Formalising the Safety of Java, the Java Virtual and Java Card

Embed Size (px)

Text of Formalising the Safety of Java, the Java Virtual and Java Card

  • "!$#&%'&(!)*#)+,-./0213)45768!$#:9; )?A@CBD@FEGIHJGK.ELBD@NMPO QPRTSVUXWYEZ@FK.R\[U\K.EZS^]`_YabJ_.c.cTd

    e,f0ghTikj l$hmonqprnLsutvnLw\xzy{nqn-|}t~xztv{vtxznLp^xr{prn CVNDs^~zn-xCYn{y~tvtNpzCJ{{prNNy{n~LTCoxzyntvC-xCCDs^7~zn-xC0~zv.FCxz{prtvFx{nLsut-n~~zy0C~~CpxLCpr{~L*y{n'-C{-v~ztvCotv~)xzyxqwytvn0vCxPNF}w$CprIyC~'nnL}N{nCprn)-N-npxrn7nL.Npxt~{nLnZ}n7xr{{tv0LCy{npznNx~nLx*Cy{tv{n'pznZC{C{vnNpzCu{nL~$xzy{nwyCvn'CNDs^txr~tnnLFxrxztvC

  • tv{CvCN)-C-nL{xr~~r^n-xC~zn-pztxqtpzNCptv{P{NNn~D.nN{)tv)kNv{'utxzy;/!=?1mon~yC{~z0tvNn'xrI.CtvFx)C}x'xzyxxry{n.C{{prV.n-xwnnLq~zn-x)'~znL{pztxt~~zCnLxztvn~vtxxrvnJs^Cn@/D^21 Ixry{t~.nLpw$nC{v0nLFxrtNI~zn-pztx7{prtnBAxry{ntv}-~*t~*C0NDsDq~r^n-xC$;txr~znL 7NDs^ YnLp~ vtvtxznZ ~r^nLx {Cpn-|{nC

    {prCCptv{2`-prn{txLCpr{vtv^xrtN tvNDsDXw$C{{x7CpFxznn0xzyx7xzy{n-prn}txtvtx-N{2{nsCnLp.nVnL|F-nn}nZY;pzNCp sCnLprtLxztvCxznZy{{tF{n~prn{nn}nZ2xrpznZC~zC.C}x~zy7y{tvCy}vnLsNnLY~zn-xpzNnpxrtnZ~-J*y{npznLCprnwn ~z{prsCnLxry{n){vtv^xrtNk~yxrny{{tF{nZ~xrCDs^{ xzy{npzntv{tv{~nZxztvN~kxry{n.nLpw$n~z{prsCn'v.C~

    nZx~k.Cprvt~tv{*xry{nP~r^n-x'

  • }t.npznFxCxrtvsFtxrtnZ~~zyC~-}}nnL|unZ-}xrtvC-}}nvNNutv{vtv{utv{-}}nvtv{utv{tv~txr~znL$LC.N~zno*xzypznn}t~xrtvxkC-xztvsutxrtvn~L2.~xrxznLnFxr~*prn~nZ&tv7TT`Npr{nLp

    PQ [ckZ#ai_fUXW#UXYO[Ma*y{n ~nZ-{prtxCCnpt~qpzNxrtvnLC.C{nNx$xzy^xPy{n~xztv{vnnLFx NDs^~zn-pztx.Cvt-tvn~BTCptv~xrC-nCNLLn~r~xzxry{n vn~z}~xrnLD.n{prCy{tv{txrnYLC{{nZxrtN~P7nC}n'C{v7xrLnLpzxrtvV{n-xw$Cpr0C{}prn~r~zn~LYNp {{vnLxNp{t^xztvNL{pr}-n~r~$C{vLnLpzxrCt&wtv}^wtv{)nsCnLFx~-$}nL{xL{NDsDpznvtnZ~CCoNr-u^.uLxz'{n-xznp

    tv{nkwy{n-xry{nLpTprnF{n~x

  • {prCCp~L^wnsCnpLw$nIw$C{2prCn7xzyx.nLpzCprtv{vy{nZ}~

    ^xvtv{FAxztvn't~'C{xztvt~zxztvC

  • ^xzxznL{xqyN~qnnLN}n7^x~.nLtutv{0PNDs^}kxzyn&@%Npxzy{nJLC{tvvnLp0'~CpC~w$nyDsCn.nLnC{vnxz0nZ~x{vt~y=nLprpzNpr~ N}n}pztv{7xry{nxrprC~zvxztvC
  • !

