jcrespec11installer.html

来自「JAVA CARD 开发包规格说明,版本为2.2.2」· HTML 代码 · 共 594 行 · 第 1/3 页

<P CLASS="Linebreak">
</P>
</UL>
<P CLASS="Paragraph"><A NAME="pgfId-410218"></A>When applet installation is unsuccessful, the Java Card RE shall guarantee that objects created during the execution of the <KBD CLASS="Filename-Command">install</KBD> method, or by the Java Card RE on its behalf (initialized static arrays) can never be accessed by any applet on the card. In particular, any reference in <KBD CLASS="Filename-Command">CLEAR_ON_RESET</KBD> transient space to an object created during an unsuccessful applet installation must be reset as a <KBD CLASS="Filename-Command">null</KBD> reference.
</P><H3 CLASS="Head2"><A NAME="pgfId-407619"></A>11.1.6	Installer Privileges</H3>
<P CLASS="Paragraph"><A NAME="pgfId-418523"></A>Although an Installer may be implemented as an applet, an Installer typically requires access to features that are not available to other applets. For example, depending on the Java Card RE implementer's implementation, the Installer will need to do the following tasks:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-407623"></A>Read and write directly to memory, bypassing the object system and/or standard security.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-407625"></A>Access objects owned by other applets or by the Java Card RE.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-407627"></A>Invoke non-entry point methods of the Java Card RE.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-407629"></A>Be able to invoke the install method of a newly installed applet.
</LI>
<P CLASS="Linebreak">
</P>
</UL>
<P CLASS="Paragraph"><A NAME="pgfId-407631"></A>Again, it is up to each Java Card RE implementer to determine the Installer implementation and supply such features in their Java Card RE implementations as necessary to support their Installer. Java Card RE implementers are also responsible for the security of such features, so that they are not available to normal applets.
</P><H2 CLASS="Head1"><A NAME="pgfId-407641"></A>
<DIV>
<HR ALIGN=left SIZE=6 WIDTH=15% noshade>
</DIV>11.2	<A NAME="42591"></A>The Newly Installed Applet</H2>
<P CLASS="Paragraph"><A NAME="pgfId-418540"></A>A single interface exists between the Installer and the applet that is being installed. After the Installer correctly prepares the applet for execution (performed steps such as loading and linking), the Installer shall invoke the applet's <KBD CLASS="Filename-Command">install</KBD> method. This method is defined in the <KBD CLASS="Filename-Command">Applet</KBD> class.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-418986"></A>The precise mechanism by which an applet's <KBD CLASS="Filename-Command">install(byte[], short, byte)</KBD> method is invoked from the Installer is a Java Card RE implementer-defined implementation detail. However, there shall be a context switch so that any context-related operations performed by the <KBD CLASS="Filename-Command">install</KBD> method (such as creating new objects) are done in the context of the new applet and not in the context of the Installer. The Installer shall also ensure that array objects created in the class initialization (&lt;clinit&gt;) methods of the applet package are also owned by the context of the new applet.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-418994"></A>The Installer shall not invoke the <KBD CLASS="Filename-Command">install(byte[], short, byte)</KBD> method of an applet if another applet from the same package is active on the card. The applet instantiation shall be deemed unsuccessful. 
</P>
<P CLASS="Paragraph"><A NAME="pgfId-410239"></A>The Installer shall ensure that during the execution of the <KBD CLASS="Filename-Command">install()</KBD> method, the new applet (not the Installer) is the currently selected applet. In addition, any <KBD CLASS="Filename-Command">CLEAR_ON_DESELECT</KBD> objects created during the <KBD CLASS="Filename-Command">install()</KBD> method shall be associated with the selection context of the new applet.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-407649"></A>The installation of an applet is deemed complete if all steps are completed without failure or an exception being thrown, up to and including successful return from executing the <KBD CLASS="Filename-Command">Applet.register</KBD> method. At that point, the installed applet is selectable.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-407651"></A>The maximum size of the parameter data is 127 bytes. The <KBD CLASS="Filename-Command">bArray</KBD> parameter is a global array <KBD CLASS="Filename-Command">(install(byte[] bArray, short bOffset, byte bLength)</KBD>), and for security reasons is zeroed after the return from the <KBD CLASS="Filename-Command">install</KBD> method, just as the APDU buffer is zeroed on return from an applet's process method. 
