检索结果-内蒙古大学图书馆

Formal specification of the javacard API in JML: the APDU class

COMPUTER NETWORKS 2001年第4期36卷 407-421页

作者： Poll, E van den Berg, J Jacobs, B Univ Nijmegen Inst Comp Sci NL-6500 GL Nijmegen Netherlands

This paper reports on an effort to increase the reliability of javacard-based smart cards by means of formal specification and verification of javacard source code. As a first step, formal interface specifications, written in the specification language JML (Java Modeling Language), have been developed for all the classes that make up the javacard API. These specifications are "lightweight" in the sense that they are incomplete and specify only some aspects of the API, but they already provide a useful addition to the existing informal API specifications. Moreover, the fact that these specification are written in a formal language makes them amenable to tool support, for verification purposes. As an illustration, the JML specifications of the APDU (Application Protocol Data Unit) class in the javacard API are discussed in detail. (C) 2001 Elsevier Science B.V. All rights reserved.

关键词： smart card javacard formal specification

来源：评论

学校读者我要写书评

暂无评论

The Adoption Rate of javacard Features by Certified Products and Open-Source Projects 22nd

The Adoption Rate of JavaCard Features by Certified Products...

引用

22nd International Conference of the Smart Card Research and Advanced Applications (CARDIS)

作者： Zaoral, Lukas Dufka, Antonin Svenda, Petr Red Hat Raleigh NC 27601 USA Masaryk Univ Brno Czech Republic

ISBN: (纸本)9783031544088;9783031544095

javacard is the most prevalent platform for cryptographic smartcards nowadays. Despite having more than 20 billion smartcards shipped with it and thirteen revisions since the javacard API specification was first published more than two decades ago, uptake of newly added features, cryptographic algorithms or their parameterizations, and systematic analysis of overall activity is missing. We fill this gap by mapping the activity of the javacard ecosystem from publicly available sources with a focus on 1) security certification documents available under Common Criteria and FIPS140 schemes and 2) activity and resources required by javacard applets released in an open-source domain (Paper supplementary materials, full results of analysis and open tools are available at https://***/papers/cardis2023). The analysis performed on all certificates issued between the years 1997-2023 and on more than 200 public javacard applets shows that new features from javacard specification are adopted slowly, typically taking six or more years. Open-source applets utilize new features even later, likely due to the unavailability of recent performant smartcards in smaller quantities. Additionally, almost 70% of constants defined in javacard API specification are completely unused in open-source applets. The applet portability improves with recent cards, and transient memory requirements (scarce resource on smartcards) are typically small. While twenty or more products have been consistently certified every year since 2009, the open-source ecosystem became more active around 2013 but seemed to decline in the past two years. As a result, the whole smartcard ecosystem might be negatively impacted by limited exposure to new ideas and usage scenarios, serving only well-established domains and potentially harming its long-term competitiveness.

关键词： Smartcard javacard Security certification Open-source

来源：评论

学校读者我要写书评

暂无评论

JCMathLib: Wrapper Cryptographic Library for Transparent and Certifiable javacard Applets 5

JCMathLib: Wrapper Cryptographic Library for Transparent and...

引用

5th IEEE European Symposium on Security and Privacy (IEEE Euro S and P)

作者： Mavroudis, Vasilios Svenda, Petr UCL London England Masaryk Univ CRoCS Brno Czech Republic

ISBN: (纸本)9781728185972

The javacard multi-application platform is now deployed to over twenty billion smartcards, used in various applications ranging from banking payments and authentication tokens to SIM cards and electronic documents. In most of those use cases, access to various cryptographic primitives is required. The standard javacard API provides a basic level of access to such functionality (e.g., RSA encryption) but does not expose low-level cryptographic primitives (e.g., elliptic curve operations) and essential data types (e.g., Integers). Developers can access such features only through proprietary, manufacturer-specific APIs. Unfortunately, such APIs significantly reduce the interoperability and certification transparency of the software produced as they require non-disclosure agreements (NDA) that prohibit public sharing of the applet's source code. We introduce JCMathLib, an open library that provides an intermediate layer realizing essential data types and low-level cryptographic primitives from high-level operations. To achieve this, we introduce a series of optimization techniques for resource-constrained platforms that make optimal use of the underlying hardware, while having a small memory footprint. To the best of our knowledge, it is the first generic library for low-level cryptographic operations in javacards that does not rely on a proprietary API. Without any disclosure limitations, JCMathLib has the potential to increase transparency by enabling open code sharing, release of research prototypes, and public code audits. Moreover, JCMathLib can help resolve the conflict between strict open-source licenses such as GPL and proprietary APIs available only under an NDA. This is of particular importance due to the introduction of javacard API v3.1, which targets specifically IoT devices, where open-source development might be more common than in the relatively closed world of government-issued electronic documents.

