Market-Driven Code Provisioning to Mobile Secure Hardware

详细信息    查看全文

• 刊名：Lecture Notes in Computer Science
• 出版年：2015
• 出版时间：2015
• 年：2015
• 卷：8975
• 期：1
• 页码：387-404
• 全文大小：836 KB
• 参考文献：1.BouncyCastle crypto API. https://鈥媤ww.鈥媌ouncycastle.鈥媜rg/鈥?/span>
  2.GlobalPlatform - device specifications. http://鈥媤ww.鈥媑lobalplatform.鈥媜rg/鈥媠pecificationsde鈥媣ice.鈥媋sp
  3.Google Wallet: Shop. Save. Pay. With your phone. http://鈥媤ww.鈥媑oogle.鈥媍om/鈥媤allet/鈥?/span>
  4.jCardSim Java card runtime environment simulator. http://鈥媕cardsim.鈥媜rg/鈥?/span>
  5.Sierraware. http://鈥媤ww.鈥媠ierraware.鈥媍om
  6.SpongyCastle crypto API. http://鈥媟tyley.鈥媑ithub.鈥媔o/鈥媠pongycastle/鈥?/span>
  7.Akram, R.N., Markantonakis, K.: Rethinking the smart card technology. In: the Second International Conference on Human Aspects of Information Security, Privacy, and Trust, pp. 221鈥?32 (2014)
  8.Akram, R.N., Markantonakis, K., Mayes, K.: A paradigm shift in smart card ownership model. In: International Conference on Computational Science and its Applications (ICCSA 2010), pp. 191鈥?00, Washington, DC, USA. IEEE Computer Society (2010)
  9.Akram, R.N., Markantonakis, K., Mayes, K.: User centric security model for tamper-resistant devices. In: IEEE International Conference on e-Business Engineering (ICEBE 2011), pp. 168鈥?77 (2011)
  10.Akram, R.N., Markantonakis, K., Mayes, K.: Trusted platform module for smart cards. In: 6th International Conference on New Technologies, Mobility and Security, NTMS 2014, pp. 1鈥?. IEEE (2014)
  11.Alves, T., Felton, D.: TrustZone: integrated hardware and software security. Inf. Q. 3(4), 18鈥?4 (2004)
  12.Anwar, W., Lindskog, D., Zavarsky, P., Ruhl, R.: Redesigning secure element access control for NFC enabled Android smartphones using mobile trusted computing. In: International Conference on Information Society (i-Society), June 2013
  13.Apple Press. Apple Announces Apple Pay: Transforming Mobile Payments with an Easy, Secure and Private Way to Pay, September 2014. https://鈥媤ww.鈥媋pple.鈥媍om/鈥媝r/鈥媗ibrary/鈥?014/鈥?9/鈥?9Apple-Announces-Apple-Pay.鈥媓tml
  14.Azema, J., Fayad, G.: M-Shield mobile security technology: Making wireless secure. Texas Instruments white paper (2008). http://鈥媐ocus.鈥媡i.鈥媍om/鈥媝dfs/鈥媤tbu/鈥媡i_鈥媘shield_鈥媤hitepaper.鈥媝df
  15.Busold, C., Dmitrienko, A., Seudi, H., Taha, A., Sobhani, M., Wachsmann, C., Sadeghi, A.-R.: Smart keys for cyber-cars: secure smartphone-based NFC-enabled car immobilizer. In: ACM Conference on Data and Application Security and Privacy (CODASPY), February 2013
  16.Certgate. Certgate products. cgCard (2012). http://鈥媤ww.鈥媍ertgate.鈥媍om/鈥媤p-content/鈥媢ploads/鈥?012/鈥?9/鈥?0131113_鈥媍gCard_鈥婦atasheet_鈥婨N.鈥媝df
  17.Clark, S.: MasterCard and Samsung introduce embedded NFC payments (2013). http://鈥媤ww.鈥媙fcworld.鈥媍om/鈥?013/鈥?2/鈥?3/鈥?27343/鈥媘astercard-samsung-introduce-embedded-nfc-payments/鈥?/span>
  18. Dmitrienko, A., Sadeghi, A.-R., Tamrakar, S., Wachsmann, C.: SmartTokens: delegable access control with NFC-enabled smartphones. In: Katzenbeisser, S., Weippl, E., Camp, L.J., Volkamer, M., Reiter, M., Zhang, X. (eds.) TRUST 2012. LNCS, vol. 7344, pp. 219鈥?38. Springer, Heidelberg (2012) View Article
  19.Edgar Dunn and Company. Advanced payments report (2014). http://鈥媤ww.鈥媝aymentscardsand鈥媘obile.鈥媍om/鈥媤p-content/鈥媢ploads/鈥?014/鈥?2/鈥婸CM_鈥婨DC_鈥婣dvanced_鈥婸ayments_鈥婻eport_鈥?014_鈥婱WC.鈥媝df
  20.Ekberg, J.-E., Kostiainen, K., Asokan, N.: The untapped potential of trusted execution environments on mobile devices. IEEE Secur. Priv. 99:1 (2014) (PrePrints)
  21.Elenkov, N.: Accessing the embedded secure element in Android 4.x (2012). http://鈥媙elenkov.鈥媌logspot.鈥媎e/鈥?012/鈥?8/鈥媋ccessing-embedded-secure-element-in.鈥媓tml
