Automatic Generation of Vulnerability Tests for the Java Card Byte Code Verifier

The byte code verifier is an essential component of the Java Card security platform. Test generation to assess its implementation is mandatory, however, comprehensive test plans are too intricate to be handmade. Therefore, automating their generation is an interesting avenue. Our approach is based on formal methods, an important asset to find a preamble, a postamble, or the entire set of test cases for each instruction. The proposed vulnerability tests confirm that a behavior rejected by the model is also rejected by its implementation. Our results show that the techniques put forward achieve such a goal, through a simplified language.