关键词： Cryptography javacard Auditability Transparency Elliptic Curves Big Integers

来源：评论

学校读者我要写书评

暂无评论

Qualified Electronic Signature via SIM Card Using javacard 3 Connected Edition Platform 9

Qualified Electronic Signature via SIM Card Using JavaCard 3...

引用

9th International Conference on Availability, Reliability and Security (ARES)

作者： Breier, Jakub Pomothy, Adam Nanyang Technol Univ Sch Phys & Math Sci Temasek Lab NTU Phys Anal & Cryptog Engn Singapore 639798 Singapore Slovak Univ Technol Bratislava Fac Informat & Informat Technol Bratislava Slovakia

ISBN: (纸本)9781479978762

Digital signature is one of the most common ways of determining the origin of a document in a digital way. To ensure authenticity, integrity and non-repudiation when such signatures are used, many countries have their standards and regulations. In EU, a signature that complies with those regulations is called 'Qualified Electronic Signature' (QES). There are many QES solutions using dedicated smart cards or security tokens and few of them that use SIM cards as a signature creation device. These SIM-based solutions usually use a third party to perform a signature, such as mobile service operator and operate as a hybrid solutions. Hence, a cooperative connection between a mobile device and a SIM card is needed. In this paper we propose a solution based on the javacard 3.0 Connected Edition platform that operate fulfills following conditions: it is a mobile service operator-independent and mobile phone operating system-independent. The first condition is achieved by performing all the operations directly on a SIM card and the second condition is satisfied by avoiding the application running on a mobile phone operating system. Instead, we propose a web based application to perform the necessary verification methods on the SIM card. So this proposed application can be accessed via mobile phone web browser. Of course, our solution satisfies the Common Criteria standard requirements for the EAL 4 level.

关键词： Qualified Electronic Signature digital signature javacard SIM Card PKI

来源：评论

学校读者我要写书评

暂无评论

增强javacard中Schnorr签名的预处理方案

引用

浙江大学学报（工学版） 2012年第3期46卷 386-391页

作者：李莹殷中科曹晓邓水光浙江大学计算机科学与技术学院浙江杭州310027

为增强javacard的安全与执行效率,研究用于javacard中签名与认证的Schnorr算法,基于密钥恢复攻击技术,提出一种针对Schnorr签名的线性攻击方法,通过实例测试了该攻击的可行性.在此基础上,设计一种安全预处理方案,该方案使用一个线性检... 详细信息

为增强javacard的安全与执行效率,研究用于javacard中签名与认证的Schnorr算法,基于密钥恢复攻击技术,提出一种针对Schnorr签名的线性攻击方法,通过实例测试了该攻击的可行性.在此基础上,设计一种安全预处理方案,该方案使用一个线性检测器对随机数进行线性检测,将经过线性检测的随机数组和相应变量存入卡中特殊区域,避免了签名时在卡内产生随机数,且签名过程不用在卡内进行大运算量的幂模运算.实验结果分析表明:该方案可以大幅度提高处理速度,改善签名效率,同时避免了一类安全攻击.

关键词： Schnorr 数字签名随机数发生器线性检测预处理 javacard

来源：评论

学校读者我要写书评

暂无评论

javacard CPU的设计与实现

引用

计算机工程 2007年第10期33卷 280-282页

作者：张德学郭立傅忠谦何力中国科技大学电子科学与技术系合肥230026

支持javacard技术标准是智能卡的发展方向,目前的javacard系统大多是采用软件虚拟机的方式来解释执行或者通过just-in-time方式执行Java指令,系统软件平台本身占用了大量的资源,且执行效率不高。解决这些问题的方法就是实现硬件Javacar... 详细信息

支持javacard技术标准是智能卡的发展方向,目前的javacard系统大多是采用软件虚拟机的方式来解释执行或者通过just-in-time方式执行Java指令,系统软件平台本身占用了大量的资源,且执行效率不高。解决这些问题的方法就是实现硬件javacard指令处理器。该文给出了一种基于微码的javacard指令处理器的FPGA设计和实现,以javacard CPU为核心搭建javacard CPU测试平台,并将其集成在一块FPGA上实现。