</P><H3 CLASS="Head2"><A NAME="pgfId-407659"></A>11.2.1	<A NAME="marker-413215"></A>Installation Parameters</H3>
<P CLASS="Paragraph"><A NAME="pgfId-407661"></A>The format of the input data passed to the target applet's <KBD CLASS="Filename-Command">install</KBD> method in the <KBD CLASS="Filename-Command">bArray</KBD> parameter is as follows:
</P>
<PRE CLASS="Codeline"><A NAME="pgfId-411345"></A>bArray[offset] = length(Li) of instance AID
</PRE>
<PRE CLASS="Codeline"><A NAME="pgfId-411346"></A>bArray[offset+1..offset+Li] = instance AID bytes (5-16 bytes)
</PRE>
<PRE CLASS="Codeline"><A NAME="pgfId-411305"></A>bArray[offset+Li+1]= length(Lc) of control info
</PRE>
<PRE CLASS="Codeline"><A NAME="pgfId-411309"></A>bArray[offset+Li+2..offset+Li+Lc+1] = control info
</PRE>
<PRE CLASS="Codeline"><A NAME="pgfId-411313"></A>bArray[offset+Li+Lc+2] = length(La) of applet data
</PRE>
<PRE CLASS="Codeline"><A NAME="pgfId-411395"></A>bArray[offset+Li+Lc+3..offset+Li+Lc+La+2] = applet data
</PRE>
<P CLASS="Paragraph"><A NAME="pgfId-411444"></A>Any of the length items: <KBD CLASS="Filename-Command">Li</KBD>, <KBD CLASS="Filename-Command">Lc</KBD>, <KBD CLASS="Filename-Command">La</KBD> may be zero. If length <KBD CLASS="Filename-Command">Li</KBD> is non-zero, the <KBD CLASS="Filename-Command">instance AID bytes</KBD> item is the proposed AID of the applet instance.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-411445"></A>The <KBD CLASS="Filename-Command">control info</KBD> item of the parameter data is implementation dependent and is specified by the Installer. 
</P>
<P CLASS="Paragraph"><A NAME="pgfId-411419"></A>Other than the need for the entire parameter data to not be greater than 127 bytes, the Java Card API does not specify anything about the contents of the <KBD CLASS="Filename-Command">applet data</KBD> item of the global byte array installation parameter. This is fully defined by the applet designer and can be in any format desired. In addition, the <KBD CLASS="Filename-Command">applet data</KBD> portion is intended to be opaque to the Installer.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-420492"></A>Java Card RE implementers should design their Installers so that it is possible for an installation program running in a CAD to specify the <KBD CLASS="Filename-Command">applet data</KBD> delivered to the Installer. The Installer simply forwards this along with the other items in the format defined above to the target applet's <KBD CLASS="Filename-Command">install</KBD> method in the <KBD CLASS="Filename-Command">bArray</KBD> parameter. A typical implementation might define a Java Card RE implementer-proprietary APDU command that has the semantics &quot;call the applet's <KBD CLASS="Filename-Command">install</KBD> method passing the contents of the accompanying <KBD CLASS="Filename-Command">applet data</KBD>.&quot;
</P><H2 CLASS="Head1"><A NAME="pgfId-410260"></A>
<DIV>
<HR ALIGN=left SIZE=6 WIDTH=15% noshade>
</DIV>11.3	<A NAME="32414"></A>The Applet <A NAME="marker-413216"></A>Deletion Manager</H2>
<P CLASS="Paragraph"><A NAME="pgfId-410261"></A>The mechanisms necessary to delete an applet on smart cards using Java Card technology are embodied in an on-card component called the Applet Deletion Manager. 
