Java IoT Authors: Yeshim Deniz, Zakia Bouachraoui, Dana Gardner, Liz McMillan, Pat Romanski

Related Topics: Java IoT

Java IoT: Article

Java Card 2.2 Specifications Overview

Java Card 2.2 Specifications Overview

Ever since the Java Card 1.0 was introduced in 1996 it has been gradually maturing, and recently celebrated its fifth anniversary. American Express, Visa, and now the Department of Defense have all deployed solutions that utilize the Java Card specifications.

This rather large movement proves that Java Card technology is a great system for data security and data mobility. At last count, American Express claimed over 4 million deployed cards and Visa estimated over 7 million at the end of last year.

Since September 11, 2001, there has been a lot of interest regarding Java-based smart cards combined with biometrics (verifying the identity of a person through some physical characteristic). This has driven the Java Card specifications to the forefront, and more and more engineers (and managers) are scrambling to implement them.

Currently, Java Card implementers use Java Card 2.1.x. Soon you'll be seeing Java Card 2.2 deployed into the marketplace. Those who have started to use the Java Card 2.1.x API are realizing that it's quite a hassle to do some basic things. For example, you can't utilize strings or other common primitive types found in Java because the Java Card processor has extremely limited resources. Most cards offer a little less than 32K of memory for applets. (Note: Don't confuse applets with J2SE applets. Applets refer to applications that reside on the Java Card.) Another deterrent is that you have to deal with bytes! When was the last time you had to think in bytes and byte arrays?

Java vs Java Card
The Java Card contains a virtual machine that's tailored for it, the Java Card VM. Because of the limitations, the JCVM has some unsupported features such as:

  • Dynamic class loading
  • Garbage collection
  • Threads
  • Cloning
  • Default visibility override
  • Package visible interface can't be extended to public visibility
  • Int, double, float, and long are not supported
  • Static instantiated classes aren't allowed
The JCVM differs from standard JVMs in several ways:
  • There's only one system class, the javacard.framework.JCSystem.
  • Persistence and transience behavior are different from Java.
  • Only single-dimensional arrays are allowed.
  • Security management policy is implied in the JCVM and not an explicit class.
  • The JCVM is a 16-bit system.
With that said, there are some useful supported features such as:
  • Packages
  • Virtual methods
  • Interfaces, abstract classes, and exception handling
  • Polymorphism
  • The root class is of class Object
Other limitations that should be mentioned include:
  • A maximum of 256 instance fields per class
  • Array size is limited to 32K
  • Memory space is limited to 32K per package
To communicate with a card, use a Card Acceptance Device (CAD). This is usually a card reader but can also refer to an ATM or point-of-sale terminal. Your communication isn't really to the card itself - it's actually to the CAD, which then sends commands to your applet.

To make engineering more complex, the structure of the applet code appears a bit backward: you use a large switch case block to process the commands you want. However, Java Card 2.2 makes all this a bit easier.

Java Card Remote Method Invocation
One thing that will make engineering easier is the use of Remote Method Invocation. An engineer will no longer have to spend a lot of time learning various APDU commands.

Currently, you have to issue commands in the following format:

CLA   INS   P1   P2   LC   CData

  • CLA: A class byte that can be an ISO 7816-4 such as 80, 84, or user-defined
  • INS: An instruction byte that states which instruction to perform
  • P1/P2: Parameter 1/2 that subdivides a command
  • LC: Length of data to be transmitted
  • CDATA: The data to be transmitted
  • LE: Length of data to be returned from the applet

    Depending on the applet, it would have to switch case on each individual CLA, INS, and P1/P2 to process the necessary command. This method of transmitting data can be a tedious job and a maintenance nightmare. The Java Card RMI makes it easier to perform a command.

    More Algorithms
    For the implementation of security algorithms we must rely on the individual vendors. Some vendors implement cards that contain just DES and Triple DES, while others implement DES, Triple DES, and RSA. For the implementation of RSA it's common to also include a crypto-coprocessor in the smart card chip to help speed up the calculations.

    In Java Card 2.2, AES and elliptic curves are added. New key lengths are also available with these new algorithms. Of course, this can be a headache involving export restrictions, so check with your vendor to see what's actually implemented and what key lengths they support.

    You can still perform digital signature and random number generation on the card as you did with Java Card 2.1.x.

    Applet/Package Deletion
    Applet/package deletion has been a hot topic since the first release of the Java Card. This feature of 2.2 will be up to individual vendors to support, utilizing their own implementation. But nonetheless, it's sure to be available since engineers and others will be requesting the functionality. Applets created using the Applet.register() methods exist until deleted by the applet deletion manager. This manager can be an applet provided by the vendor and is selectable by providing an application identifier, AID. Sun wanted to leave the implementation of the applet deletion manager up to the vendors and, because of that, the AID won't be standardized but it must be SELECTable. As long as the vendors provide a SELECTable behavior to the outside world, they can implement the applet deletion manager any way they see fit for their Java Cards.

    Memory Resource Management
    The JCSystem class offers two new methods: isGarbageCollectionSupported and requestGarbageCollection. These offer limited garbage collection support to query if a vendor has implemented garbage collection functionality and to request that the action be carried out. Garbage collection isn't a requirement, and once again it's up to the implementers. However, you can now query the amount of memory available to the applet, which wasn't available in 2.1.x.

