Jean-Louis Lanet

article

A systematic approach toward security in Fog computing: Assets, vulnerabilities, possible countermeasures

Mozhdeh Farhadi, Jean‐Louis Lanet, Guillaume Pierre, Daniele Miorandi

Software: Practice and Experience > 50 > 6 > 973 - 997

Fog computing is an emerging paradigm in the Internet of Things (IoT) space, consisting of a middle computation layer, sitting between IoT devices and Cloud servers. Fog computing provides additional computing, storage, and networking resources in close proximity to where data is being generated and/or consumed. As the Fog layer has direct access to data streams generated by IoT devices and responses/commands...

article

Reverse engineering Java Card and vulnerability exploitation: a shortcut to ROM

Abdelhak Mesbah, Jean-Louis Lanet, Mohamed Mezghiche

International Journal of Information Security > 2019 > 18 > 1 > 85-100

Secure elements store and manipulate assets in a secure way. The most attractive assets are the cryptographic keys stored into the memory that can be used to provide secure services to a system. For this reason, secure elements are prone to attacks. But retrieving assets inside such a highly secure device is a challenging task. This paper presents the process we used to gain access to the assets in...

chapter

Persistent fault injection attack from white-box to black-box

Abdelhak Mesbah, Mohamed Mezghiche, Jean-Louis Lanet

2017 5th International Conference on Electrical Engineering - Boumerdes (ICEE-B) > 1 - 6

2017 5th International Conference on Electrical Engineering - Boumerdes (ICEE-B)

Among the protection mechanisms that ensure the Java Card security, the Byte Code Verifier (BCV) is one of the most important security elements. In fact, embedded applets must be verified prior installation. This prevents ill-formed applet to be loaded. In this article, the behavior of the Oracle BCV towards some unchecked piece of codes is analyzed, and the way to bypass the BCV is highlighted. Then,...

chapter

An Automated Formal Process for Detecting Fault Injection Vulnerabilities in Binaries and Case Study on PRESENT

Thomas Given-Wilson, Nisrine Jafri, Jean-Louis Lanet, Axel Legay

2017 IEEE Trustcom/BigDataSE/ICESS > 293 - 300

2017 IEEE Trustcom/BigDataSE/ICESS

Recently fault injection has increasingly been used both to attack software applications, and to test system robustness. Detecting fault injection vulnerabilities has been approached with a variety of different but limited methods. This paper proposes a general process without these limitations that uses model checking to detect fault injection vulnerabilities in binaries. The efficacy of this process...

article

Reverse engineering a Java Card memory management algorithm

Abdelhak Mesbah, Jean-Louis Lanet, Mohamed Mezghiche

Computers & Security > 2017 > 66 > C > 97-114

Smart cards are tamper resistant devices that manipulate assets in a secure way. Among the assets, one is of a particular interest the native layers. If some attacks have succeeded in getting access to the applicative layer very few of them have had access to the native layers. We propose here to use applicative programs to perform data reverse engineering in order to understand the hidden algorithms...

article

When time meets test

Jean-Louis Lanet, Hélène Bouder, Mohammed Benattou, Axel Legay

International Journal of Information Security > 2018 > 17 > 4 > 395-409

One of the main challenges in system’s development is to give a proof of evidence that its functionalities are correctly implemented. This objective is mostly achieved via testing techniques, which include software testing to check whether a system meets its functionalities, or security testing to express what should not happen. For the latter case, fuzzing is considered as first class citizen. It...

article

Trust can be misplaced

Noreddine El Janati El Idrissi, Guillaume Bouffard, Jean-Louis Lanet, Said El Hajji

Journal of Cryptographic Engineering > 2017 > 7 > 1 > 21-34

Retrieving assets inside a secure element is a challenging task. The most attractive assets are the cryptographic keys stored into the non-volatile memory area. Most of the researches try to obtain cryptographic keys through side-channel attacks or fault-injection attacks. Such cryptographic objects are stored into secure containers. We demonstrate in this paper how one can use some characteristics...

chapter

Evaluation of the Ability to Transform SIM Applications into Hostile Applications

Guillaume Bouffard, Jean-Louis Lanet, Jean-Baptiste Machemie, Jean-Yves Poichotte, more

Lecture Notes in Computer Science > Smart Card Research and Advanced Applications > Smart Cards System Security > 1-17

The ability of Java Cards to withstand attacks is based on software and hardware countermeasures, and on the ability of the Java platform to check the correct behavior of Java code (by using byte code verification). Recently, the idea of combining logical attacks with a physical attack in order to bypass byte code verification has emerged. For instance, correct and legitimate Java Card applications...

chapter

COGITO: Code polymorphism to secure devices

Damien Courousse, Bruno Robisson, Jean-Louis Lanet, Thierno Barry, more

2014 11th International Conference on Security and Cryptography (SECRYPT) > 1 - 6

2014 11th International Conference on Security and Cryptography (SECRYPT)

In this paper, we advocate the use of code polymorphism as an efficient means to improve security at several levels in electronic devices. We analyse the threats that polymorphism could help thwart, and present the solution that we plan to demonstrate in the scope of a collaborative research project called COGITO. We expect our solution to be effective to improve security, to comply with the computing...