    "

    #

    $

    #

    %

    #

    &

    ! #

    #

    &

    #

    '

    '

    '

    C{vn'CCDs^DC{CCCn)(&{CpvnCnL~znLn C{vn

  • tvxry{nyC wpztxxrnL{pru~ pzF~z~zC.C{vN t~n}Cy
  • mopN/ FF^58?1TC~znLprsCnxry^x{xN{v{{tvpr&LCxzt{vnyC{CnZ~J{Cx$prnF{tvprnPprn- -CtxztvC)Cxry{nLp*{tx~-u{}x~yprn- -CtxztvC~`~^ uX}rXzu^}LC{NpTxzy{n*{{pr.N~zntvv~xrprxztvCZxzynLq{pz^sut}n$xzyn~zC{p-n-}}n
  • xzy{n&tv{vnLnLFxrCp! ~NtvNx~)C*sutvnLwICpxzy{n&{pzNCpnpL{}npr~xrC}tv{nLNpz }}n~DC~r~t~xktqxry{n~znLvn-xztvC
  • sutv~ztv{vn FxrNtv~znZxrtNt~&v^w vnLsNnLPLCLnL}x&xzyxtxt~x}{{~wtxzyIxzy{nC~xrprNxrtN~{pr^sut}n0tvI&y{tvCyInsCn{NNn

    mvCy0nLxzn/ M&n-|}{prn~r~tvNvv^wP~PC{{t{prtvsFtvvnLNn~$xrxzy{nL{pzprnLFx{pztvLtvAV' ?.-S.nL|}{pznZ~z~ztvC0.nLpzCpr~~xCtv~z.nxrtvCtv7~tvtvpJw*DN~$xzy{nN}un~L*y{nxzy{n$}xry{Cp~T}n-nPL-}-CL-N~

  • '

    !

    '

    "

    !

    #

    #

    '

    C{vn}@% {NNn({Np3

  • FHGIKJf j '7j, I*y{nCC% vC{CCnw*C~'~.nLt.Lvv}nZ~tvCnVxzo-CtvnCDs^{prCCp~'nZp~u{nLprC~T~zttvprtxztvnL~.wtxzyCDs^{txt~~zC & nxzANpztvnNxrn0CV~z{{.Cpzxr~N^CnZ~-xry{prnC~"}utvNC{t{ *y{noCC% vC{CCn0}tYnLp~prCCDs^{{Np)n-|{C{vn'xry{n&CC% yN~)0{CxztvCoP~z{{prC}xrtv{nItx {FnZ~{x yDsNn{{tvxtvtv{{npLvN~z~zn~L{nqxzxzy{ntvp}t.npzn-nZ~-Zxzyn*NDs^*vC{CCnJCxry{n$CC% vC{CCnyDsNn}t.npznFx'C~npzs^npzNnpxrtnZ~$~y{y{n{Cn{Cw$N~}n~r-prtvnZ uV'PN}t^/ 1Nwy{N~znLprsCn~xzy^xxzy{n*-N{tv^xztvN{pruLn~r~ xry{nNDs^0{NNntv~{x'{vvV~xrprNxL unnun-xztvC}v' -pr-tpzNnCTxry{nqCC%5t~*xrnL~{prn xry^xuFxzn'-}}n~

    }{Cx&-Npzpr{}xtxr~tFxrnLprP~xrxznICvnCxz{}nZ~tvprnnyDsutvC{p7u{tLCv0uFxzn-}}n{prCNprC~prnCn{nLp^xrnuI-N{tvnpr~LY{}x)xry{nLVD~&nwprtxxrnLoFVyYNp-Npzpr{}xrn}{prtv{{n-xw$Cpr xrprC~ztv~r~ztN"*y{npznLCprn*xzy{n@% ~nZ~'uFxzn)L}}nsCnLprtnLpxzy^xP.nLpzCpr~$qu{qnp*-N~t~xzn-y{nZ}~.n-NpznnL|unZ-}xrtv{qxzy{n)Lu{n'~tvxzy{n)pznsFtvN~*~nZxztvN&N0NDs^}{xry{nL{pzprnLFxP~znxrtvC

