A User Centric Security Model for Tamper-Resistant Devices

4.3 Trusted Environment & Execution Manager
Interface
· Protocol Encoding/Decoding
· Enforces Access Policy
Trusted Environment & Execution Manager (TEM)
Backup Token
Handler
Attestation Handler
Runtime Security
Manager
Crypto-coprocessor
· Asymmetric Encryption/Decryption
· Symmetric Encryption/Decryption
· Digital Signature
Native Code
Hash Generator
Smart Card Hardware
Random Number
Generator
Self-test Manager
Figure 4.2: Architecture for the Trusted Environment & Execution Manager
and utilise the smart card's cryptographic hardware (the crypto co-processor). The TEM
requires access to the crypto co-processor for encryption/decryption, signature generation
and verication, and random number generation.
4.3.1 Interface
The TEM interface manages the communication between the TEM and on-card entities
(e.g. platform services and applications) or o-card entities (e.g. SPs). The TEM interface
does not replace the o-card interface discussed in section 4.2.3, it only implements the
communication service that a TEM uses to communicate with on-card applications and
(o-card) SPs.
The TEM interface implements the attestation protocol discussed in section 4.7. Furthermore,
it also provides a state validation service (section 4.4.3) to installed applications
during the application sharing process. The state validation of an application can only be
performed by the TEM if it is explicitly requested to do so by that application. Therefore,
for state validation, the TEM establishes a shared secret with an application (at the time
of application installation). When the installed application (refer to it as App A ) needs to
provide state validation to another application (refer to it as App B ), for example during
the application sharing process, the TEM will only provide the state valuation of App A
to App B if App A explicitly requests the TEM with App B identity using the shared secret
(for a more detailed discussion, please see section 7.3.2).
4.3.2 Backup Token Handler
The backup token handler acts as a repository that stores the restoration tokens of individual
applications (if sanctioned by their respective SPs) on a smart card. When a
user registers with a backup server or wants to transfer the installed applications from
86