A User Centric Security Model for Tamper-Resistant Devices

8.3 Runtime Protection Mechanism
8.3.4 Application Compilation
It might be considered adequate to modify the Java virtual machine specication for the
smart card environment to provide an eective runtime protection mechanism; for example,
reducing the number of opcodes and removing opcode zero from opcode list. However, we
avoid it for the sake of simplicity. Instead we use the property les that include meta-data
about the respective application. The property le is downloaded to the smart card as part
of the application and veried by the respective TEM during the bytecode verication as
shown in gure 8.1.
A Java compiler will take a Java le and convert it to a (bytecode) class le. The class
le not only has opcodes, but it also includes information about various segments (e.g.
methods, and classes) of an application that is necessary for the JCVM to execute the application.
However, for our proposal we introduce a property le that includes additional
information about an application. If a JCVM knows how to process property les then it
will proceed with them; otherwise, it will silently ignore them. In our proposal a property
le is stored and used by the TEM during the execution of the associated application. In
order to integrate the TEM into the runtime environment, the JCVM is required to be modied
so it can communicate with the TEM in order to safeguard the execution environment.
1 A p p l i c a t i o n I n f o {
2 A p p l i c a t i o n _ I d e n t i f i e r A p p l i c a t i o n I d e n t i f i e r ;
3 C l a s s I n f o r m a t i o n C l a s s I n f o [ class_count ] ; }
4 C l a s s I n f o {
5 C l a s s _ I d e n t i f i e r C l a s s I d e n t i f i e r ;
6 MethodInformation MethodInfo [ method_count ] ; }
7 MethodInfo {
8 Method_Identifier M e t h o d I d e n t i f i e r ;
9 MethodIntegrity HashValue ;
10 ControlFlowGraph Graph [ jumps_count ] }
Listing 8.1: Structure of the property le of a Java Card application.
The property le contains security and reliability information concerning an application
that the runtime environment can utilise to execute an application. The structure of the
property le is illustrated in listing 8.1, which includes information regarding the control-
ow graph, and integrity matrix (hash values of the non-mutable part of the individual
methods in a class).
The ApplicationInfo data structure includes the application identier (e.g. AID) and an
array of classes that are part of the respective application. For each class in the application,
we have a ClassInfo structure that contains the MethodInformation array that
contains information regarding all methods associated with the given class. Each method
is represented by MethodInfo structure that includes the control-ow graphs that are gen-
198