A User Centric Security Model for Tamper-Resistant Devices

4.2 Platform Architecture
user (section 3.6). The owner of an application space has the right to install or delete any
application they choose within their respective space. With the concept of spaces, we can
even extend the smart card's capability to accommodate multiple users. An example is a
home personal computer used by family members where each member of the family has her
or his own prole (account) on the computer. In such a scenario, applications on a UCTD
belonging to individual family members should also be securely segregated, and this can
be accomplished by creating an application space for each individual user.
A logical set of memory locations, associated with a single SP, is called a domain and it
is under the complete and independent control of that SP. The domain provides a simple
mechanism in which each application has a secure compartment that is independently managed
by the SP. Domain ownership is delegated independently of any o-card entity (e.g.
card manufacturer) to the SP during the application installation process that is discussed
in chapter 6. A point to note is that the concept of domains is widely deployed by the
GlobalPlatform card specication [30] and we simply adapt it to the UCOM architecture.
The managers shown in the platform space of gure 4.1 are collectively represented by the
term Platform Manager (PM), illustrated in gure 3.7.
4.2.2 Card Security Manager
The card security manager is the hub for the dierent security and operational services
that a smart card provides.
During the application installation process, the card security manager will facilitate the
generation of an SP's domain and oversee the transfer of control of the domain to the
appropriate SP. For each application belonging to an SP, there will be a separate domain
allocated to the SP that will only have one application in it. This is to allow an SP to
manage its individual applications on a smart card individually. Furthermore, this also
simplies the deletion, and blocking/disabling of applications. The card security manager
can delete entire domain and any associated privileges to applications installed in the
domain without aecting other applications in the domain. The card security manager
facilitates the transfer of domain control to the appropriate SP. This transfer includes
the generation of cryptographic keys that the SP will use them to authenticate itself to
the domain and perform related management tasks (e.g. application installation, deletion,
blocking, unblocking and update). The card security manager would also ensure that the
keys generated during the application installation process are not revealed to any third
party (e.g. card manufacturer or cardholder).
If an installed application violates the security policy of a smart card, the card security
82