A User Centric Security Model for Tamper-Resistant Devices

4.6 Device Ownership
4.5.3 Challenge-Response Pair Generation
In the case of the mechanism based exclusively on the PRNG as depicted in algorithm 4.4,
the card manufacturer will provide a set of seed values that is referred as the seed le. The
seed le has a limited set of seeds and with the PRNG designed to update, the seed le
will keep the internal state of the PRNG dicult to emulate by an adversary.
On the other hand, if the online attestation mechanism is based on PUFs then the card
manufacturer requests the smart card to generate a limited set of CRPs. A new CRP is
generated on every successful online attestation; therefore, the card manufacturer does not
need to maintain an exhaustive set of CRPs for individual smart cards.
4.6 Device Ownership
An o-card entity can have one of two types of ownerships on a UCTD. These are discussed
in subsequent sections.
4.6.1 Administrative Ownership
This ownership privilege is enabled in the UCTD to accommodate the requirements of an
IT infrastructure in a corporate, government or public institution (i.e. schools, library, etc.)
to manage hand-held and traditional computing platforms. In addition, the administrative
ownership enables the scheme in which an organisation that is referred as administrative
authority (i.e. MNOs, CIBs, TSOs, SCMs, and MPMs, etc.) can issue smart cards to its
customers and may charge either the application provider or the user on each application
download (section 3.6).
An entity with administrative privileges can install an application in the administrator
space on a UCTD. The administrator space is an application space (section 4.2.1) on a
UCTD that is under the control of the administrative authority. The user of the UCTD
will not have any privilege to install or delete an application from the administrator space;
the user only has the right to use these applications to acquire sanctioned services. The
administrator space can enable the administrative authority to install certain protection
applications (i.e. applications related to network/system user policy, rewall and antivirus
denitions, and content lters, etc.). Furthermore, administrative ownership does not give
the administrative authority the privilege to install, delete or use/access any application
that is installed by a user in her application space.
98