JSM: A small Java Processor Core for Smart Cards and Embedded Systems

Size: px

Start display at page:

Download "JSM: A small Java Processor Core for Smart Cards and Embedded Systems"

Baldric Higgins
5 years ago
Views:

1 JSM: A small Java Processor Core for Smart Cards and Embedded Systems, Hagen Ploog, Nico Bannow,Dirk Timmermann

2 Outline Goals Smart cards Java on smart cards Design and Functionality of Java processor Rapid-Prototyping-System Outview

3 Goals Development of a Java processor for small embedded systems, especially smart cards Increase of development time for smart card applications Speed up execution time of Javacard applications (Javacard applets) Usage in domains with security concerns Access to external devices Reducing chip s die size and power consumption retaining high performance

4 Smart card Plastic SmartCard- Chip

5 Java Card Smart cards based on Java Card technology

6 Java2 platform Specialized API Specialized JVM

7 Application domains Financial services Health care Telecommunication Public entities Network security Retail Industry Authority and coupons Stored values Personal information Security Payment Access / Identification

8 Smart card microcomputer architecture Basic functions ID-Data ROM RAM Memory CPU (f.e. 8051) contacts EEPROM cryptocontroller Application data Coprocessor for encryption algorithms

9 Advantages Security Easy to use Disadvantages Application development is time consuming and often hard Applications for SC mostly written in Assembler and C Applications masked in ROM - Changing of applications not possible Applications not portable

10 One Solution Java on Smartcards Javacard...but with long run times Our Solution: Java in Hardware

11 Advantages (Java Card) Secure value-added services in ubiquitous world Support additional services and applications after the card has been issued Rapid development of smart card applications

12 Why Java Write Once, Run Anywhere - Portability Security of Applications Usage of standard tools Multi application cards

13 Problems Limited resources Solution Limited instruction set Split virtual machine

14 Java for smart cards: : Limitations Adaptation of API and instruction set to the limited resources of smartcards Limit the size of classes, objects and stackframes Reload of Classes not possible Applets and Objects can not be deleted but deviate from the minimum requirements smart cards can be extended at will

15 Split virtual machine Java virtual machine Card terminal Class files Post processor Applet Image Interpreter PC Smart card

16 JavaCard Installer Applet Applet User Memory Applications and Data JCRE JavaCard API Java Interpreter Smartcard OS Java Virtual Machine Operating System

17 Split virtual machine One part of the Java virtual machine executes off-card, Preparing the executable code that is executed in the other part of the VM, on the card Reasons: - size of applet image downloaded to the card - run-time memory requirement

18 Split virtual machine Off-card: - Linking classes and resolving references - Converter Produces applet image (*.cap Files) - Verifier Verify CAP-Files - Reading in all of the Java executable codes to produce applet image (Java Card loading format, CAP-File) - CAP-File may be downloaded to a Java Card - The code will then be executed by the on-card part of the JCVM On-card: - JCVM, JCRE, JC-API s Converter Verifier

19 Off-card: Split virtual machine Converter Verifier - Reading in all of the Java executable codes to produce applet image (Java Card loading format, CAP-File) - CAP-File may be downloaded to a Java Card - The code will then be executed by the on-card part of the JCVM On-card: - JCVM, JCRE, JC-API s

20 Java Card-Security Derived from the Java Programming Language Object-oriented programming language Name space mgmt. for type and procedure name Reuse if code that has already tested Strongly typed language Java byte code strictly related to specification No pointers as in C and C++ Access to memory beyond allocated array boundaries not possible with array indices Java provides transparent storage allocation

21 Java Card-Security hrough Java Card platform security enhancements Transaction atomicity Applet firewall Security and cryptographic classes

22 Features of JSM 32bit Synthesizeable Code Microcode control Stack machine Security tests in parallel to program execution Additional bytecodes Embedded Triple DES Crypto Coprocessor

23 Design of JSM external device external device external device IO Unit 32 0/A 1/B ALU Stack MMU Microcode Decoder Control Unit LSU (Stack) LSU (MMU) RAM ROM RAM FLASH MUX 32

