A User Centric Security Model for Tamper-Resistant Devices

8.2 Smart Card Runtime Environment
Class File
Smart Card
Resource
Java File Compile Packager
File
Installation
Package
Off-Card
Installer
On-Card Bytecode
Verifier
Supporting
Libraries
Installed
Application
Figure 8.1: Java Card application development process
any resource les and supporting libraries into an installation package (e.g. CAP, or JAR
le [16, 28]) that can be downloaded to a Java Card. On the Java Card, the on-card
bytecode verier will analyse the downloaded application and validate that it conforms to
the stated Java language semantics.
The class le contains the bytecode representation of the program code, an example is
illustrated in gure 8.2. The statement if_scmplt 22, at line 08, of bytecode representation
is the opcode for if-else statement. The opcode represents that if the statement is
true then proceed with next line otherwise jump to line 22. The JCVM for Java Card
3.0.1 has listed approximately 185 opcodes and each opcode (e.g. if_scmplt) has an associated
byte value. For example, opcode if_scmplt is represented as byte values 0x6C
(in hexadecimal format). The SCRT interprets individual instructions (opcodes) during
the application execution.
00: if (a < b){
01: c = a;
02: }else{
03: c = a;
04: }
Java File
Compile
00: aload_0
01: getfield #14
04: aload_0
05: getfield #16
08: if_scmplt 22 (+14)
11: aload_0
12: aload_0
13: getfield #14
Class File (Bytecode Representation)
16: putfield #23
19: goto 30 (+11)
22: aload_0
23: aload_0
24: getfield #14
27: putfield #23
30: return
Figure 8.2: Java source le to bytecode conversion
Figure 8.3 illustrates the architecture of a typical JCVM except for the modules in a dotted
circle (i.e. runtime security manager) which is part of our proposal discussed in section 8.3.
Various components and their functions are described subsequently with emphasis on how
they interact during the execution of an application.
The JCVM mainly deals with an abstract storage unit called word that is the smallest
storage unit that it can process. The actual size of a word is left to the JCVM implementers
and it depends upon the underlying hardware. However, the JCVM specication [16]
states that a word should be large enough to hold a value of byte, short, reference, or
returnAddress.
When an application is initiated, the bytecode representation of an application is loaded
to the JCVM memory by a class loader subsystem. The class loader is responsible for
190