</P>
<P CLASS="Paragraph"><A NAME="pgfId-418558"></A>To the CAD, the Applet Deletion Manager appears to be an applet, and may be one and the same as the Applet Installer. It has an AID, and it becomes the currently selected applet instance when this AID is successfully processed by a SELECT FILE command. Once selected on a logical channel, the Applet Deletion Manager behaves in much the same way as any other applet, as follows:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-410263"></A>It receives all APDUs dispatched to this logical channel, just like any other active applet.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410264"></A>Its design specification prescribes the various kinds and formats of APDUs that it expects to receive, along with the semantics of those commands under various preconditions.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-419302"></A>It processes and responds to all APDUs that it receives. Response to incorrect APDUs include an error condition of some kind.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410266"></A>When another applet is selected on this logical channel (or when the card is reset or when power is removed from the card), the Applet Deletion Manager becomes deselected and remains suspended until the next time it is selected.
</LI>
<P CLASS="Linebreak">
</P>
</UL><H3 CLASS="Head2"><A NAME="pgfId-410267"></A>11.3.1	Applet Deletion Manager Implementation</H3>
<P CLASS="Paragraph"><A NAME="pgfId-411074"></A>The Applet Deletion Manager need not be implemented as an applet on the card. The requirement is only that the Applet Deletion Manager functionality be SELECTable. The corollary to this requirement is that Applet Deletion Manager component shall not be able to be invoked on a logical channel where a non-Applet Deletion Manager applet is an active applet instance, nor when no applet is active.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-419102"></A>A Java Card RE implementer could choose to implement the Applet Deletion Manager as an applet. If so, the Applet Deletion Manager might be coded to extend the <KBD CLASS="Filename-Command">Applet</KBD> class and to respond to invocations of the <KBD CLASS="Filename-Command">select</KBD>, <KBD CLASS="Filename-Command">process</KBD>, and <KBD CLASS="Filename-Command">deselect</KBD> methods, and, if necessary, the methods of the <KBD CLASS="Filename-Command">javacard.framework.MultiSelectable</KBD> interface.
</P>
<P CLASS="Paragraph"><A NAME="pgfId-410270"></A>However, a Java Card RE implementer could also implement the Applet Deletion Manager in other ways, as long as it provides the SELECTable behavior to the outside world. In this case, the Java Card RE implementer has the freedom to provide some other mechanism by which APDUs are delivered to the Applet Deletion Manager code module.
</P><H3 CLASS="Head2"><A NAME="pgfId-410271"></A>11.3.2	Applet Deletion Manager AID</H3>
<P CLASS="Paragraph"><A NAME="pgfId-410272"></A>Because the Applet Deletion Manager is SELECTable, it shall have an AID which may be the same as that of the Applet Installer. Java Card RE implementers are free to choose their own AIDs by which their Applet Deletion Manager is selected. Multiple Applet Deletion Managers may be implemented.
</P><H3 CLASS="Head2"><A NAME="pgfId-410273"></A>11.3.3	Applet Deletion Manager APDUs</H3>
<P CLASS="Paragraph"><A NAME="pgfId-410274"></A>The Java Card API does not specify any APDUs for the Applet Deletion Manager. Java Card RE implementers are entirely free to choose their own APDU commands to direct their Applet Deletion Manager in its work. 
</P>
<P CLASS="Paragraph"><A NAME="pgfId-410275"></A>The model is that the Applet Deletion Manager on the card is initiated by an applet deletion program running on the CAD. In order for applet deletion to succeed, this CAD applet deletion program shall be able to do the following:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-410276"></A>Recognize the card.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410277"></A>SELECT FILE the Applet Deletion Manager on the card.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410278"></A>Coordinate the applet deletion process by sending the appropriate APDUs to the card Applet Deletion Manager. These APDUs include the following:
</LI>
<P CLASS="Linebreak">
</P>
<UL>
<LI CLASS="Bullet2"><A NAME="pgfId-410279"></A>Authentication information, to ensure that the applet deletion is authorized.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet2-"><A NAME="pgfId-410280"></A>Identify the applet(s) code or instance to be deleted from the card's memory.
</LI>
<P CLASS="Linebreak">
</P>
</UL>
</UL>
<P CLASS="Paragraph"><A NAME="pgfId-410286"></A>The <EM CLASS="Emphasis">Application Programming Interface, Java Card Platform, Version 2.2.2</EM> does not specify the details of the CAD applet deletion program nor the APDUs passed between it and the Applet Deletion Manager.