    Cqxzyn@% t~k~xzprxr{prn'xz y{tvNy{vtNyFxxzyn{^sCn{C~znZxr~Jxzy{nCC% {NNnuNxrn -}}n sCnpzt^xrtN-N~z~$vNNutv{{Tmon.nLCtvwtxzy&){prtvn-. . >2H >2M ?-V -h>> !B.B`6

    tvN{pzn'JCDs^~xrxznnLFx*Cxry{nnF{tvs^vnLFx$CC% -}}n~y{^wtv{ y^w2t{Cpr^xztvNt~~rLxxrnLprnu-CtxztvC'tFxrFFxrnL}}n~ -CtvnZuu{N v)Nu{.)5uN

    *y{nuFxzn-}}nsNnLprtnLpyC~xz7prnLpznZ^xznxzy{ntv}NpzxztvCxzyxw*C~N-nqpznZC}tvv7DsDCtvvC{vn tvxzynCDs^~zCprLnq*ytv~pznL}t~r-^sNnLprYtv}Cpr^xrtvC -N{vtv^xrn~xry{nuFxzn-}}n*sCnptnLp^C CCn~txT}t--{xxz~.nLttv-vnCp-N-t~znC~zy{tvCwy^xuNxrn)-}}nsCnpzt^xrtNt~-Fx^xg'PC}t/ Z>5FZC?1wnpzn7xry{n0p~xxr{prC.N~zn

    xzy{n~zn&CPxu{tv{pr{vn~xz}n~r-prtvnxry{nFFxrnLu{n&sNnLprtL^xrtvCo{pz}Ln~r~-uypr{vn~)CpznNpzn{prnLt~nqxzy7x{prCJ{NNnq{n~r-prt{xztvCo*xzynsCnpztnp/ NL?1$CnN~tvnpxzq{}npr~xrC&CprnN~N&CN}xxry0u{^ ~*prn-npzn-ntv{vnLnLFx^xztvNFxrxrC'PN}t ~Pttxrt.{{{vtLxztvCo/ Z>51-C~t}npznZ)~CF{}xJprnLpznZ~nNx^xrtsNn~zn-xr~JuFxznLu{n~8t~xrpz-xztvC~PC{xC^sNnLp ==FCIN{}prn~r~nZ0xry{n{pzN{vnL~{pzN}xztv{nZ~-Twy{tyVwtvvknn-|}{tv{nZItv un-xztvC5uuv*y{nLtvpP{prC.N~rw*C~Cvv^wnZ7n-|uxzn}n7u7~nsCnprC}xzy{Npr~L;pzn{X %0txry{n{/ >

  • NCC.nLp^xztvN

    'xznLprxztvsCn {pzFCy{nZ~$xzNpzCvtv~znPxry{nuFxzn'-}}n)sNnLpztLxztvC&{pz}Ln~r~yDsCn .nLn{prC.N~znY36C}.nLpr/ ^21AYC t$/ ?5=1Ctvxz pz^sNnxu.n~N{}n~r~7xzynX@%tA n)xry{nqLCprpznZxr{n~r~CJxzynquFxznLu{n'sNnLprtnLp$Cp &pznvxztvsCnv~Cv~{~nLxuxzyn$CC%Zn-|{-v}tv{*q{xztAxzy{prnN}tv{{NCpzCCn7-NvnZxztvN$LvN~z~vFC}tv{Vn-xr *y{ntvxzuCt~7{^x;A^wCv}~t~L.wytvyon~xrC{vt~y{nZ~LC~xzptvFxr~x Cv{prCCp NtvNx~-V}Cvsut&xry{nNnL{nprxznZ-C~xrprCtFx~xzy{nn~xrC{vtv~zy{nZ~xzy{n }nZ~tvprn{prC.nLpzxztvnZ~C5uN~tv{tv^xrntLCnLFx~ tvVxry{nCC%-}}nCTtvCpzn}I*y{t~ wN{pzn^sCnkxry{n{nLnZ'Cpvu}}Tmy{tvvnsNnLprtFtv{Pxzy{nuFxzn-}}n{xry{n~{pzN}xztv{n$^xkC{}prn~r~kNuZxry{n*sCnpztnpq~x{^wxNntFxrC-CNxxzyx$v}LC. D'nLtxzynLp$yDsCnxu.nVwy{nLxzy{nLCvFNpztvNt^xznZ~YprC =NNpTxzyxJ}}D.nprn-npnLLnwynL'xzy{n*LCNCprtvCtv^xrn~.prC NC*y{t~

