Architecture Overview

C H A P T E R 1

This chapter introduces the runtime environment in the Connected Edition of the Java Card 3 Platform, including its hardware and connectivity, and describes how it achieves backward compatibility by emulating the Classic Edition’s runtime environment (RE).

The following components of the architecture are described in this chapter:

Hardware Overview

High-level Architecture

Runtime Environment for Classic Applet-based Applications

1.1 Hardware Overview

The Java Card 3 Platform, Connected Edition, is intended to run on a wide variety of smart card and secure token devices with constrained resources. The typical hardware configuration of the targeted devices is as follows:

A 32-bit processor

128 kilobytes of EEPROM

512 kilobytes of ROM

24 kilobytes of RAM

Low power consumption, typically not battery powered, and operating with an external or magnetically-induced power source

Full duplex, high-speed interface with a hosting device

Connectivity to some kind of network, typically through the hosting device:

Over the full duplex, high-speed interface

One or more logical network interfaces

Two-way connections, possibly intermittent, with limited bandwidth

Limited timer and real-time clock capabilities. The minimum is a low precision interval timer and an implementation specific means of re-synchronization of the wall clock time with an external time source.

FIGURE 1-1 depicts the connectivity layers and protocol stacks of the Java Card Platform, Connected Edition.

FIGURE 1-1 Connectivity Layers and Protocol Stacks

1.1.1 Physical Connectivity

The target devices for the Java Card Platform, Connected Edition, typically have a high-speed contacted physical interface. In addition, they may have additional I/O interfaces, including contactless physical interfaces.

The high-speed contacted interface is typically one of the following:

a Universal Serial Bus (USB) interface

a MultiMediaCard (MMC) interface

an ISO 7816-3 interface

The contactless interface is typically an ISO 14443-compliant interface.

1.1.2 Logical Connectivity

A Java Card Platform implementation MUST provide to applications a logical network interface supporting the following network protocols:

TCP (Transmission Control Protocol)

Transport Layer Security (TLS)

Hypertext Transfer Protocol (HTTP)

Secure Hypertext Transfer Protocol (HTTP over TLS)

This logical network interface MAY additionally support the following network protocol:

Universal Datagram Protocol (UDP)

A Java Card Platform implementation is not required to support the TCP/IP or UDP/IP on card. Connections over HTTP, HTTPS, and TLS protocols and datagrams over the UDP protocol MAY be supported over IP, as well as non-IP protocols, by using a gateway on the terminal or hosting device. The TLS protocol MUST be supported on card.

Applications MUST NOT be required to know that a non-IP protocol is being used. Applications MUST only gain access to the logical network interface through the Generic Connection Framework (GCF) API and indirectly through the web application container, see Section 2.1, Web Application Model Overview and Chapter 3. A Java Card Platform implementation MUST recognize both IPv4 and IPv6 literal address formats, such as when passed inside URIs to the GCF API, but MAY only support such addresses according to the underlying supported protocols. See Section 2.3.3, Handling of URIs for details on the URI format that a Java Card Platform implementation MUST support.

A Java Card Platform implementation MUST provide access to the ISO 7816-4 interface to applet-based applications indirectly through the applet container, see Section 2.2, Applet-based Application Models Overview and Chapter 4.

1.2 High-level Architecture

The high-level architecture of the Java Card Platform, Connected Edition, is illustrated in FIGURE 1-2. For additional information on the new architecture in version 3.0.1, see Overview of New Features.

At the core of the Java Card Platform is the Java Card Virtual Machine (Java Card VM). The Java Card VM is implemented on top of the device’s operating system. The Java Card VM is based on a subset of the Connected Limited Device Configuration v1.1 Virtual Machine, which is itself compliant with the Java Virtual Machine Specification and Java Language Specification. The Java Card VM is described in the Virtual Machine Specification for the Java Card Platform, v3.0.1, Connected Edition.