24 Microcode controlled processor Memory Bytecode Descriptor Table pointer to start of microcode sequence Microcode Table Microcode Microcode ALU, MMU, Stack, IO-Unit, Control-Unit Realization of byte code through RISC alike Microcode instructions Internally translation from bytecode to microcode Jumps, conditional jumps and execution of subroutines possible Very efficient regarding realization,execution speed, modifications Clearly arranged

25 Software objects - states are defined by variables - modifications through operands and bytecodes - operands transmits data Software encapsulation vs Hardware encapsulation Operands Software Object (BLACKBOX) Operands Hardware modules - states are defined by registers and memory - modifications through input signals and internal logic - output signals transmit data Input Signals Hardware Modul (BLACKBOX) Output Signals

26 General structure JSM s modules FUNCTION DATA IN Java Processor Modul DATA OUT STATE ERROR

27 '1' extend MMU (data_out) 8 ALU state MMU state ctrl_unit_ main ctrl_unit_ test STACK state IO UNIT state FSM CONTROL UNIT ctrl_unit_ test_module ctrl_unit_ jump_offset test eq test gt test eq test gt current_micro_ code_subroutine test eq test gt test rom access CU mux ROM table 1 (contains start of micro code entries for each byte code and additional micro code sequences)... current_micro_ code_return_ptr-1 current_micro_ code_return_ptr first in -> last out "1" ALU function MMU function STACK function IO UNIT function ALU data out MMU data out STACK data out SELECT DATA BUS IO UNIT data out last_micro _code_ptr MUX MUX ADD MUX ROM table 2 (contains all micro code sequences) Control Unit ALU data in MMU data in STACK data in IO UNIT data in REGISTER, CONSTANT :

28 modules_state modules_error modules_data_out alu_test_eq alu_test_gt mmu_test_eq mmu_test_gt stack_test_eq stack_test_gt mmu_test_rom_access clk reset 1 2 ADD addition CONTROL UNIT state machine current state last_micro _code_ptr last_micro _code_ptr current_micro_ code_return_ptr micro_code _decoder "1" constant "1" sel_modules_function modules_data_in error IO & Components CU register REGISTER, CONSTANT :

29 DATA IN A 32 DATA IN B 32 ALU select function clk reset REGISTER A FSM logic (+,-,*,/,...) REGISTER B REGISTER state error DATA OUT 32 zero 1 1 lt /gt

30 ta_in l_function set register A, B, buffer REG A REG B BUFFER current alu function A+B A-B ADD/SUB addition subtraction constants 0, 1, 2 "0","1","2" "0" SHL (U)SHR shift operation ALU state machine counter register COUNTER AND, OR, XOR adapt_data _to_type logical operation decrement demux DEC DEMUX log2(n) -> N current phase TEST_0 GT compare operation data_out test_eq test_gt state error REGISTER, CONSTANT : IO & ComponentsALU

31 DATA IN DATA OUT MMU FSM test_eq test_gt state error byte_code_rom_access select function reset clk REGISTER, POINTER BUFFER DATA IN function address state error DATA OUT MMU LSU REGISTER:

32 data_in sel_function clk reset MMU system register register Applet register Type register ConstPool register Method register PC current MMU function ADD offset adder MMU universal register register A register B register REFERENCE register INTEGER address decoder address decoder MMU state machine data buffer data_in_ buffer data_out_ buffer TEST_0 TEST_GT TEST_NULL compare operation constants CONSTANTS current phase merge vectors reduce vector adapt_data _to_type modify vectors REGISTER, CONSTANT : data_out test_eq test_gt state error byte_code_rom_access MMU LSU IO & Components MMU

33 DATA IN DATA OUT STACK 32 2 * 32 FSM state test_eq test_gt error select function reset clk REGISTER, POINTER BUFFER function address DATA IN state error DATA OUT STACK LSU REGISTER:

34 data_in sel_function clk reset stack pointer max_tos pointer TOS pointer frame_data pointer local_variable pointer current stack function A+B A-B ADD/SUB offset adder data buffer data_in buffer buffer 0 buffer 1 A+B A-B SUB test adder Stack state machine constants CONSTANTS TEST_0 GT compare increment compare operation counter register counter_m counter_n current phase reduce vector merge vector vector modify module REGISTER, CONSTANT : data_out state test_eq test_gt error STACK LSU IO & Components Stack

35 Input / Output and Components of IO-Unit data_buffer constant "0" data_in sel_function clk reset current io_unit function IO-Unit state machine current_device_ selector current_priority_ selector data_out state error TEST_0 DEMUX log2(n) -> N select device (multiplexer) rotate vector ADD external devices REGISTER, CONSTANT :

36 DATA IN 32 DATA OUT 32 I/O-Unit FSM (device 0) state interrupt error select function reset BUFFER clk function data_in data_out state error device 1 device 2... REGISTER:

37 iadd : mikrocode sequence Example 1. POP TOS & TOS-1 TO OUTPUT Stack 4. ALU 2. Stack PUSH VALUE FROM ALU TO TOS Stack LOAD REGISTER A & B WITH DATA FROM STACK ALU CONSTANT 1 3. CALCULATE REGISTER A + B ALU SET PC RELATIVE & LOAD BYTECODE MMU

38 Access to external devices IO - UNIT DEVICE PORT 2 DEVICE PORT 1 sel_function data_in data_out state error sel_function data_in data_out state error... IO - DEVICE 2 IO - DEVICE 1 specific external device communication Access to external devices over IO-Unit Every Device (IO-Device) has 1 I/O-Bus Buffering of data must be done in devices (ISR is used)

39 New bytecodes New bytecodes start_applet read_applet write_applet select_io_device read_io_device write_io_device Operation Preparation of an applet. Reading a word from memory and save it on stack. Writes a word to memory. Value and reference are on stack. Selects a device from I/O modules. Reads value(s) from I/O device and pushes it on top of stack. Outputs a value to I/O device. Value is on stack.

40 Error recognization and handling Java has many opportunities to check an applet for run time errors Strength type verification Unauthorized bytecode instructions Range overflow Internal errors Runtime errors Now every error results in a stop of the processor

41 Results Area: ~ 2400 slices without optimization Utilization of Area within Virtex: ~ 20% Speed: ~ 7.5 MHz without optimization Size of microcode: 52 kbit Estimated die size: ~ 0.2 mm 0,18µ

42 Development environment APTIX MP3C BOARD VIRTEX 1000 FPGA Synopsys DesignAnalyzer Synthesis HP Logic Analyzer Xilinx M3 Place&Route JSM core Aptix MP3 Explorer FPGA Download I²C interface addr data control IO Memory Extension Board ROM RAM FLASH I²C Parallel Converter parallel PC I²C IO

43 Outview JSM in smart devices JavaCard API in wireless Systems

44 JSM in smart devices Integration of Java Silicon Machine into Smartdevices Mobile Communication Unit for Distributing Intelligence GSM GPS Java Core FingerPrint SmartCard

45 Future architectures GSM, 3G, Javacard VM Applets Wireless network WAP Gateway Internet J2EE HTML / WML Applet Server Servlets J2ME, CLDC GSM, WAP, 3G KVM Java applications Network 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

46 Future architectures J2ME, CLDC GSM, WAP, 3G KVM Java applications 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

47 Future architectures GSM, 3G, Javacard VM Applets APDU 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

48 Future architectures Wireless Network WAP Gateway Internet Network 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

49 Future architectures J2EE HTML / WML Applet Server Servlets Network 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

50 Future architectures Network 3GPP 3rd Generation Portable Phones USIM Universal Subscriber Identity Module CLDC Connected, Limited Device Configurat CDC Connected Device Configuration

51 Future architectures RMI RMI Applications are independent from protocols RMI

52 ...thank you

Smart Card Operating Systems Overview and Trends

Smart Card Operating Systems Overview and Trends Pierre.Paradinas@gemplus.com Gemplus Labs Smart card A piece of plastic with a chip that contains: CPU, memories and programs SC is your personal information