Enforcement of applet boundaries in Java card systems

In multi-application Java Cards, applet’s sensitive data must be protected against unauthorized accesses. Applet isolation is normally achieved through the firewall mechanism. The firewall allows an applet to access external objects only through an object sharing mechanism, called shareable interface. Firewall is based on the access control policy and does not control information propagation. This paper shows how extending the firewall with the inspection of call-stack of shareable interface methods contributes to avoid unwanted information flow that can arise as a result of method callback from one applet to another. This control detects the illegal information flow of the well-known Electronic Purse case study.