Authors:
Guillaume Barbu
1
;
Philippe Hoogvorst
2
and
Guillaume Duc
2
Affiliations:
1
Institut Mines-Télécom / Télécom ParisTech, CNRS LTCI, Oberthur Technologies and Innovation Group, France
;
2
Institut Mines-Télécom / Télécom ParisTech and CNRS LTCI, France
Keyword(s):
Java Card, Java Exceptions, Software Attacks, Fault Attacks, Combined Attacks.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Security and Privacy in Mobile Systems
;
Security and Privacy in Web Services
;
Security Engineering
;
Security in Information Systems
;
Software Security
Abstract:
Many publications have studied the various issues concerning Java Cards security regarding software and/or hardware attacks. However, it is surprising to notice that the particular case of exception-related mechanisms has not been tackled yet in the literature. In this article, we fill this gap by proposing several attacks against Java Card platforms based on both exception handling and exception throwing. In addition, this study allows us to point out that a weakness known by the web-oriented Java community for more than a decade still passes the different steps of the state-of-the-art Java Card application deployment process (namely conversion and verification). This appears all the more important as the Java Card 3 Connected Edition specifications have started to bridge the gap between the two worlds that are Java Cards and Java web services.