A User Centric Security Model for Tamper-Resistant Devices

3.5 Security and Operational Requirements of the UCOM
SCR8. Feature Interaction Problem Avoidance: The smart card needs to have a
mechanism that prevents any possible feature interaction problems. Feature interaction
problems are caused by dependencies between the software and hardware.
The mechanism will record any dependencies of an application before it is installed.
Therefore, when there is a change that aects the dependencies of the application,
it can either be deleted or cease its execution.
SCR9. Malicious Application/User Problem: The smart card should implement effective
security and privacy measures to counter a malicious user or application. The
smart card platform should be able to resist the introduction of malicious applications
or hardware-based intrusions to breach security. To avoid application-level
breaches, the card should have the capability to perform application code verications
on the card. In addition it should have a conservative execution environment
(i.e. a defensive virtual machine [112]) that ceases execution of an application if there
is a violation of the card's security.
SCR10. Application Scanning Attack: Each application on a smart card acts as an
identity of the card owner in some context, as discussed in the previous section.
Each application on a smart card has unique Application Identier (AID) [24]. A
malicious user can use the application identier to scan the applications installed
on a particular card. It will not only violate the privacy requirement of the user,
but may also enable the attacker to create/modify the attack. A malicious user may
choose the weakest application in the smart card to initiate an attack. The smart
card should have a security mechanism to avoid such an attack.
3.5.4 Service Provider's Requirements
Service providers use smart cards as secure tokens to oer their services, in a secure manner,
to their customers. If this secure token is compromised, they have to bear both nancial
and brand losses. Therefore, from a business point of view, SPs have even more at stake
than card issuers, both nancially and in relation to brand image, and they would be
reluctant to adopt the UCOM, if they had doubts about its security. The requirements of
SPs in the UCOM are listed below:
SPR1. Transmission Security: SPs will lease their applications to a smart card through
the internet or a third party intranet. It is essential that applications are not tampered
with during the transmission.
SPR2. Installation Security: After an application is downloaded to a smart card, it
will be decrypted. During this process, no on-card or o-card entity should be able
to gain access to the application code or data.
74