A User Centric Security Model for Tamper-Resistant Devices

4.2 Platform Architecture
4.2.4 Cardholder's Security Manager
The cardholder's security manager maintains services that facilitate an eective and secure
management of the smart card contents by its user (cardholder).
At the time a UCTD is delivered to a user, it might be a blank card, which is under
the default ownership of the smart card manufacturer. The cardholder's security manager
facilitates a cardholder to acquire the control of the smart card (section 4.6), which will
enable her to install or delete any application she desires.
Furthermore, when a user requests any privilege services (e.g. application installation,
application deletion, a list of installed applications), she has to authenticate herself to
the cardholder's security manager. On successful authentication, the cardholder's security
manager will proceed with the requested service.
When a user takes the ownership of a smart card, the card contents (e.g. cryptographic keys
and certicates) are specic to the user. Therefore, when the ownership changes hands,
the cardholder's security manager requests the card security manager (section 4.2.2) to
initiate the clean-up command that deletes all applications and data, returning the smart
card to the default ownership (card manufacturer's ownership). This process is referred to
as decommissioning and is discussed in chapter 9.
The cardholder's security manager provides functionality to satisfy requirements CR1,
CR2, SCR1, and SCR7.
4.2.5 Subscription Manager
The subscription manager handles the registration of a smart card with an administrative
authority. The authority can be a corporate and home-network administrator and/or a
centralised scheme manager like a card issuer or TSM. These entities might be registered
before the card was issued or the user might choose to register her smart card to a particular
authority to get better services.
The subscription manager facilitates the registered administrative authority to manage
their application space on the UCTD. In addition, if a user is allowed to evict the administrative
authority then the subscription manager will proceed with the removal process.
This process will include deleting the associated space and all applications (domains) in
the respective space, along with revoking any privileges delegated to the administrative
authority on the UCTD. In carrying out this process, the subscription manager is similar
84