A User Centric Security Model for Tamper-Resistant Devices

4.2 Platform Architecture
manager can take action and restrict the application by either blocking it so it cannot
execute, or by deleting it. In the GlobalPlatform card specication, such a mechanism
requires the card issuer's permission whereas in the UCOM the card security manager
wants to delete an application it only requires permission from the cardholder.
In addition, when the ownership of a smart card is changed or if the card is decommissioned,
the card security manager is responsible for resetting the smart card conguration.
This process includes the deletion of all installed applications and any data related to
applications/users. The resetting operation will set the smart card to the default factory
setting, as a blank card. Such a mechanism does not exist in the GlobalPlatform card
specication and it is discussed as part of the decommissioning of the UCTD in chapter 9.
The card security manager provides functionality that ensures the platform is in conformance
with the requirements CR1, CR2, CR5, SCR5, SCR6, SPR1, SPR2, and SPR6 that
are listed in section 3.5.
4.2.3 Card Services Manager
Services provided by the smart card platform are under the control of the card services
manager. The services include the o-card interface, the runtime Application Programming
Interface (API), and default applications. The access rights to these services are designated
(requested) by the respective application's SP and the card services manager enforces them.
This functionality enables an SP to manage the behaviour of its application(s) on a smart
card.
Furthermore, a smart card might have multiple applications from dierent SPs that provide
the same service, like banking applications from distinct banks. In such a situation, the
user would have the option of making one application the default application of the group
to which it belongs. The card services manager deals with a list of default applications
when a smart card is presented at a Services Access Point (SAP). If the SAP only requests
an application that belongs to a particular group (e.g. transport, banking, telecom or access
control) without specifying a particular member of that group, the card services manager
selects the default application for the group. However, if the SAP wants to select a specic
application, which may not be the default application of its group the SAP has to request
that application explicitly.
The card services manager ensures that the platform satises requirements CR3, CR4,
SCR5, SPR6, and SPR7 (dened in section 3.5).
83