  • CDs^%0n-xry{}Y.4>B. [B- >> >MB.d8b Md.B5b>>.>mK

    C{tvvnCC%5Lu{nh>.4>B.Z

    [H4>M? -?>5? [M ?6M2 h>>> .d86 2>.[ g2 [ 2>>.> g2 >

    k|{-n}xztvNyC}vnLp q2>.[ g2 [ >>-

    *y{n!>q} 2>. [M ?6M2 h>>>>.d86 >

    Nn-xr{pr7~xrxznnLFx*xxzy{n n&Txzy{n nLxzy{}>. [H 2>>.>

    TtN{prn}(' CDs^&n-xry{}oCVxzy{nnZF{tvsDCvnLFx CC% Lu{n~y^wty^w~z{{prC{xztv{n~prnP~znxr~C-n-}}n~zCLnCpn-|{-n}xztvN~-N{tvvnu&u0N v'C0u{.5} F

    ~xrpz-xztvCCvv^wtv{xzynPC~xnL|}n-{xznfg2)tv~xzprxrtN*y{n@% y{^w$nLsNnLp&~z{{.Cpzxr~prn-xr{pz~C'xrtv{vn~{pzN}xztv{nZ~wtxry)~tv{Nvn`>tv~xzpr-xztvCDxry{t~N-tvvtxt~YNpzCvtv~znF&{prnL{7C%txy{nLO/2=21N-npz{nZ.C}xxry{nuFxznILu{n0sCnLprtLxztvC -N{vn-|u

    txCpzn{H/ F!1'~zy{^wP~xry^xnL|u}tv{ C{xI~{pzN}xztv{nZ~t-prnC~zn~Lu{nI~tvn0F .C}x)=}=N>5Cpxry{nIwyCvnCv 5u*y{t~P~z{CNn~xr~$xry^xxry{n).nL{nL{xr~yDsut'.CvuCpz{y{t&~z{{prC{xztv{n~qD{CxLC.nL~r^xrnNpxzy{n7tvLpznZC~zn-CnL|}txCCtvFCCZDw$Nv^w }tYnLprnLFx{pzFCyqxzq-N

    ^xxzy{n-CnL|}tx tvxry{npzu~uqpzNF~tv{ )nLwxun~}~xznL Cp*uNxrn -}}n~LJ*y{nL&~y{^w"xzyx*xzy{n -N{vn-|}tx'Cxzy{n {pruTxu.n)~N{}n~r~*tv~*~ztvC{tFxzvqpznZ}-nZ/ 2M2>.M2't~pznZNtprn xzn-|}txJN{txzNpTxTxry{nnL'Cxry{nn-xry{}tusNu^xrtNPtx

  • xzyxxry{n&Nxz*-C~r~ *xry{n&N & n-x.nLtv{Nnprxzn {Nt~xzy{n&~zCnN~xzynC{nC}xtv{nVuIxry{nCnpznZ~Nv}xztvC{pruLn~r~-XPt~tv}Cpr}}t~r-~r~ztNCxry{ntvNxrnLpC-xztvC'-C~r~vNC{nLp~kxu.n~r^nLx'w*C~Jxzy{n.nLCtv{t NpzC{{}}nLpr{tv{{tv{'JCDs^q}ut-C~r~$FC}npr~L}{M ~k~zwnpxrxzy{n*{{w*C~ & CpyCnCxry{n-C~r~

    vNC{tPnyC{t~`CYN uNN~T{n~r-prt.n'u(

  • -C~r~kvNN}tv{)vtv{utCpznxzu)xrtvCyFxzv-C{vnYNxzvv^wCpxry{n7xzypznnI-NN{nLFxr~qxrnIsCnLprtnn-Yn-xztvsCn / N?1*y{nLtvp{pzNF~zC
  • $

    '

    1

    ' $

    $

    $ $ $

    #

    '

