Automatic source code transformations for strengthening practical security of smart card applications

Warning

This publication doesn't include Faculty of Sports Studies. It includes Faculty of Informatics. Official publication website can be found on muni.cz.
Authors

LORENC Václav SMOLKA Tobiáš ŠVENDA Petr

Year of publication 2010
Type Article in Proceedings
Conference Sborník příspěvků z 36. konference EurOpen.CZ
MU Faculty or unit

Faculty of Informatics

Citation
Web http://europen.cz/Anot/36/eo-1-10.pdf
Field Informatics
Keywords smart card; power analysis; source code analysis; platform security
Description Smart card platforms like Java Card or .NET allow to implement portable applications that can be run on different smart card hardware. The resulting overall security of the applet is strongly dependent on the implementation of the smart card operating system, related libraries, as well as physical resistance and information leakage of the underlying hardware. Defenses implementable on the source code level for later case might exist, but such a situation is unfavorable for applet developer as multiple versions of applet must be maintained to support a wider range of smart cards (although all providing Java Card platform). In this paper we describe several practical attacks on modern smart cards, discuss possible defenses and propose a general framework for automatic replacement of vulnerable operations by safe equivalents. A code strengthening constructions can be also automatically inserted. Practical implementation and examples of usage are presented and discussed.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.

More info