    JCSystem.getAvailableMemory is a nicer way to query if memory is available before you allocate it. In 2.1.x, you cross your fingers and hope that the memory is available when you allocate it, otherwise you'll receive an exception.

    Logical Channels
    In Java Card 2.1.x your commands are processed by the currently selected applet. Java Card 2.2 allows up to four sessions to be open, one session per logical channel. Now applet instances can be selected on different logical channels. The applet can take advantage of multisession functionality and can be concurrently selected with another applet on a different logical channel. The applet can even be selected multiple times. There is a basic logical channel, logical channel 0, that is activated upon a card reset. A card reset can occur when the card has been powered down via card removal or electrical failure.

    Applets that are capable of being selected on multiple logical channels at the same time are called multiselectable applets. These will have the same security constraints as in Java Card 2.1.x with regard to active contexts. To forward APDU commands to a logical channel, the command will contain encoding in the header CLA byte to denote which channel. For example, CLA byte 0x02 could denote logical channel 2, and 0x00 could denote logical channel 0. The logical channel is of key importance for wireless support involving 3GPP, WAP, and ETSI.

    Java Card 2.2 includes support for contactless smart cards. These cards don't have the visible chip on them, but can be read if the card is simply waved within a certain proximity of a contactless CAD. There has been movement to include some form of biometry in the Java Card API, and this technology will no doubt be appearing on the market soon.

    With the new Java Card specification, existing features, such as transaction processing (much like commit/rollback in a database), become more powerful.

    Personally, I'm excited about the RMI specification and memory management features that will make complex Java Card engineering a lot friendlier.

  • More Stories By Joseph Smith

    Joseph Smith, a senior software
    engineer with over 13 years of
    experience,has been designing and
    developing Web-based soulutions for
    the last five years.

    Comments (2)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

    IoT & Smart Cities Stories
    When Enterprises started adopting Hadoop-based Big Data environments over the last ten years, they were mainly on-premise deployments. Organizations would spin up and manage large Hadoop clusters, where they would funnel exabytes or petabytes of unstructured data.However, over the last few years the economics of maintaining this enormous infrastructure compared with the elastic scalability of viable cloud options has changed this equation. The growth of cloud storage, cloud-managed big data e...
    Your applications have evolved, your computing needs are changing, and your servers have become more and more dense. But your data center hasn't changed so you can't get the benefits of cheaper, better, smaller, faster... until now. Colovore is Silicon Valley's premier provider of high-density colocation solutions that are a perfect fit for companies operating modern, high-performance hardware. No other Bay Area colo provider can match our density, operating efficiency, and ease of scalability.
    ScaleMP is the leader in virtualization for in-memory high-end computing, providing higher performance and lower total cost of ownership as compared with traditional shared-memory systems. The company's innovative Versatile SMP (vSMP) architecture aggregates multiple x86 systems into a single virtual x86 system, delivering an industry-standard, high-end shared-memory computer. Using software to replace custom hardware and components, ScaleMP offers a new, revolutionary computing paradigm. vSMP F...
    At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
    As you know, enterprise IT conversation over the past year have often centered upon the open-source Kubernetes container orchestration system. In fact, Kubernetes has emerged as the key technology -- and even primary platform -- of cloud migrations for a wide variety of organizations. Kubernetes is critical to forward-looking enterprises that continue to push their IT infrastructures toward maximum functionality, scalability, and flexibility. As they do so, IT professionals are also embr...
    Atmosera delivers modern cloud services that maximize the advantages of cloud-based infrastructures. Offering private, hybrid, and public cloud solutions, Atmosera works closely with customers to engineer, deploy, and operate cloud architectures with advanced services that deliver strategic business outcomes. Atmosera's expertise simplifies the process of cloud transformation and our 20+ years of experience managing complex IT environments provides our customers with the confidence and trust tha...
    As you know, enterprise IT conversation over the past year have often centered upon the open-source Kubernetes container orchestration system. In fact, Kubernetes has emerged as the key technology -- and even primary platform -- of cloud migrations for a wide variety of organizations. Kubernetes is critical to forward-looking enterprises that continue to push their IT infrastructures toward maximum functionality, scalability, and flexibility. As they do so, IT professionals are also embr...
    CloudEXPO has been the M&A capital for Cloud companies for more than a decade with memorable acquisition news stories which came out of CloudEXPO expo floor. DevOpsSUMMIT New York faculty member Greg Bledsoe shared his views on IBM's Red Hat acquisition live from NASDAQ floor. Acquisition news was announced during CloudEXPO New York which took place November 12-13, 2019 in New York City.
    The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
    The graph represents a network of 1,329 Twitter users whose recent tweets contained "#DevOps", or who were replied to or mentioned in those tweets, taken from a data set limited to a maximum of 18,000 tweets. The network was obtained from Twitter on Thursday, 10 January 2019 at 23:50 UTC. The tweets in the network were tweeted over the 7-hour, 6-minute period from Thursday, 10 January 2019 at 16:29 UTC to Thursday, 10 January 2019 at 23:36 UTC. Additional tweets that were mentioned in this...