Signing program data payload sequence in program loading

• US 8,473,417 B2
• Filed: 06/06/2011
• Issued: 06/25/2013
• Est. Priority Date: 01/16/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: de Jong, Eduard
• Primary Examiner(s): Cheung, Mary
• Application Number:
  US13/134,413
• Publication Number:
  US 20110289323A1
• Time in Patent Office: 750 Days
• Field of Search: 705/64, 705/65, 705/67, 726/1, 726/2, 726/4, 726/5, 726/9, 726/14, 726/20, 382/115, 382/116, 382/124, 713/168, 713/180, 713/182, 713/186, 713/189, 713/192
• US Class Current: 705/64
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Communicating program data between a first device and a second device comprises disassembling a first program file comprising program data into at least one logical data unit, partitioning each of the at least one logical data unit into at least one protocol data unit and computing a first fingerprint over the payload portion of the at least one protocol data unit of the at least one logical data unit. The format of the at least one protocol data unit is defined by a communication protocol and includes a payload portion.

Claims

1. A method comprising:

disassembling, on a host computer, a first program file comprising program data into at least one logical data unit;

partitioning, on said host computer, each of said at least one logical data unit into at least one protocol data unit, the format of said at least one protocol data unit defined by a communication protocol and including a payload portion;

computing, on said host computer, a first fingerprint over the payload portion of said at least one protocol data unit of said at least one logical data unit; and

communicating, by said host computer a second program file to a loading terminal configured to communicate with a resource-constrained device, said second program file comprising said program data and one or more members of the group comprising said first fingerprint and an authentication code based at least in part on said first fingerprint.

2. The method of claim 1 wherein said program data comprises a class file.

3. The method of claim 1 wherein said first program file comprises a JAR file.

4. The method of claim 1 wherein said first program file comprises a CAP file.

5. The method of claim 1 wherein said method further comprises creating, on said host computer, at least one verification protocol data unit associated with one of said at least one logical data unit, said verification protocol data unit comprising verification data for said logical data unit.

6. The method of claim 1 wherein said authentication code further comprises at least one loading device authentication code for use by said loading terminal in authenticating said second program file received from said host computer.

7. The method of claim 1 wherein said authentication code further comprises at least one target device authentication code for use by resource-constrained device in authenticating data received from said loading terminal, said received data based at least in part on said first program file.

8. The method of claim 1 wherein

said communication protocol comprises an application protocol data unit (APDU) protocol;

and

said protocol data units comprise application protocol data units (APDUs).

9. A program storage device readable by a machine, embodying a program of instructions executable by the machine comprising:

disassembling, on a host computer, a first program file comprising program data into at least one logical data unit;

partitioning, on said host computer, each of said at least one logical data unit into at least one protocol data unit, the format of said at least one protocol data unit defined by a communication protocol and including a payload portion;

computing, on said host computer, a first fingerprint over the payload portion of said at least one protocol data unit of said at least one logical data unit; and

communicating, by said host computer a second program file to a loading terminal configured to communicate with a resource-constrained device, said second program file comprising said program data and one or more members of the group comprising said first fingerprint and an authentication code based at least in part on said first fingerprint.

10. An apparatus comprising:

a memory for storing said program data; and

an off-card installer configured to;

disassemble a first program file comprising program data into at least one logical data unit;

partition each of said at least one logical data unit into at least one protocol data unit, the format of said at least one protocol data unit defined by a communication protocol and including a payload portion;

compute a first fingerprint over the payload portion of said at least one protocol data unit of said at least one logical data unit; and

communicate a second program file to a loading device configured to communicate to a resource-constrained device, said second program file comprising said program data and one or more members of the group comprising said first fingerprint and an authentication code based at least, in part on said first fingerprint.

11. The apparatus of claim 10 wherein said program data comprises a class file.

12. The apparatus of claim 10 wherein said first program file comprises a JAR file.

13. The apparatus of claim 10 wherein said first program file comprises a CAP file.

14. The apparatus of claim 10 wherein said off-card installer is further configured to create at least one verification protocol data unit associated with one of said at least one logical data unit, said verification protocol data unit comprising verification data for said logical data unit.

15. The apparatus of claim 10 wherein said authentication code further comprises at least one loading device authentication code for use by said loading device in authenticating said second program file.

16. The apparatus of claim 10 wherein said authentication code further comprises at least one target device authentication code for use by said resource-constrained device in authenticating data received from said loading terminal, said received data based at least in part on said first program file.

17. The apparatus of claim 10 wherein

said communication protocol comprises an application protocol data unit (APDU) protocol;

and

said protocol data units comprise application protocol data units (APDUs).