A User Centric Security Model for Tamper-Resistant Devices

4.2 Platform Architecture
Platform Space
Application Space
Card Services
Manager
Card Security
Manager
Cardholder’s
Security
Manager
Application Installation
& Deletion Manager
Subscription
Manager
Cross-Device
Manager
Backup &
Restoration Manager
Smart Card
Firewall
Domain
of SP A
Domain
of SP B
Domain
of SP B
Smart Card Firewall
Smart Card Runtime Environment (SCRT)
System Classes
Application Programming Interfaces (APIs)
Smart Card Virtual Machine
Trusted Environment & Execution Manager (TEM)
Native Code
Smart Card Hardware
Figure 4.1: User Centric Smart Card (UCSC) architecture
Most of the components shown in gure 4.1 are either an improvement to the existing
framework or an addition to the GlobalPlatform architecture. We use GlobalPlatform as
the base architecture for the components in this section. These components modify the
GlobalPlatform card specication to accommodate the UCOM philosophy. Please note that
in this section, we make repeated references to the security and operational requirements
discussed in section 3.5.
Furthermore, certain components that are shown as part of the UCTD architecture in
gure 4.1 are discussed in later chapters where they are described in detail. These components
include the application installation & deletion manager (chapters 5 and 9), the
backup & restoration mechanism (chapter 9), the cross-device manager and smart card
rewall (chapter 7), and the Smart Card Runtime Environment (chapter 8). We delay
their discussion to later chapters for the sake of argument ow and logical placement as
we compare them with the existing smart card architectures (e.g. Java Card, Multos and
GlobalPlatform).
4.2.1 Spaces
A space is a memory container that holds collections of services or applications (i.e.
domains). As depicted in gure 4.1 there are two spaces: platform space and application
space. The platform space is owned by the smart card platform itself so that users do not
have any control over the services installed in the platform space. The application space
can be under the control of an o-card entity that may be a centralised authority (i.e.
TSM or card issuer) or the smart card user. In addition, there can be multiple application
spaces on a smart card accommodating a centralised authority and the respective card
81