  22.European Payments Council - GSMA. Trusted Service Manager. Service management requirements and specifications. EPC 220鈥?8. Version 1.0 (2010). http://鈥媤ww.鈥媏uropeanpayments鈥媍ouncil.鈥媏u/鈥媔ndex.鈥媍fm/鈥媖nowledge-bank/鈥媏pc-documents/鈥媏pc-gsma-tsm-service-management-requirements-and-specifications/鈥媏pc220-08-epc-gsma-tsm-wp-v1pdf/鈥?/span>
  23.Global Platform. Card specification. Version 2.2 (2006)
  24.Global Platform. Remote application management over HTTP protocol, September 2006
  25.Global Platform. Global Platform card technology: Secure channel protocol 03, September 2009
  26.Global Platform. GlobalPlatform鈥檚 proposition for NFC mobile: Secure element management and messaging. White paper (2009). http://鈥媤ww.鈥媠icherungssystem鈥媏.鈥媙et/鈥媐ileadmin/鈥婫lobalPlatform_鈥婲FC_鈥婱obile_鈥媁hite_鈥婸aper.鈥媝df
  27.GlobalPlatform. GlobalPlatform Device Technology. TEE System Architecture. Version 1.0 (2011). http://鈥媑lobalplatform.鈥媜rg/鈥媠pecificationsde鈥媣ice.鈥媋sp
  28.GlobalPlatform. A new model: The consumer-centric model and how it applies to the mobile ecosystem (2012). http://鈥媤ww.鈥媑lobalplatform.鈥媜rg/鈥媎ocuments/鈥婥onsumer_鈥婥entric_鈥婱odel_鈥媁hite_鈥婸aperMar2012.鈥媝df
  29.GlobalPlatform. Secure element access control (2012). http://鈥媤ww.鈥媑lobalplatform.鈥媜rg/鈥媠pecificationsde鈥媣ice.鈥媋sp
  30. Gonz谩lez, J., Bonnet, P.: Towards an open framework leveraging a trusted execution environment. In: Wang, G., Ray, I., Feng, D., Rajarajan, M. (eds.) CSS 2013. LNCS, vol. 8300, pp. 458鈥?67. Springer, Heidelberg (2013) View Article
  31.Google. Android API guide - Bluetooth (2010). http://鈥媎eveloper.鈥媋ndroid.鈥媍om/鈥媑uide/鈥媡opics/鈥媍onnectivity/鈥媌luetooth.鈥媓tml
  32. Itoi, N., Arbaugh, W.A., Pollack, S.J., Reeves, D.M.: Personal secure booting. In: Varadharajan, V., Mu, Y. (eds.) ACISP 2001. LNCS, vol. 2119, pp. 130鈥?44. Springer, Heidelberg (2001) View Article
  33.Ekberg, J.-E.: Trustonic.<t-base - a trusted execution environment. White paper (2014)
  34.Kostiainen, K., Ekberg, J.-E., Asokan, N., Rantala, A.: On-board credentials with open provisioning. In: ACM Symposium on Information, Computer, and Communications Security (ASIACCS), pp. 104鈥?15. ACM (2009)
  35.Kostiainen, K., Reshetova, E., Ekberg, J.-E., Asokan, N.: Old, new, borrowed, blue - a perspective on the evolution of mobile platform security architectures. In: First ACM Conference on Data and Application Security and Privacy, pp. 13鈥?4 (2011)
  36.Marforio, C., Karapanos, N., Soriente, C., Kostiainen, K., 膶apkun, S.: Secure enrollment and practical migration for mobile trusted execution environments. In: The Third ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM), pp. 93鈥?8. ACM, New York (2013)
  37.Marlowe, C.: Intel and Visa join forces to boost mobile payments (2012). http://鈥媤ww.鈥媎mwmedia.鈥媍om/鈥媙ews/鈥?012/鈥?2/鈥?8/鈥媔ntel-and-visa-join-forces-to-boost-mobile-payments
  38.Masti, R.J., Marforio, C., 膶apkun, S.: An architecture for concurrent execution of secure environments in clouds. In: The ACM Cloud Computing Security Workshop (CCSW), pp. 11鈥?2 (2013)
  39.Press Release, Giesecke and Devrient. G&D makes mobile terminal devices even more secure with new version of smart card in microSD format. http://鈥媤ww.鈥媑i-de.鈥媍om/鈥媏n/鈥媋bout_鈥媑_鈥媎/鈥媝ress/鈥媝ress_鈥媟eleases/鈥婫%26D-Makes-Mobile-Terminal-Devices-Secure-with-New-MicroSD%E2%84%A2-Card-g3592.鈥媕sp
  40.TrendLabs. 3Q 2012 security roundup. Android under siege: Popularity comes at a price (2012). http://鈥媤ww.鈥媡rendmicro.鈥媍om/鈥媍loud-content/鈥媢s/鈥媝dfs/鈥媠ecurity-intelligence/鈥媟eports/鈥媟pt-3q-2012-security-roundup-android-under-siege-popularity-comes-at-a-price.鈥媝df
  41. Vasudevan, A., Owusu, E., Zhou, Z., Newsome, J., McCune, J.M.: Trustworthy execution on mobile devices: what security properties can my mobile platform give me? In: Katzenbeisser, S., Weippl, E., Camp, L.J., Volkamer, M., Reiter, M., Zhang, X. (eds.) TRUST 2012. LNCS, vol. 7344, pp. 159鈥?78. Springer, Heidelberg (2012) View Article
  
