Universite de Caen Basse Normandie; ENSICAEN; UMR 6072 GREYC, France
Security, Analysis, Smart Card application, Observation, Detection, Evaluation, WSCT Framework.
Enterprise Information Systems
Information Systems Analysis and Specification
Information Technologies Supporting Learning
Security and Privacy
Smart cards are tamper resistant devices but vulnerabilities are sometimes discovered. We address in this paper the security and the functional testing of embedded applications in smart cards. We propose an original methodology for the evaluation of applications and we show its beneﬁt by comparing it to a classical certiﬁcation process. The proposed method is based on the observation of the APDU (Application Protocol Data Unit) communication with the smart card. Some speciﬁc properties are veriﬁed as a complementary method in the evaluation process and allows the on-the-ﬂy detection of an anomaly and the reasons that triggered this anomaly during the test. Here are presented two uses of this method: a simple use to illustrate the use of properties to verify an implementation of an application and a more complex illustration by applying the fuzzing method to show what we can obtain with the proposed approach, i.e. an analysis of an anomaly.