</P><H3 CLASS="Head2"><A NAME="pgfId-410297"></A>11.3.4	Applet Deletion Manager Behavior</H3>
<P CLASS="Paragraph"><A NAME="pgfId-410298"></A>Java Card RE implementers shall also define other behaviors of their Applet Deletion Manager, including the following:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-410299"></A>Whether or not applet deletion can be aborted and how this is done
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410300"></A>What happens if an exception, reset, or power fail occurs during applet deletion
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410301"></A>What happens if another applet is selected before the Applet Deletion Manager is finished with its work
</LI>
<P CLASS="Linebreak">
</P>
</UL>
<P CLASS="Paragraph"><A NAME="pgfId-418593"></A>The following three categories of applet deletion are required on the card:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-413763"></A>Applet instance deletion involves the removal of the applet object instance and the objects owned by the applet instance and associated Java Card RE structures.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-413766"></A>Applet/library package deletion involves the removal of all the card resident components of the CAP file, including code and any associated Java Card RE management structures.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-413769"></A>Deletion of the applet package and the contained applet instances involves the removal of the card-resident code and Java Card RE structures associated with the applet package, and all the applet instances and objects in the context of the package and associated Java Card RE structures.
</LI>
<P CLASS="Linebreak">
</P>
</UL><H5 CLASS="Head4"><A NAME="pgfId-417372"></A>Invocation of the Method <KBD CLASS="Filename-Command">javacard.framework.AppletEvent.uninstall</KBD></H5>
<P CLASS="Paragraph"><A NAME="pgfId-417385"></A>Whenever one or more applet instances is being deleted, the Applet Deletion Manager shall inform each of the applets of potential deletion by invoking, if implemented, the applet's <KBD CLASS="Filename-Command">uninstall</KBD> method. When multiple applet instances are being deleted, the order of invocation of the uninstall methods is unspecified. Prior to following the stepwise sequence described in <A HREF="JCRESpec11installer.html#53400" CLASS="XRef">Section 11.3.4.1, Applet Instance Deletion</A>, <A HREF="JCRESpec11installer.html#97190" CLASS="XRef">Section 11.3.4.2, Applet/Library Package Deletion</A>, or <A HREF="JCRESpec11installer.html#26964" CLASS="XRef">Section 11.3.4.3, Applet Package and Contained Instances Deletion</A>, the Java Card RE shall do the following:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-417386"></A>Perform any security and authorization checks required for the deletion of each of the applet instances to be deleted. If the checks fail, an error is returned and the applet deletion fails.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-417404"></A>Otherwise, check if an applet instance belonging to the contexts of the applet instances being deleted, is active on the card. If so, an error is returned and the applet instance deletion fails. 
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-417407"></A>Otherwise, perform the following steps for each of the applet instances to be deleted: 
</LI>
<P CLASS="Linebreak">
</P>
</UL>
<P CLASS="ParaIndent1"><A NAME="pgfId-417389"></A>If the applet instance being deleted implements the <KBD CLASS="Filename-Command">AppletEvent</KBD> interface, set the currently selected applet to that of the applet instance and invoke the <KBD CLASS="Filename-Command">uninstall</KBD> method of the applet instance.
</P>
<UL>
<UL>
<LI CLASS="Bullet2"><A NAME="pgfId-417416"></A>A context switch into the context of the applet instance occurs upon invocation.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet2-"><A NAME="pgfId-417419"></A>If an uncaught exception is thrown during the execution of the <KBD CLASS="Filename-Command">uninstall</KBD> method, it is caught and ignored.
</LI>
<P CLASS="Linebreak">
</P>
</UL>
</UL><H4 CLASS="Head3"><A NAME="pgfId-410518"></A>11.3.4.1	<A NAME="53400"></A>Applet Instance Deletion</H4>
<P CLASS="Paragraph"><A NAME="pgfId-410564"></A>The Java Card RE shall guarantee that applet instance deletion is not attempted and thereby deemed unsuccessful in the following cases:
</P>
<UL>
<LI CLASS="Bullet1"><A NAME="pgfId-410570"></A>An object owned by the applet instance is referenced from an object owned by another applet instance on the card.
</LI>
<P CLASS="Linebreak">
</P>
<LI CLASS="Bullet1"><A NAME="pgfId-410502"></A>An object owned by the applet instance is referenced from a static field on any package on the card.
</LI>