A User Centric Security Model for Tamper-Resistant Devices

3.5 Security and Operational Requirements of the UCOM
rised cardholder can execute any privileged commands. These privileged commands
can change the state of the smart card (e.g. alter the application installation and
deletion commands).
GR2. Security: This requirement stipulates the need to provide protection against attacks
that can violate the security requirements of each of the UCOM components.
Therefore, the UCOM should provide an adequate security mechanism to protect all
the components and their communications.
GR3. Privacy: The privacy requirement is essential in the UCOM, since smart cards
are used as a secure token to access some personal information or monetary services.
Therefore, the UCOM should provide privacy services to those components that
require it.
GR4. Interoperability: The UCOM should not prefer any particular platform, SCOS,
or hardware conguration. The aim is to provide an unrestricted scalability to the
overall UCOM model. A smart card would present the list of supported functionalities
to the requesting SP and then it would be up to the SP's discretion whether it
leased its application or not. From the point of view of the smart card, the SP and
the UCOM architecture, there should be no preference. If a smart card supports an
SP's requirements and supports the security and operational functionality required
by the SP's ALP, then the SP would lease its application on request, unless there
is some genuine reason not to do so. In the event of a valid reason, the SP should
inform the requesting cardholder of the main reason for not leasing the application.
GR5. Ease of Maintenance: The framework should be simple to use and maintain for
SPs. In addition, it should not require any extensive modication to the existing
infrastructure.
GR6. Impartiality: The smart card supplier could be a smart card manufacturer, an
SP, or a third party vendor. Regardless of the supplier, the smart card should not
favour any particular application or set of applications. This would be possible if
an SP supplies the smart cards, and then they might be tempted to give additional
privileges to its own application. Therefore, the UCOM should provide guarantees
that all applications will have the equivalent privileges to suit their operations.
The major components of the UCOM are cardholders, smart cards, and SPs. In subsequent
sections, the operational and security requirements of these major components are
discussed.
71