• 作者单位：Alexandra Dmitrienko (16)
  Stephan Heuser (15)
  Thien Duc Nguyen (15)
  Marcos da Silva Ramos (16)
  Andre Rein (16)
  Ahmad-Reza Sadeghi (15)
  
  16. CASED/Fraunhofer SIT Darmstadt, Darmstadt, Germany
  15. CASED/Technische Universit盲t Darmstadt, Darmstadt, Germany
  
• 丛书名：Financial Cryptography and Data Security
• ISBN：978-3-662-47854-7
• 刊物类别：Computer Science
• 刊物主题：Artificial Intelligence and Robotics
  Computer Communication Networks
  Software Engineering
  Data Encryption
  Database Management
  Computation by Abstract Devices
  Algorithm Analysis and Problem Complexity
  
• 出版者：Springer Berlin / Heidelberg
• ISSN：1611-3349

文摘

Today, most smartphones feature different kinds of secure hardware, such as processor-based security extensions (e.g., TrustZone) and dedicated secure co-processors (e.g., SIM-cards or embedded secure elements). Unfortunately, secure hardware is almost never utilized by commercial third party apps, although their usage would drastically improve security of security critical apps. The reasons are diverse: Secure hardware stakeholders such as phone manufacturers and mobile network operators (MNOs) have full control over the corresponding interfaces and expect high financial revenue; and the current code provisioning schemes are inflexible and impractical since they require developers to collaborate with large stakeholders. In this paper we propose a new code provisioning paradigm for the code intended to run within execution environments established on top of secure hardware. It leverages market-based code distribution model and overcomes disadvantages of existing code provisioning schemes. In particular, it enables access of third party developers to secure hardware; allows secure hardware stakeholders to obtain revenue for usage of hardware they control; and does not require third party developers to collaborate with large stakeholders, such as OS and secure hardware vendors. Our scheme is compatible with Global Platform (GP) specifications and can be easily incorporated into existing standards.