A security vulnerability of Java Card on array access in financial system
Jiang-pei Xu,Li-ji Wu,Xiang-jun Yang,Yu-zhong Wang,Xiang-min Zhang
DOI: https://doi.org/10.1109/WOCC.2013.6676466
2013-01-01
Abstract:Generally, Java Card mainly consists of the following parts: COS (Chip Operating System), JCVM (Java Card Virtual Machine), and API (Application Programming Interface). As a multi-application system, Java Card itself is very complicated, so it may inevitably exist some security vulnerabilities inside. Based on these parts of Java Card, we can find out some detectable points to its security vulnerabilities. This paper presents a method containing a specific case to test Java Card on array access, aiming to detect the possible security vulnerabilities of JCVM. In this paper, three different kinds of Java Cards have been tested and the test result has been described. From the test result, we successfully find out a security vulnerability of JCVM.