Every organization is facing their own Digital Transformation as they attempt to stay ahead of the competition, or worse, just keep up. Each new opportunity, whether embracing machine learning, IoT, or a cloud migration, seems to bring new development, deployment, and management models. The results are more diverse and federated computing models than any time in our history.
| By Joseph Smith | Article Rating: |
|
| July 1, 2002 12:00 AM EDT | Reads: |
14,650 |
Ever since the Java Card 1.0 was introduced in 1996 it has been gradually maturing, and recently celebrated its fifth anniversary. American Express, Visa, and now the Department of Defense have all deployed solutions that utilize the Java Card specifications.
This rather large movement proves that Java Card technology is a great system for data security and data mobility. At last count, American Express claimed over 4 million deployed cards and Visa estimated over 7 million at the end of last year.
Since September 11, 2001, there has been a lot of interest regarding Java-based smart cards combined with biometrics (verifying the identity of a person through some physical characteristic). This has driven the Java Card specifications to the forefront, and more and more engineers (and managers) are scrambling to implement them.
Currently, Java Card implementers use Java Card 2.1.x. Soon you'll be seeing Java Card 2.2 deployed into the marketplace. Those who have started to use the Java Card 2.1.x API are realizing that it's quite a hassle to do some basic things. For example, you can't utilize strings or other common primitive types found in Java because the Java Card processor has extremely limited resources. Most cards offer a little less than 32K of memory for applets. (Note: Don't confuse applets with J2SE applets. Applets refer to applications that reside on the Java Card.) Another deterrent is that you have to deal with bytes! When was the last time you had to think in bytes and byte arrays?
Java vs Java Card
The Java Card contains a virtual machine that's tailored for it, the Java Card VM. Because of the limitations, the JCVM has some unsupported features such as:
- Dynamic class loading
- Garbage collection
- Threads
- Cloning
- Default visibility override
- Package visible interface can't be extended to public visibility
- Int, double, float, and long are not supported
- Static instantiated classes aren't allowed
- There's only one system class, the javacard.framework.JCSystem.
- Persistence and transience behavior are different from Java.
- Only single-dimensional arrays are allowed.
- Security management policy is implied in the JCVM and not an explicit class.
- The JCVM is a 16-bit system.
- Packages
- Virtual methods
- Interfaces, abstract classes, and exception handling
- Polymorphism
- The root class is of class Object
- A maximum of 256 instance fields per class
- Array size is limited to 32K
- Memory space is limited to 32K per package
To make engineering more complex, the structure of the applet code appears a bit backward: you use a large switch case block to process the commands you want. However, Java Card 2.2 makes all this a bit easier.
Java Card Remote Method Invocation
One thing that will make engineering easier is the use of Remote Method Invocation. An engineer will no longer have to spend a lot of time learning various APDU commands.
Currently, you have to issue commands in the following format:
CLA INS P1 P2 LC CData
Depending on the applet, it would have to switch case on each individual CLA, INS, and P1/P2 to process the necessary command. This method of transmitting data can be a tedious job and a maintenance nightmare. The Java Card RMI makes it easier to perform a command.
More Algorithms
For the implementation of security algorithms we must rely on the individual vendors. Some vendors implement cards that contain just DES and Triple DES, while others implement DES, Triple DES, and RSA. For the implementation of RSA it's common to also include a crypto-coprocessor in the smart card chip to help speed up the calculations.
In Java Card 2.2, AES and elliptic curves are added. New key lengths are also available with these new algorithms. Of course, this can be a headache involving export restrictions, so check with your vendor to see what's actually implemented and what key lengths they support.
You can still perform digital signature and random number generation on the card as you did with Java Card 2.1.x.
Applet/Package Deletion
Applet/package deletion has been a hot topic since the first release of the Java Card. This feature of 2.2 will be up to individual vendors to support, utilizing their own implementation. But nonetheless, it's sure to be available since engineers and others will be requesting the functionality. Applets created using the Applet.register() methods exist until deleted by the applet deletion manager. This manager can be an applet provided by the vendor and is selectable by providing an application identifier, AID. Sun wanted to leave the implementation of the applet deletion manager up to the vendors and, because of that, the AID won't be standardized but it must be SELECTable. As long as the vendors provide a SELECTable behavior to the outside world, they can implement the applet deletion manager any way they see fit for their Java Cards.
Memory Resource Management
The JCSystem class offers two new methods: isGarbageCollectionSupported and requestGarbageCollection. These offer limited garbage collection support to query if a vendor has implemented garbage collection functionality and to request that the action be carried out. Garbage collection isn't a requirement, and once again it's up to the implementers. However, you can now query the amount of memory available to the applet, which wasn't available in 2.1.x.
JCSystem.getAvailableMemory is a nicer way to query if memory is available before you allocate it. In 2.1.x, you cross your fingers and hope that the memory is available when you allocate it, otherwise you'll receive an exception.
Logical Channels
In Java Card 2.1.x your commands are processed by the currently selected applet. Java Card 2.2 allows up to four sessions to be open, one session per logical channel. Now applet instances can be selected on different logical channels. The applet can take advantage of multisession functionality and can be concurrently selected with another applet on a different logical channel. The applet can even be selected multiple times. There is a basic logical channel, logical channel 0, that is activated upon a card reset. A card reset can occur when the card has been powered down via card removal or electrical failure.
