Application of the B formal method to the proof of a type verification algorithm

Smart cards are credit-card sized devices embedding a microprocessor. They are typically used to provide security to an information system. Open cards are smart cards able to download code after their issuance. The card security is usually ensured by a third party that sends a cryptographic certificate with the code to authenticate it. On-card code verification could be a solution for improving card deployment flexibility. However, due to the small amount of resources, the verification process is generally done off-card, and checking downloaded code on-card is a real challenge. The FAÇADE architecture proposes to generate a certificate off-card and to check the code using this certificate on-card. However, the certificate or the code can be modified, and so cannot be trusted. This paper presents the approach used to formally prove that the proposed verification algorithm never accepts an invalid program.