that the card issuer treats smart cards in a way similar to the way business
assets are treated. Therefore, issuers preferred smart cards to be under their control and the
ICOM tted well with such commercial attitudes. In theory, by ensuring centralised control
an issuer can increase the revenue streams by renting out space in a multi-application smart
card. However, although such ideas are considered workable to some extent, the adoption
of this model is not widespread.
Security Control. A smart card is often deployed as a security token, which provides
secure and reliable access to certain services. Most organisations prefer to retain control of
the security mechanisms for access to their services, which are implemented on a smart card.
This ensures that only the applications installed on their (issued) smart cards can access
sanctioned services, which maintains the provided services. As the installed applications
are designed by the card issuer, it is considered safe to connect with the services provided
by the card issuer. Any compromise of the smart card's security will result in loss for
an organisation whose application is installed on the smart card, both nancially and in
relation to the brand image. To remain secure and condent that the smart cards meet
an organisation's security requirements, the organisation will prefer that the cards remains
under its control as provided by the ICOM.
Modication Control. Once a smart card is issued, only its issuer or trusted partners
may modify the installed applications. Therefore, a malicious user can neither install a new
application nor modify existing applications. As the installation, modication or updating
of an application is under control of either the card issuer or their trusted partners, it
can be assumed with condence that no application on the smart cards will be malicious.
This assumption that centralised control guarantees security led to a realistic but simple
approach to numerous smart card security mechanisms; such as the smart card rewall
[82], application installation mechanism/protocol [83], virtual machine [84] and platform
assurance [56, 85, 86].
55