On top of the Java Card VM are the Java Card Platform, Connected Edition libraries and Java Card Classic Edition libraries:

The Java Card Classic Edition libraries are the libraries for the Java Card classic APIs, which are backward compatible with the APIs for the Java Card Platform, release 2.2.2. These APIs are described in the Java Card API Specification, Classic Edition. A superset of these APIs are also included in the Java Card API Specification, Connected Edition. The Java Card Classic Edition APIs include the applet framework API depicted above on the stack.

The Java Card Platform, Connected Edition libraries are the libraries for the Java Card Platform, Connected Edition API. Some of these libraries are defined by the Java Card VM Specification for the Java Card Platform, Connected Edition, others correspond to additional, advanced, functionality described in the current specification document, as well as in the Java Card API Specification, v3.0.1, Connected Edition. The Java Card Platform, Connected Edition APIs include the Servlet API depicted above on the stack

Not depicted on FIGURE 1-2 are libraries from standards bodies that MAY be installed on a Java Card Platform to extend its functionality. These libraries and the functionality they provide MUST be compliant with the specifications of the Java Card Platform, Connected Edition.

On top of the Java Card Platform, Connected Edition and Java Card Classic Edition libraries are the two application containers:

The applet container that contains applet-based applications and manages their lifecycle through the applet framework API. Applet-based applications are of two types:

Classic Applet-based Applications. These applications correspond to ISO 7816 APDU applet-based applications that have been developed against the Java Card classic API and that run in a Java Card v2.2.2 runtime emulation environment that, in particular, guarantees their thread-safety. See Section 1.3, Runtime Environment for Classic Applet-based Applications for more details.

Extended Applet-based Applications. These applications correspond to ISO 7816 APDU applet-based applications that have been developed to use the advanced capabilities of the Java Card Platform, Connected Edition, such as multi-threading and networking.

The servlet container that contains web applications and manages their lifecycle through the servlet API. These applications correspond to HTTP servlet-based applications that have been developed to use the advanced capabilities of the Java Card Platform, Connected Edition.

FIGURE 1-2 High-level Architecture

1.3 Runtime Environment for Classic Applet-based Applications

The Java Card Platform Connected Edition is backward compatible with Java Card Platform, Classic Edition, which is itself compatible with the release 2.2.2 of the Java Card Platform. The Java Card Platform, Connected Edition, MUST support running classic applet-based applications in a Java Card Platform, v2.2.2 runtime emulation environment, which enforces the Java Card RE v2.2.2 runtime requirements.

This Java Card Platform, v2.2.2 runtime emulation environment MUST guarantee the following:

Classic applet-based applications and libraries have access to Java Card Platform, v2.2.2 APIs.

Classic libraries are only accessible to Classic applet-based applications.

Classic applet-based application and library code are executed by a single thread at any time (thread-safety).

Access control and ownership tagging performed by the Java Card platform firewall are identical to that of the Java Card Platform, v2.2.2 firewall, especially with respect to the Java Card RE entry point object and global array objects defined in Java Card Platform, v2.2.2.

The persistence model supports the specialized Java Card Platform, v2.2.2 transient array objects.

The transaction model supports the single transaction rollback logging view of classic applications, as well as the associated API unchanged.

The on-card initialization of classic applet-based application and library classes does not result in different runtime effects and semantics when compared to using off-card, precomputed, static field images.

Off-card compatibility tools MUST allow for Java applications programmed for the Java Card Platform, Version 2.2.2, to be deployed on both the Java Card 3 platform Connected Edition and on the Java Card 3 platform Classic Edition. These tools MUST also allow for Java applications packaged for the Java Card Platform, Version 2.2.2, to be transformed, through a process called normalization, and repackaged for deployment on both the Java Card 3 platform Connected and Classic Editions.

FIGURE 1-3 depicts the development and deployment process for classic applet-based applications that ensures for these applications the backward compatibility and interoperability with both the Java Card 3 platform Connected and Classic Editions.

FIGURE 1-3 Classic Application Development and Deployment Process for Backward Compatibility

See the Runtime Environment Specification for the Java Card Platform, v3.0.1, Classic Edition for an exhaustive list of the requirements for the classic Java Card RE.