    C{vn{Cq{tv{nCDs^q7@% vC{CCnZ~

    D

  • xry{t~CC%,~z{~zn-xp9'~znZ-t^xztvNqCxzy{nCDs^)~z{~zn-x$t~CtvsCnYxzyu~t~r~tv{xry{nCNpxr{{txxz7{pr^sCn'xzy{n-N{t^xztvN~zynLn~*LCprpznZxLNPN~zn7/5>5!1CtvsNn~^xr{prC{~nFxzt~CY~z{~zn-xk
  • ~x^xrtvv}~nZ~yDsNn&.nLn2C{C}xznZ xrCp~.nLtLCv}n-sutv~znVNpNDs^}VFx^xztCv}~ztv~C C~r~zuLt^xznZoC}xrtt~r^xztvC~ prnn-|}nZxrnoxzInLCprpznZxtA nCxry{nLprn~{F~nZxz0{prn~znLprsCn'xzynnt&C${prCNprC~-JsNnLVxzy{N{Cyoxry{t~t~ tvNpxFx C~znZx)P~znL{pztxC0-N{vn-xzn~z{prsCnLIxzy{t~0}Ntvt~nCNxry{n ~r-C.nqxzy{t~7CnpL ^w*nLsNnLpw$n & ~x}pDwN{p^xxrnLFxztvNxzxw$xu.n~'CvF~t~xry^x'~xz}V~zCnNDsD7~znZ-tN~.n-xr~Ln~rLCnCvF~t~Np'N & n-xCprtvnLFxznZVC{CCCnZ~ Cv}~ztv~prnLxznVxr'xrtxry{pznZC}tv{'{xry{nLppznZNnLFxv}~t~*-N-npz~pzprD.C7y{n}~LmyvnLqNtvp /!81*pznZ~nNxVLCq{tv{no.CtvFxznp

    qnZ~z.nPC}~zt~vNCprtxry{`CpNDs^{pzNCp~Lc"~ztv{ {^xVA^wX{pzFCyxry{nL-N~xrpzx'NprC{ywytvyypC-xznpzt~zn~...>)Cxzy{n tv~npxI{nLwM>..> xzy^xV~z{Y-C~r~nZ~MS>....&*yn{nw -C~r~ .C~'{V~nZ-{prtx}tvCN{nFYnLprtv{xry{n ~znLp*{v

  • xznLFxztvCxry{nsNnLprtntv{vnLnNx^xrtNPCt~;/
  • prnn-|}nL}xznZoxN~x CLnxzyu~ Ntsutv{pzt~znqxz-N~znLprsDxztvsCn{pzD|}tv^xrtvC~$xr&xry{nprn.nLyDsutvCpC$vuC~Lq*yn~}~xzn t~-CpzNtv~zn.n-xw$nLnwyxt~Cytns^{vnwtxry}xrCxznqxrny{tvF{nZ~Cwy^x*{pzNCpnpr~prnC{vnPxr{pr^sFt}nC*yn~z}~xrnLt~)xry{nLprn-Npzn&Cprn.^wnpxry xun7y{nNnLpk{}xvn~r~).^wnp{$xry{pzNCptv{&wtxry{vsCnpzt^xztvNunLxz~ry}PnLxrnLp'C%vnp;/ N?1*CtvsNn NnprxztvCC

    C^|}tvCxzt~znLCFxztL~YCP~~nLxC{NDs^)xry{ntv.nLpz^xrtsNn-CprnP'nLxzy{}v~r*y{nL'xzynL{pr^sCn$xzyn~N{u{n~r~$xzy{n)|utvN^xzt~znLCNxrtL~Jwtxry&prn~znZx$xzqxzyn C.nLpz^xrtN~nFxztL~L*y{ntvp^|}tvCxzt~znLCFxztL~LCxzyu~n~znVxzIN~)7N~t~Cp)xzy{nsNnLprtLxztvCCCDs^{prCCp~L$xzyxunZ~'C~znLFxrtv~)prn&C~n'.n}ntv@kJ~zxzyxnyC{tLC$y{nZutVCxry{n~N{}n~r~{pzuCw$C{nnZC~ztv{vntv{xz{prnknpzt^xrtN8tv~ {Cx prn~xzprtxrn3xz NDsD {prCCp~L%0uCprn/Z{1JyC~{tx{nw sNnLp~tvC0C~CT~~nLx