On-demand distributed on-card bytecode verification

After the evolution of Java-based smart cards, security issues arises concerning Java applets not to be vulnerable to modifications or malicious attacks that may threaten applications supported by these applets. Bytecode verification fills the latter gap. Java Sandbox Security model and Common Criteria standard suggest on-board bytecode verification to maximize security. This paper suggests an on-card bytecode verification whose execution is distributed within Java applet´s lifecycle. Part of the verification runs on-demand at the run-time execution phase of the Java applets. The proposed solution targets a real Java-based card operating system.