A User Centric Security Model for Tamper-Resistant Devices

3.4 User Centric Smart Card Ownership Model (UCOM)
3.4.6.1 Application Management Server (AMS)
An AMS is implemented and maintained by an SP to support the UCOM. The AMS's main
function is to facilitate authorised cardholders to ubiquitously manage the SP's applications
on their cards.
The account details provided by the SP to its customers contain the AMS access credentials.
Using these credentials, the user can access and install the SP's application(s). The exact
mechanism of the user registration and credential issuance, and the usage mechanism which
controls how a user's credential will be veried (authenticated) are specic to each SP.
The main function of an AMS is to maintain the SP's application(s) and to ensure that the
application is only leased to a smart card if it satises the SP's Application Lease Policy
(ALP).
3.4.6.2 Application Lease Policy (ALP)
An ALP denes the minimum requirement of an SP that a smart card has to satisfy before
the SP will lease its application. The ALP is dened by an SP, and it could have the
following requirements.
1. Minimum smart card hardware requirement.
2. Minimum Smart Card Operating System (SCOS) or platform (e.g. Java Card) requirements.
3. Minimum application memory requirement.
4. Minimum Common Criteria Security Evaluation Level [69].
5. Maximum number of smart cards that can hold the lease of the application.
6. Cryptographic key generation requirements.
7. Secure communication channel requirements.
8. Application lease limits and restrictions (if applicable).
In addition to the abovementioned points in the ALP, an SP can dene some additional
criteria for its application. During the application installation process [10], a smart card
tries to satisfy the SP's requirements, and if it succeeds, the SP will lease the application
to the smart card; otherwise the request will be declined.
69