Checking Absence of Illicit Applet Interactions: A Case Study

Abstract

Abstract. This paper presents the use of a method -and its corresponding tool set -for compositional verification of applet interactions on a realistic industrial smart card case study. The case study, an electronic purse, is provided by smart card producer Gemplus as a test case for formal methods for smart cards. The verification method focuses on the possible interactions between different applets, co-existing on the same card, and provides a technique to specify and detect illicit interactions between these applets. The method is compositional, thus supporting post-issuance loading of applets. The correctness of a global system property can algorithmically be inferred from local applet properties. Later, when loading applets on a card, the implementations are matched against these local properties, in order to guarantee the global property. The theoretical framework underlying our method has been presented elsewhere; the present paper evaluates its practical usability by means of an industrial case study. In particular, we outline the tool set that we have assembled to support the verification process, combining existing model checkers with newly developed tools, tailored to our method.

Load time code validation for mobile phone Java Cards

“…Therefore, the ClaimChecker during validation of A parses all interfaces declared in the CAP file of A (lines 5-6) and checks with the Export component if the interface is exported. Thus the ClaimChecker successfully identifies all shareable interfaces (lines 9-12), and for each of these interfaces it goes through the declared method tokens matching them with the Provides A set (lines [8][9][10][11][12][13][14][15][16][17][18][19][20][21][22]. By definition of the shareable A and by construction of the ClaimChecker (in compliance with the JCRE specifications), shareable A ⊆ Provides A .…”

“…There were investigations [12,21,22,23] of static scenarios, when all applets are known and the composition is analyzed off-device. For example, Avvenuti et al [24] have developed the JBIFV tool which verifies whether a JC applet respects pre-defined information flow policies.…”

User Centric Security Model for Tamper-Resistant Devices

“…The reason for choosing Java Card and Multos is twofold: a) they represent two contrasting architectures to implement the rewall mechanism, and b) they are the two most deployed smart card platforms. Furthermore, the rewall mechanisms deployed in the ICOM are mature [28,29,185,187,188] and have been extensively studied [189] [192], which cannot be claimed for the UCOM.…”

A Type System for Checking Applet Isolation in Java Card

“…These formalizations have been used to formally verify applet isolation and confidentiality properties [3,4,15]. With our type system, applet isolation can be mostly checked syntactically.…”