A User Centric Security Model for Tamper-Resistant Devices

3.5 Security and Operational Requirements of the UCOM
SPR3. Maintenance Security: SPs require access privileges for their applications to
update application data les or to update the applications themselves. This access
to the application should be secure, and it should not involve cardholders. However,
if the SP desires, the cardholder's consent can also be requested for application
update/modication processes.
SPR4. Intellectual Property Protection: In the UCOM, SPs lease their applications
to the user's smart card. A malicious user can simulate a smart card on a device
(e.g. computer) and then request the application from an SP. If the SP leases the
application to a simulated environment, the malicious user can reverse engineer the
application. This could reveal the secret information (e.g. cryptographic keys, and
algorithms) contained in the application. Therefore, SPs require that adequate security
protection is implemented to safeguard their condentiality and integrity of
their applications.
SPR5. Application Code Condentiality: The applications from SPs would need to
comply with certain standards. However, these standards will not prevent them from
using proprietary algorithms. The SPs would require that the code of their applications
and its inner workings should remain condential. The smart card provides
adequate security to prevent an adversary from gaining knowledge of the SP's application.
Application Code Condentiality will be jointly provided by mechanisms
that satisfy the abovementioned requirements.
SPR6. Application Control: In the UCOM, although users own the smart cards, the
ownership of the application still resides with the SP. SPs only lease applications to
their customers (UCSCs). The SP has the power to revoke the application lease, or
to block or modify the application. The lease of an application is governed by the
ALP. In addition, the SP controls all operations that a cardholder can request on
its smart card. These operations are application installation, application deletion,
and state change (i.e. application block and unblock operations), and they cannot be
performed unless authorised by the relevant application's SP.
SPR7. Protection Against Monopolies: In the UCOM, multiple applications may be
installed on a smart card from dierent SPs. They all share and use the same smart
card hardware and card operating system. There is a possibility that a smart card
operating system can favour certain applications. As a result, these applications can
monopolise the card. Therefore, SPs will require assurances that such scenarios will
not be possible.
SPR8. Ease of Implementation: SPs have made substantial investments to their existing
infrastructure that provides services to their customers. Therefore, the UCOM
should not impose unnecessary changes to the existing infrastructure. The basic idea
is to implement the UCOM as another layer on top of the existing infrastructure,
which implements UCOM without extensive modication.
75