Constraint-based security analysis for the Java Card firewall

This paper presents a constraint-based static analysis to prove security (confidentiality) properties of Java Card programs. We define a subset of the Java Card bytecode focussing on aspects of the Java Card firewall, method invocation, field access, variable access, shareable objects and contexts and present an analysis to compute an approximation of the set of possible value stored in each variable. To achieve this task, we introduce a new kind of constraints: quantified conditional constraints. This kind of constraints permits to generate the constraints for a program in a demand-driven fashion. In addition, it permit to model precisely the effects of the Java Card firewall by only producing a constraint if the corresponding operation is authorized by the firewall. The result of this analysis is a precise description of the object flow and of the security exceptions which can be thrown by the firewall.