A User Centric Security Model for Tamper-Resistant Devices

3.5 Security and Operational Requirements of the UCOM
CR5. Ownership Mechanism: A mechanism is required that securely authenticates the
owner of the smart card and facilitates the exercise of her privileges (i.e. installing
and deleting applications).
3.5.3 User Centric Smart Card's Requirements
The security and operational requirements of smart cards are listed below, and most of
these requirements should be implemented by smart card suppliers:
SCR1. Security Assurance: A smart card should have a mechanism(s) that will provide
assurance to a requesting SP that adequate security and privacy measures have been
implemented to ensure the security and privacy requirements of the application(s).
SCR2. Security Evaluation: A smart card should be able to evaluate the downloaded
applications and verify that they do not pose any threat to the safe execution of the
other application(s) on the card.
SCR3. Interoperability: A smart card should have the capability to support a wide
range of applications and communication interfaces/channels.
SCR4. Runtime Environment Fairness: A smart card should require that no application
installed on it tries to monopolise the runtime environment.
SCR5. Application Management: A smart card should have mechanisms to securely
manage the applications. The management of the applications includes application
downloading, installation, and deletion.
SCR6. Application Lease Management: A smart card should require adequate mechanisms
to manage an application lease. The lease of an application may have certain
limits or restrictions that a smart card has to satisfy over the lifetime of the application.
For instance, the limit could be an expiry date or the number of times used, and
restrictions may be the runtime environment's conguration. The mechanism should
be able to provide assurance to the SP that their application will be deleted if the
limit is reached, or cease to execute if lease restrictions are violated. The application
leased from the SP is governed by an application lease policy described in section
3.4.6.2.
SCR7. Ownership Validation: A smart card should support a mechanism to authenticate
its owner using some security parameters (i.e. Personal Identication Numbers:
PIN, password, pass-phrase, or biometric, etc.). There should be the functionality
to reset these values securely.
73