A java card security framework: requirement analysis and enforcing techniques

摘要

In this paper, we present a novel security framework for enhancing the password management and user authentication of a Java card systematically. It consists of two parts, security requirement analysis and enforcing techniques. For the security requirement analysis, we adopt the OWASP guideline and suggest 16 items that are needed to be addressed methodically at the various stages of software development lifecycle. As the security enforcing techniques, we propose two advanced schemes, multimodal password management and secure channel. Real implementation based experiments have shown that the two schemes indeed improve the confidentiality and manageability with lightweight space and time overheads. In addition, we have observed that the 16 items can be utilized effectively to verify the security level of the schemes.