A User Centric Security Model for Tamper-Resistant Devices

3.3 Frameworks for the ICOM
quent sections. We leave in-depth analysis to later chapters where they are discussed and
compared alongside the UCOM-based proposals. Therefore, in this section we will briey
introduce the best-known ICOM-based smart card architectures.
3.3.1 Multos
In 1997, a consortium of companies (MAOSCO) supported the development of a Smart
Card Operating System (SCOS) called Multos [29], with one aim: to provide a high level
of security and reliability. They required a single operating system which could be implemented
on any silicon chip and which had an application written for it that was independent
of the underlying hardware. Their vision anticipated the creation of a multi-application
smart card. From the beginning, Multos was developed as a secure multi-application
SCOS that achieved ITSEC 5 Assurance Level E6 [93](comparable to the Common Criteria
EAL7 [69, 94]), which is the highest level attained by any SCOS [6].
The MAOSCO Consortium denes the Multos specications, and is the license issuer and
operator of the certication service for Multos. It has made most of its specications available
to the SCOS developers provided they sign an NDA (Non Disclosure Agreement), and
pay licence and royalty fees. A restriction in the Multos specication is its inexibility with
respect to adding new Application Programming Interfaces (APIs). The license agreement
with Multos restricts smart card manufacturers from enhancing their product by including
new APIs to the specication.
With the advent of the Java Card technology, a Multos card division called StepNexus [95]
has made available the Multos SmartDeck environment free of charge [96]. The Multos
SmartDeck is a complete high-level development environment which enables application
developers to design applications easily for Multos-based cards.
The Multos card architecture is illustrated in gure 3.2. At the top in gure 3.2 is the
application layer that contains three applications (namely A, B, and C); each application
has its own space, which is protected by the card's rewall mechanism. The next layer is
the Application Abstract Machine (AAM), which also includes dierent APIs. The Multos
operating system presides over the hardware and provides services such as communication,
memory management, the handling of loading and deleting of applications, together with
APDU commands and responses. At the bottom of the gure is the hardware, which
supports the SCOS. Functions that access this layer are written in native language, but
are accessed by a fully specied virtual machine, which is the same no matter what the
hardware.
5 Information Technology Security Evaluation Criteria (ITSEC) is an international security assurance
evaluation criteria [92].
58