search

GlobalPlatform / WebApis-for-SE

Open source Apis to access a Secure Element from a Web application
Apache License 2.0
18 stars 5 forks source link

Authorized web applications are allowed #32

Closed hchavers closed 8 years ago

hchavers commented 8 years ago

Comments from Trusted Computing Group - Item # 13

Section: 6. Access Control

Comment: RE “In order to make sure only authorized web applications are allowed to use the Secure Element, the web application runtime MUST use ...”

Proposed Resolution: Is the intent to EXCLUDE any non-web-app users of the Secure Element or to EXCLUDE use of the Secure Element by unauthorized web applications?

serianox commented 8 years ago

The intent is only to control access from web apps. Non-web apps, e.g. middleware, will still have access to the Secure Element as they used to.

Note that it does not protect from a compromised device that would not properly implement the Access Control Enforcer, which is addressed by the internal protection of the Secure Element itself (using e.g. PIN or secure messaging).

This does not prevent however the user device to implement the same or similar mechanism defined in [GP-AC] to control access to the Secure Element from non-web apps, e.g. [OMAPI] in Android.