On the security of Java Card platforms against hardware attacks. (De la sécurité des plateformes Java Card face aux attaques matérielles)

Smart cards play a key role in various applications we use on a daily basis: payment, mobile communication, public transports, etc. In this context, the Java Card technology has evolved since its introduction in the mid-nineties to become nowadays the world leading smart card platform. In the context of Java Card, researches on security have revealed that the possibility of loading malicious applications represents a real threat. In the meantime, the scientific community has also paid interest to the security of embedded cryptography, revealing that theoretically strong cryptosystems can be easily broken if their implementation does not take into account certain physical properties of the underlying hardware device. In particular, a part of the published attacks relies on the attacker's capacity to physically perturb the component during a cryptographic operation. These latter fault attacks have been rarely considered in the literature in the Java Card context. In this thesis, we study and evaluate the security of Java Cards against the combination of fault and software attacks in order to enhance it. First, we present various attack paths involving both hardware and software attacks and expose how these attacks allow to break various security mechanisms of Java Cards. In particular, our security analysis proves that the type-safety property, the control-flow integrity and the application isolation can be tampered with by the combination of adequate fault injections and malicious applications. Then, with regards to the goal of this thesis and the results of our security analysis, we present different approaches allowing to improve the resistance of Java Cards and Java Card applications against combined attacks. Thus we define several countermeasures against the attack we exposed as well as against some of the state-of-the-art attacks, always bearing in mind the strong constraints relative to smart cards.