A User Centric Security Model for Tamper-Resistant Devices

3.6 Coopetitive Architecture
SPR9. Feature Interaction Management: The SPs require that any changes to the
smart card platform that can aect their application's execution should be avoided.
In the best-case scenario, the smart card platform follows the SP's delegated process
that removes the interdependencies between applications in such situations. However,
if this does not solve the problem, then the card should simply block the application
or possibly delete it (with the card owner's consent).
SPR10. Protection from Malicious Users: The SPs would like to have their applications
protected by the underlying smart card platform. Therefore, even if the
application were issued to the malicious user, he would not be able to obtain any
sensitive information about the application.
3.6 Coopetitive Architecture
A UCTD can be a single-user, and/or a multi-user device, depending upon its deployment
architecture. In a multi-user architecture, a device (e.g. a computer or tablet) might be used
by multiple users. Furthermore, a UCTD might be part of a corporate network, as in the
case of a mobile phone issued to employees by an organisation. The organisation (referred
as an administrative authority) would like to retain the control of the UCTD issued as
part of the mobile phone, while giving freedom to the user to have/manage the UCTD
independently of the organisation. It is necessary to consider these deployment scenarios
in order to achieve true scalability that will enable small to medium-sized organisations
like leisure facilities, local libraries, schools, surgeries and colleges, as well as large-scale
organisations like banks, MNOs and transport operators, to provide their services through
a UCTD to a user without any restrictions from a centralised authority (e.g. card issuer).
To accommodate the role of an administrative authority on a UCTD, we extend the UCOM
architecture and propose the Coopetitive Architecture for Smart Cards (CASC). In the
CASC a cardholder retains the application choice but under the provision of an administrative
authority (e.g. TSM). Nevertheless, the baseline architecture of the UCTD is
based the UCOM, as the CASC is an extension of the UCOM architecture that provides
centralised ownership of the device while preserving the user's freedom of choice.
The CASC combines the TSM architecture with the openness, scalability, and exibility
of the UCOM architecture. In this architecture, users get their choice of selecting which
application they want on their smart cards, and administrative authorities (or the TSM, the
administrator of the corporate network) have a permanent presence on the cards along with
possibly being part of the revenue loop. The CASC requires all the necessary modications
to the existing smart card architecture (i.e. deployed in the ICOM) to achieve its goals.
So while we focus on the UCOM in this thesis, we are implicitly also catering to the
76