Operating System Integrity Verification for Java Card Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for smart cards and similar electronic devices are vulnerable to disruption attacks, particularly due to reliance on developer integrity checks for data protection, which can be tedious and unreliable, and do not inherently resist physical or logical attacks that modify data or instructions.
Innovation Solution
An operating system method that automatically updates metadata for protected objects and data members with integrity verification data, ensuring that any manipulation is checked against a reference integrity value before proceeding, thus providing robust protection against disturbance attacks without relying on the developer to manually implement integrity checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Java Card 3.0.5 application programming interface offers a security mechanism for creating integrity-sensitive arrays using the SensitiveArrays class, then data protection is provided, but the responsibility for reliability is placed on the application developer which makes source code writing tedious and maintenance complex
Solution Approach 1:
The system performs integrity checks automatically without requiring developer intervention. The virtual machine monitor intercepts method calls and automatically verifies integrity of objects and arrays, making the security mechanism self-executing rather than developer-dependent.
Solution Approach 2:
The virtual machine monitor acts as an intermediary between the application code and the execution environment. It intercepts method calls and automatically performs integrity checks on objects and arrays, shielding the developer from the complexity of manual verification while maintaining security.
2Reliability
If manual integrity checks are incorporated into the source code, then reliability of security mechanism is improved, but the amount of non-volatile memory occupied by the application code increases
Solution Approach 1:
The integrity check functionality is extracted from the application code and relocated to the virtual machine monitor. This separates the security verification logic from the application binary, maintaining reliability while reducing the memory footprint of the deployed application.
3Reliability
If the operating system automatically performs integrity checks on all objects, then resistance to disruption attacks is improved, but the processing time and system complexity increase
Solution Approach 1:
The system applies integrity checks selectively rather than universally. The virtual machine monitor intercepts specific method calls (new, clone, deserialize) and performs checks only on objects created through these operations, rather than checking every object access, thus balancing security with performance.
4Reliability
If integrity checks are performed at every manipulation point, then security against logical attacks is improved, but the ease of operation deteriorates due to increased code complexity
Solution Approach 1:
The virtual machine monitor serves as an intermediary that automatically performs integrity checks at critical points without requiring explicit code from the developer. This maintains strong security against logical attacks while keeping the application code simple and maintainable.
Data Source
Figure 1~2B
Figure 3
AI summary
During the execution of an application developed in an object-oriented language and compiled into intermediate code, the intermediate code is executed by an interpreter of an operating system installed on a circuit board. When the interpreter detects a call to a dedicated operating system function within the application's intermediate code for an object to be protected, the operating system updates (311) metadata associated with that object to link a reference integrity check data to that object.When the interpreter detects further manipulation of the protected object in the application's intermediate code, the operating system determines (305) an integrity check data value corresponding to said protected object in its current state, and before the interpreter performs said manipulation, the operating system verifies (306) that the calculated integrity check data value matches the reference integrity check data value.