Java security: hostile applets, holes&antidotes
Java security: hostile applets, holes&antidotes
Java Card: Internet Computing on a Smart Card
IEEE Internet Computing
Formalizing the safety of Java, the Java virtual machine, and Java card
ACM Computing Surveys (CSUR)
A Secure Object Sharing Scheme for Java Card
ICICS '02 Proceedings of the 4th International Conference on Information and Communications Security
A Formal Correspondence between Offensive and Defensive JavaCard Virtual Machines
VMCAI '02 Revised Papers from the Third International Workshop on Verification, Model Checking, and Abstract Interpretation
Context Inference for Static Analysis of Java Card Object Sharing
E-SMART '01 Proceedings of the International Conference on Research in Smart Cards: Smart Card Programming and Security
A Programming and a Modelling Perspective on the Evaluation of Java Card Implementations
JavaCard '00 Revised Papers from the First International Workshop on Java on Smart Cards: Programming and Security
Secure object flow analysis for java card
CARDIS'02 Proceedings of the 5th conference on Smart Card Research and Advanced Application Conference - Volume 5
Secure information flow for a concurrent language with scheduling
Journal of Computer Security - Formal Methods in Security Engineering Workshop (FMSE 04)
Malicious Code on Java Card Smartcards: Attacks and Countermeasures
CARDIS '08 Proceedings of the 8th IFIP WG 8.8/11.2 international conference on Smart Card Research and Advanced Applications
Electronic Notes in Theoretical Computer Science (ENTCS)
Application-binding protocol in the user centric smart card ownership model
ACISP'11 Proceedings of the 16th Australasian conference on Information security and privacy
Formal methods for smartcard security
Foundations of Security Analysis and Design III
Firewall mechanism in a user centric smart card ownership model
CARDIS'10 Proceedings of the 9th IFIP WG 8.8/11.2 international conference on Smart Card Research and Advanced Application
Hi-index | 0.00 |
Since the invention of the Java Card, the issue of code and data sharing has been a topic of great interest. Early Java Cards shared data via files secured with access control lists. Java Card 2.1 specification introduced a method of object sharing, allowing access to methods of server applets using Shareable Interface Objects (SIO). However, this SIO approach can be improved. It permits access to all interfaces of the SIO, whereas some interfaces may be intended only for particular clients. AID impersonation could be used to gain access to services unless the card authenticates all applets. Access to a SIO by future applets may be impossible. Passing object data between applets is quite cumbersome. An approach to object sharing based on delegates is described, which provides needed improvements with minimal modifications to Java Card 2.1. Using the delegate approach, only the desired methods of an applet are exposed, and each method can be protected by any security policy the applet wishes to implement. A shared secret security policy is described, using challenge/response phrases to avoid revealing the shared secret. Such a security policy does not require applet authentication to avoid AID impersonation, and lends itself readily to access by any future applets that may be written.