Computer program product containing instructions for providing a processor the capability of executing an application derived from a compiled form

• US 8,726,247 B2
• Filed: 10/19/2010
• Issued: 05/13/2014
• Est. Priority Date: 10/25/1996
• Status: Expired due to Fees

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Wilkinson, Timothy J., Guthery, Scott B., Krishna, Ksheerabdhi, Montgomery, Michael A.
• Primary Examiner(s): CHAVIS, JOHN Q
• Application Number:
  US12/907,949
• Publication Number:
  US 20110126178A1
• Time in Patent Office: 1,302 Days
• Field of Search: 717/139
• US Class Current: 717/139
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/443 Optimisation
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/44557 Code layout in executable memory
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3563 Software being resident on card
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/03 : Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/062 : Pre-authentication

Abstract

An integrated circuit card is used with a terminal. The integrated circuit card includes a memory that stores an interpreter and an application that has a high level programming language format. A processor of the card is configured to use the interpreter to interpret the application for execution and to use a communicator of the card to communicate with the terminal.

Claims

1. A method of programming a device having a memory and a processor, the method comprising the steps of:

inputting an application program in a first programming language;

compiling the application program in the first programming language into a first intermediate code associated with the first programming language wherein the first intermediate code is interpretable by a first intermediate code virtual machine and not interpretable by a second intermediate code virtual machine;

converting the first intermediate code into a second intermediate code by performing at least one operation to replace a construct in the first intermediate code with an equivalent construct in the second intermediate code, wherein the second intermediate code is interpretable by the second intermediate code virtual machine and not interpretable by the first intermediate code virtual machine;

loading the second intermediate code into the memory of the device;

providing the application with specific privileges; and

upon detecting that the application attempts access to a data item on the device, determining whether the specific privileges of the application are sufficient to allow the application the access to the data item.

2. The method of programming a device of claim 1 wherein providing specific privileges to the application comprises associating an identity with the application.

3. The method of programming a device of claim 1 further comprising determining whether the specific privileges of the application are sufficient to allow the application the access to the data item by delegating the determination to an operating system of the device.

4. The method of programming a device of claim 3 further comprising granting access upon determining that the identity associated with the application is contained in the access control list associated with the data item.

5. The method of programming a programmable device of claim 3 further comprising denying access upon determining that the identity associated with the application is not contained in the access control list associated with the data item.

6. A method of programming a device having a memory and a processor, the method comprising the steps of:

inputting an application program in a first programming language;

compiling the application program in the first programming language into a first intermediate code associated with the first programming language wherein the first intermediate code is interpretable by a first intermediate code virtual machine and not interpretable by a second intermediate code virtual machine;

converting the first intermediate code into a second intermediate code by performing at least one operation to replace a construct in the first intermediate code with an equivalent construct in the second intermediate code, wherein the second intermediate code is interpretable by the second intermediate code virtual machine and not interpretable by the first intermediate code virtual machine; and

loading the second intermediate code into the memory of the device;

wherein the second code virtual machine is set to recoginize a method invocation as being an invocation of a native code subroutine and upon recognizing the method invocation as being an invocation of a native code subroutine, transferring control to the native code subroutine.

7. The method of programming a device of claim 6 wherein the second code virtual machine passes parameters to the native code subroutine on a stack associated with the second code virtual machine.

8. The method of programming a device of claim 6 wherein the second code virtual machine passes parameters to the native code subroutine on a stack associated with an operating system of the device.

9. An electronic device, comprising:

a memory and a processor connected to the memory;

the memory storing;

a second intermediate code virtual machine configured to interpret applications in a converted form; and

an application for the device obtained by;

a compiler operable to compile an application program in a first programming language into a first intermediate code associated with the first programming language wherein the first intermediate code is interpretable by at least one first intermediate code virtual machine and not interpretable by the second intermediate code virtual machine; and

a converter operable to convert the first intermediate code into a second intermediate code by performing at least one operation to replace a construct in the first intermediate code with an equivalent construct in the second intermediate code, wherein the second intermediate code is interpretable by a second intermediate code virtual machine and not interpretable by the first intermediate code virtual machine;

wherein the application has associated therewith specific privileges; and

wherein the device is operable to, upon detecting that the application attempts access to a data item on the device, determine whether the specific privileges of the application are sufficient to allow the application the access to the data item.

10. The electronic device of claim 9 wherein the specific privileges to the application are associated with an identity associated with the application.

11. The electronic device of claim 10 wherein the device is further operable to grant access upon determining that the identity associated with the application is contained in the access control list associated with the data item.

12. The electronic device of claim 10 wherein the device is further operable to deny access upon determining that the identity associated with the application is not contained in the access control list associated with the data item.

13. An electronic device, comprising:

a memory and a processor connected to the memory;

the memory storing;

a second intermediate code virtual machine configured to interpret applications in a converted form; and

an application for the device obtained by;

a compiler operable to compile an application program in a first programming language into a first intermediate code associated with the first programming language wherein the first intermediate code is interpretable by at least one first intermediate code virtual machine and not interpretable by the second intermediate code virtual machine; and

a converter operable to convert the first intermediate code into a second intermediate code by performing at least one operation to replace a construct in the first intermediate code with an equivalent construct in the second intermediate code, wherein the second intermediate code is interpretable by a second intermediate code virtual machine and not interpretable by the first intermediate code virtual machine; and

wherein the application has associated therewith specific privileges; and

wherein the device comprises an operating system operable to, upon detecting that the application attempts access to a data item on the device, determine whether the specific privileges of the application are sufficient to allow the application the access to the data item.

14. An electronic device, comprising:

a memory and a processor connected to the memory;

the memory storing;

a second intermediate code virtual machine configured to interpret applications in a converted form and further configured to recognize a method invocation as being an invocation of a native code subroutine and upon recognizing the method invocation as being an invocation of a native code subroutine, transferring control to the native code subroutine; and

an application for the device obtained by;

a compiler operable to compile an application program in a first programming language into a first intermediate code associated with the first programming language wherein the first intermediate code is interpretable by at least one first intermediate code virtual machine and not interpretable by the second intermediate code virtual machine; and

a converter operable to convert the first intermediate code into a second intermediate code by performing at least one operation to replace a construct in the first intermediate code with an equivalent construct in the second intermediate code, wherein the second intermediate code is interpretable by a second intermediate code virtual machine and not interpretable by the first intermediate code virtual machine.

15. The electronic device of claim 14 wherein the second code virtual machine passes parameters to the native code subroutine on a stack associated with the second code virtual machine.

16. The electronic device of claim 14 wherein the second code virtual machine passes parameters to the native code subroutine on a stack associated with an operating system of the device.