A User Centric Security Model for Tamper-Resistant Devices

3.3 Frameworks for the ICOM
Controlling Authorities
Security Domain
Card Issuer’s
Security Domain
Application
Provider’s Security
Domain
Card Issuer’s
Application
GlobalPlatform API
Application Provider’s
Application
Global Services
Application
System Classes
OPEN and GlobalPlatform Trusted Framework
Smart Card Runtime Environment (SCRT)
Smart Card Hardware
Figure 3.4: Generic representation of the GlobalPlatform card architecture
owner of the domain. The security domain also provides separate cryptographic keys to
the card issuer and the application providers to manage their respective domains/applications.
The security domain also manages key handling, encryption, decryption, digital
signature, and the verication of (hosted) applications (i.e. only at the time of installation
[30, 103]). The card issuer generates the security domain (application domain) on
the card and then gives control of the application domains to the card issuer's partners
(application providers). These application providers can then manage their applications
independently of the card issuer's involvement.
The OPEN framework dened in the GlobalPlatform specication handles/controls the
downloading and installation of applications. The Trusted framework enables dierent
services such as inter-application communications; however, the GlobalPlatform Card
Security Requirement Specication [1] states that GlobalPlatform relies on the underlying
platform's (e.g. Java Card, and Multos) implementation of the rewall mechanism..
The crucial component of the GlobalPlatform card specication is termed the Card Manager.
This is a generic term used for such services as OPEN, the issuer security domain and
Cardholder verication method services. The Card Manager actively controls the smart
card environment. Furthermore, the smart card issuer cannot access any of the application
domains because they are protected by the cryptographic keys (access keys) and these keys
are shared only between an application domain and an application provider. However, if
a particular application provider violates the agreement with the card issuer, or they no
longer have a partnership to provide services, then the card issuer can block or delete the
application provider's application.
In this section, we have provided a short description of the GlobalPlatform card specication
which in no way denes all the functions of the specication. However, we continue to
refer to the GlobalPlatform card specication in subsequent chapters and give detailed descriptions
of its components as required. It is noteworthy that GlobalPlatform has shown
the capacity and willingness to adapt to the industry's trends. It has published GlobalPlatform
Card Remote Application Management over HTTP Card Specication v2.2
in response to Java Card 3 and GlobalPlatform's Proposition for NFC Mobile: Secure
62