关键词： javacard 处理器智能卡

来源：评论

学校读者我要写书评

暂无评论

javacard处理器上扩展AES加解密硬件模块的研究

引用

小型微型计算机系统 2007年第8期28卷 1492-1495页

作者：张德学郭立傅忠谦中国科学技术大学电子科学与技术系安徽合肥230026

javacard应用的许多场合需要对数据进行加解密,而javacard处理器大都效率不高,难以有效运行现代加解密算法.AOJCP(Area-Optimized javacard Processor)是一款自主设计、基于微码、面积优化、低功耗的javacard硬件处理器,本文描述了在其... 详细信息

javacard应用的许多场合需要对数据进行加解密,而javacard处理器大都效率不高,难以有效运行现代加解密算法.AOJCP(Area-Optimized javacard Processor)是一款自主设计、基于微码、面积优化、低功耗的javacard硬件处理器,本文描述了在其上扩展新一代密钥加密标准AES(Advanced Encryption Standard)的全过程.使用硬件执行128bit AES加密算法只需13个时钟,而pentium III机型上手工优化的AES加密算法最快需要226个时钟.扩展AES硬件模块后,AOJCP加解密速度分别可达25.3和23.5Mbit/sec.

关键词： AES 加密解密 javacard 处理器

来源：评论

学校读者我要写书评

暂无评论

基于javacard的云数据确定性删除方法

引用

武汉大学学报（理学版） 2023年第6期69卷 719-728页

作者：任正伟陈钟凯王丽娜邓莉徐士伟童言武汉科技大学计算机科学与技术学院湖北武汉430065 智能信息处理与实时工业系统湖北省重点实验室湖北武汉430065 空天信息安全与可信计算教育部重点实验室武汉大学国家网络空间安全学院湖北武汉430072 华中农业大学信息学院湖北武汉430070 华中农业大学理学院湖北武汉430070

确定性删除将外包数据的删除问题转换为密钥的安全管控和删除问题,使得留存于云服务提供商和数据使用者处的外包数据是失效、不可恢复的。但是,现有的确定性删除方案大多是在资源充裕的计算机和智能手机上设计和实现的,无法应用于资源... 详细信息

确定性删除将外包数据的删除问题转换为密钥的安全管控和删除问题,使得留存于云服务提供商和数据使用者处的外包数据是失效、不可恢复的。但是,现有的确定性删除方案大多是在资源充裕的计算机和智能手机上设计和实现的,无法应用于资源受限的嵌入式设备。本文提出了适用于javacard平台的云数据确定性删除方法。在该方法中,密钥的使用条件可以是时间,也可以是次数,数据属主可以根据其需要选取一种条件以实现密钥在数据使用者端的受限使用。对于这两种使用条件,数据使用者都可以将密钥及使用条件安全保存在本地,节省通信开销。当密钥使用条件满足时,javacard用密钥解密数据;当密钥使用条件不满足时,javacard安全删除密钥,并生成可公开验证的密钥删除证据。实验和对比分析表明,本文方案性能开销合理,能够实现预期目的,可以应用于嵌入式设备。

关键词：云数据确定性删除密钥管理 javacard

来源：评论

学校读者我要写书评

暂无评论

基于javacard的移动代理安全模型研究

引用

通信学报 2003年第11期24卷 27-33页

作者：王汝传孙开翠杨立扬郑晓燕南京邮电学院计算机科学与技术系中国科学院研究生院信息安全国家重点实验室北京100039

欲阻止恶意主机攻击移动代理,代理中的代码信息和数据信息必须被隐藏起来。同时,还要使它们对于执行环境来说是可访问和可执行的。现有措施大都采用软件方法(如密码技术),但并不足以解决恶意主机问题。一个完全不同的方法就是使用可信... 详细信息

欲阻止恶意主机攻击移动代理,代理中的代码信息和数据信息必须被隐藏起来。同时,还要使它们对于执行环境来说是可访问和可执行的。现有措施大都采用软件方法(如密码技术),但并不足以解决恶意主机问题。一个完全不同的方法就是使用可信赖的且可抵御攻击的javacard来保护移动代理。本文讨论用javacard保护移动代理的机理,同时给出我们所设计的一个javacard的安全模型。

关键词：移动代理 javacard 安全模型

来源：评论

学校读者我要写书评

暂无评论

javacard CPU的设计与FPGA实现

引用

电子技术应用 2006年第9期32卷 58-61页

作者：张德学郭立傅忠谦何力中国科技大学电子科学与技术系安徽合肥230026

给出了一种基于微码的javacard指令处理器的FPGA设计和实现,以此javacardCPU为核心搭建的测试平台已集成在一块FPGA上实现。

关键词： javacard 处理器智能卡

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：