Applets that are capable of being selected on multiple logical channels at the same time are called multiselectable applets. These will have the same security constraints as in Java Card 2.1.x with regard to active contexts. To forward APDU commands to a logical channel, the command will contain encoding in the header CLA byte to denote which channel. For example, CLA byte 0x02 could denote logical channel 2, and 0x00 could denote logical channel 0. The logical channel is of key importance for wireless support involving 3GPP, WAP, and ETSI.
Conclusion
Java Card 2.2 includes support for contactless smart cards. These cards don't have the visible chip on them, but can be read if the card is simply waved within a certain proximity of a contactless CAD. There has been movement to include some form of biometry in the Java Card API, and this technology will no doubt be appearing on the market soon.
With the new Java Card specification, existing features, such as transaction processing (much like commit/rollback in a database), become more powerful.
Personally, I'm excited about the RMI specification and memory management features that will make complex Java Card engineering a lot friendlier.
Published July 1, 2002 Reads 14,650
Copyright © 2002 SYS-CON Media, Inc. — All Rights Reserved.
Syndicated stories and blog feeds, all rights reserved by the author.
More Stories By Joseph Smith
Joseph Smith, a senior software
engineer with over 13 years of
experience,has been designing and
developing Web-based soulutions for
the last five years.
Every organization is facing their own Digital Transformation as they attempt to stay ahead of the competition, or worse, just keep up. Each new opportunity, whether embracing machine learning, IoT, or a cloud migration, seems to bring new development, deployment, and management models. The results are more diverse and federated computing models than any time in our history.
Jan. 8, 2019 12:30 PM EST |
By Zakia Bouachraoui Jan. 8, 2019 10:00 AM EST |
By Liz McMillan Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.Nov. 11, 2018 04:00 PM EST Reads: 3,170 |
By Pat Romanski Nov. 11, 2018 11:45 AM EST Reads: 2,284 |
By Elizabeth White Nov. 10, 2018 11:45 PM EST Reads: 2,064 |
By Pat Romanski Nov. 10, 2018 10:00 PM EST Reads: 3,206 |
By Pat Romanski Nov. 10, 2018 01:00 AM EST Reads: 2,941 |
By Pat Romanski Nov. 9, 2018 04:45 PM EST Reads: 2,282 |
By Yeshim Deniz Nov. 3, 2018 05:00 AM EDT Reads: 4,027 |
By Yeshim Deniz Nov. 2, 2018 03:00 PM EDT Reads: 3,210 |


Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
"Calligo is a cloud service provider with data privacy at the heart of what we do. We are a typical Infrastructure as a Service cloud provider but it's been des...
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the...
Isomorphic Software is the global leader in high-end, web-based business applications. We develop, market, and support the SmartClient & Smart GWT HTML5/Ajax platform, combining the productivity and performance of traditional desktop software with the simplicity and reach of the open web.
With staff in 10 timezones, Isomorphic provides a global network of services related to our technology, with offerings ranging from turnkey application development to SLA-backed enterprise support.
Leading global enterprises use Isomorphic technology to reduce costs and improve productivity, developing ...
On-premise or off, you have powerful tools available to maximize the value of your infrastructure and you demand more visibility and operational control. Fortunately, data center management tools keep a vigil on memory contestation, power, thermal consumption, server health, and utilization, allowing better control no matter your cloud's shape. In this session, learn how Intel software tools enable real-time monitoring and precise management to lower operational costs and optimize infrastructure for today even as you're forecasting for tomorrow.
Data center, on-premise, public-cloud, private-cloud, multi-cloud, hybrid-cloud, IoT, AI, edge, SaaS, PaaS... it's an availability, security, performance and integration nightmare even for the best of the best IT experts.
Organizations realize the tremendous benefits of everything the digital transformation has to offer. Cloud adoption rates are increasing significantly, and IT budgets are morphing to follow suit. But distributing applications and infrastructure around increases risk, introduces complexity and challenges availability at every turn.
To embrace DX and to come out on top, t...
DevOps has long focused on reinventing the SDLC (e.g. with CI/CD, ARA, pipeline automation etc.), while reinvention of IT Ops has lagged. However, new approaches like Site Reliability Engineering, Observability, Containerization, Operations Analytics, and ML/AI are driving a resurgence of IT Ops. In this session our expert panel will focus on how these new ideas are [putting the Ops back in DevOps orbringing modern IT Ops to DevOps].
Addteq is a leader in providing business solutions to Enterprise clients. Addteq has been in the business for more than 10 years. Through the use of DevOps automation, Addteq strives on creating innovative solutions to solve business processes. Clients depend on Addteq to modernize the software delivery process by providing Atlassian solutions, create custom add-ons, conduct training, offer hosting, perform DevOps services, and provide overall support services.
In his session at 21st Cloud Expo, Michael Burley, a Senior Business Development Executive in IT Services at NetApp, described how NetApp de...
When building large, cloud-based applications that operate at a high scale, it’s important to maintain a high availability and resilience to...


















