A User Centric Security Model for Tamper-Resistant Devices

4.4 Security Assurance and Validation Mechanism
4.4 Security Assurance and Validation Mechanism
The UCOM requires a mechanism that supports a dynamic and remote security assurance
and validation process which is based on the TEM coupled with a third party evaluation.
The third party evaluation certicate provides a security assurance and TEM provides the
validation that the assurance is correct at the time of request. However, in the UCOM
environment, applications are not required to be evaluated by third parties, and so evaluations
can be costly, and may discourage small and medium-scale organisations from opting
for the UCTD-based architecture. To verify the security and reliability of an application,
a smart card can employ on-card verication mechanisms like bytecode verication [128].
In this thesis, we refer to the Common Criteria (CC) evaluators for third party evaluation
as it is one of the most accepted and deployed evaluation mechanisms in the smart card
industry.
4.4.1 Common Criteria
In late 1990s, the Common Criteria (CC) was released, and they were later adopted as
a multi-part ISO/IEC standard (ISO/IEC 15408 [129]), that is internationally accepted
under the Common Criteria Recognition Agreement (CCRA) [69].
The CC scheme denes the methodology for expressing the security requirements, conformance
claims, evaluations process, and nally, certication of the product. The security
requirements for a product at an abstract level are stipulated by Protection Proles (PPs).
A Security Target (ST) details these security requirements and makes the conformance
claims for a product or its sub-component(s), generally referred to as Target of Evaluation
(TOE).
The Evaluation Assurance Levels (EALs) are predened assurance packages that have a set
of security requirements. There are seven packages dened in the Common Methodology
for Information Technology Security Evaluation (CEM) [130] that are referred as EAL
1 to EAL 7 with level seven being the most comprehensive security evaluation. The CC
proposes an evaluation methodology, which denes the procedures that an evaluator should
follow when processing conformance claims regarding a TOE under a particular ST, PP
and desired EAL. This evaluation methodology is published in the CEM [130].
In the literature, some reservations are expressed regarding the validity and the process ef-
ciency of the CC [67, 86, 131]. However, the CC has taken a strong hold in the smart card
industry, especially in high-security areas like banking and IDS/passports, as the security
90