Virtual Machine Secure Bytecode Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security tokens, such as smart cards, face a challenge in balancing high security with acceptable performance, as enhancing security often slows down execution, and optimizing for speed may compromise security, especially when subjected to physical attacks.
Innovation Solution
A virtual machine that recognizes and processes secure bytecodes for increased security in sensitive parts of applets, while using conventional bytecodes for faster execution in non-attack contexts, with secure bytecodes offering higher resistance to attacks but at a slower pace.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure bytecodes are used to enhance security against physical attacks, then security resistance is improved, but execution speed deteriorates
Solution Approach 1:
The patent applies different bytecode types to different code regions: secure bytecodes are used in sensitive areas requiring high security (such as cryptographic operations and authentication routines), while conventional bytecodes are used in non-sensitive areas where speed is more critical. This localized application resolves the contradiction by providing enhanced security only where necessary rather than uniformly across the entire applet.
Solution Approach 2:
The virtual machine dynamically selects between secure and conventional bytecode execution paths based on the security sensitivity of the current operation. The system adapts its security level and execution speed according to the specific context, using secure bytecodes for sensitive operations and conventional bytecodes for routine operations, thus balancing security and performance dynamically.
2Reliability
If secure bytecodes are used for all operations, then security is improved, but productivity deteriorates
Solution Approach 1:
The patent implements security selectively by marking only sensitive instructions with secure bytecodes (e.g., cryptographic functions, authentication, data protection operations), while leaving non-sensitive instructions to use conventional bytecodes. This localized security approach maintains high security for critical operations while preserving overall execution efficiency.
Solution Approach 2:
Instead of applying secure bytecodes to all operations (excessive action), the patent applies them only to the necessary subset of sensitive operations (partial action). This partial application of security measures achieves adequate protection while avoiding the performance penalty of securing every single operation.
3Productivity
If conventional bytecodes are used for fast execution, then productivity is improved, but security deteriorates
Solution Approach 1:
The patent creates a hybrid execution model where conventional bytecodes provide fast execution for non-sensitive operations, while secure bytecodes provide enhanced protection for sensitive operations. This spatial differentiation allows the system to achieve both speed and security by matching the execution mode to the security requirements of each specific instruction.
4Reliability
If secure bytecodes with prefixes are introduced, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces a prefix byte as an intermediary marker that indicates whether the following instruction should be executed as a secure bytecode or conventional bytecode. This simple one-byte prefix mechanism allows the virtual machine to distinguish between secure and conventional operations without requiring complex instruction encoding schemes, thereby limiting the increase in device complexity.
Solution Approach 2:
The patent modifies the bytecode structure by adding a prefix parameter that changes the execution mode. Instead of creating entirely new complex instruction sets, the system uses a simple parameter change (the prefix byte) to toggle between secure and conventional execution paths, minimizing the increase in virtual machine complexity.
Data Source
Figure 1
Figure 2~6
AI summary
The invention relates to a virtual machine. The virtual machine is set to recognize, in addition to a set of conventional bytecodes, at least one secure bytecode functionally equivalent to one of the conventional bytecodes. It is set to process secure bytecodes with increased security, while it is set to process conventional bytecodes with increased speed. The invention also relates to a computing device comprising such a virtual machine, to a procedure for generating bytecode executable by such a virtual machine, and to an applet development tool comprising such procedure.