A User Centric Security Model for Tamper-Resistant Devices

3.4 User Centric Smart Card Ownership Model (UCOM)
Cardholder/
User /Customer
UCSC Supplier
User Centric Smart Card (UCSC)
Card Application
Management Software
(CAMS)
Service Access Point (SAP)/ Host Platforms
Host Device
Cell Phone
Kiosk
Computer
1
2
Internet / Service
Provider’s Network /
Third Party Network
Service Provider
Application Management
Server (AMS)
Cell Phone Kiosk Computer
Access Panel
1: Application Request/Download Channel
2: Service Request/Delivery Channel
Application Services
Authentication Server
(ASAS)
Figure 3.6: Illustration of the UCOM components and their interactions
Therefore, the role of security policy enforcer is taken up by the smart card itself and
cardholders only have the privilege to install and delete applications. The ICOM enables a
card issuer to control the issuance of its smart card to individual users, which is translated
as the privilege to lease its application in the UCOM, whereas installed applications will
always be in total control of the SPs, and users will be entitled to use them under the lease
policy of their respective SPs.
The architecture of a UCOM consists of seven main components, as shown in gure 3.6:
the User Centric Smart Card (UCSC) supplier, the cardholder, the UCSC, the Card Application
Management Software (CAMS), the host devices, the Service Provider (SP) and
the Service Access Points (SAPs). A smart card that supports a user's ownership is called
a UCSC and we use this term only in this chapter to dierentiate between ICOM-based
smart cards and cards that support the UCOM.
A cardholder acquires a UCSC from a UCSC supplier. After acquiring the UCSC, the cardholder
requests an SP to lease their application. The cardholder presents her card to a host
device. The host device then enables the cardholder to use Card Application Management
Software (CAMS) that establishes an interface between UCSC and the SP's Application
Management Server (AMS). After authentication of the cardholder and security validation
of the UCSC, the AMS leases the application(s).
Once the application is installed, the cardholder can present her card to a SAP to access
services. The SAP will establish a connection between UCSC and the SP's Application
Services Authentication Server (ASAS). After being authenticated by ASAS, the user can
use the designated service. The architecture of the application lease and usage is explained
in section 3.4.6.2. In subsequent sections, we discuss the UCOM components shown in
gure 3.6.
66