article

Chronicle of a Java Card death

Mozhdeh Farhadi, Jean-Louis Lanet

Journal of Computer Virology and Hacking Techniques > 2017 > 13 > 2 > 109-123

Various attacks are designed to gain access to the assets of Java Card Platforms. These attacks use software, hardware or a combination of both. Manufacturers have improved their countermeasures to protect card assets from these attacks. In this paper, we attempt to gain access to assets of a recent Java Card Platform by combining various logical attacks. As we did not have any information about the...

chapter

Formal Proof of Smart Card Applets Correctness

Jean-Louis Lanet, Antoine Requet

Lecture Notes in Computer Science > Smart Card Research and Applications > Session 2: The Java Card I > 85-97

The new Gemplus smart card is based on the Java technology, embedding a virtual machine. The security policy uses mechanisms that are based on Java properties. This language provides segregation between applets. But due to the smart card constraints a byte code verifier can not be embedded. Moreover, in order to maximise the number of applets the byte code must be optimised. The security properties...

chapter

FACADE: A Typed Intermediate Language Dedicated to Smart Cards

Gilles Grimaud, Jean-Louis Lanet, Jean-Jacques Vandewalle

Lecture Notes in Computer Science > Software Engineering — ESEC/FSE ’99 > 476-493

The use of smart cards to run software modules on demand has become a major business concern for application issuers. Such down-loadable executable content needs to be trusted by the card execution environment in order to ensure that an instruction on a memory area is compliant with the definition of the data stored in this area (i.e. its type). Current solutions for smart cards rely on three techniques...

chapter

Combined Software and Hardware Attacks on the Java Card Control Flow

Guillaume Bouffard, Julien Iguchi-Cartigny, Jean-Louis Lanet

Lecture Notes in Computer Science > Smart Card Research and Advanced Applications > Java Card Security > 283-296

The Java Card uses two components to ensure the security of its model. On the one hand, the byte code verifier (BCV) checks, during an applet installation, if the Java Card security model is ensured. This mechanism may not be present in the card. On the other hand, the firewall dynamically checks if there is no illegal access. This paper describes two attacks to modify the Java Card control flow and...

chapter

Enforcing High-Level Security Properties for Applets

Mariela Pavlova, Gilles Barthe, Lilian Burdy, Marieke Huisman, more

IFIP — The International Federation for Information Processing > Smart Card Research and Advanced Applications VI > Java Cards > 1-16

Smart card applications often handle privacy-sensitive information, and therefore must obey certain security policies. Typically, such policies are described as high-level security properties, stating for example that no pin verification must take place within a transaction. Behavioural interface specification languages, such as JML (Java Modeling Language), have been successfully used to validate...

chapter

Are Smart Cards the Ideal Domain for Applying Formal Methods

Jean-Louis Lanet

Lecture Notes in Computer Science > ZB 2000: Formal Specification and Development in Z and B > 363-373

The traditional approach for programming smart cards does not allow the creation of downloadable executable code and requires programmers with experience in programming in low-level languages. This approach, associated with a high quality qualification process, produce secured smart card. Unfortunately, it does not allow card manufacturers and issuers to quickly respond to the market changes, and...

chapter

Java Applet Correctness: A Developer-Oriented Approach

Lilian Burdy, Antoine Requet, Jean-Louis Lanet

Lecture Notes in Computer Science > FME 2003: Formal Methods > Java, Object Orientation and Modularity > 422-439

This paper presents experiments on formal validation of Java applets. It describes a tool that has been developed at the Gemplus Research Labs. This tool allows to formally prove Java classes annotated with JML, an annotation language for Java that provides a framework for specifying class invariants and methods behaviours. The foundations and the main features of the tool are presented. The most...

chapter

A load balancing task allocation scheme in a hard real time system

Jean Louis Lanet

Lecture Notes in Computer Science > Euro-Par'96 Parallel Processing > 640-643

We address the problem of allocating real-time tasks subject to precedence constraints in a distributed system. The use of a list algorithm is a good trade-off between the complexity of the algorithm and the quality of the solution. The optimisation criterion is the load balancing which is linked with the fault tolerance requirements. Such a criterion guarantees that every processor will spend the...

chapter

JACK — A Tool for Validation of Security and Behaviour of Java Applications

Gilles Barthe, Lilian Burdy, Julien Charles, Benjamin Grégoire, more

Lecture Notes in Computer Science > Formal Methods for Components and Objects > Trust and Security > 152-174

We describe the main features of JACK (Java Applet Correctness Kit), a tool for the validation of Java applications, annotated with JML specifications. JACK has been especially designed to improve the quality of trusted personal device applications. JACK is fully integrated with the IDE Eclipse, and provides an easily accessible user interface. In particular, it allows to inspect the generated proof...

chapter

Checking the Paths to Identify Mutant Application on Embedded Systems

Ahmadou Al Khary Séré, Julien Iguchi-Cartigny, Jean-Louis Lanet

Lecture Notes in Computer Science > Future Generation Information Technology > Security, Software Engineering, Communication and Networking > 459-468

The resistance of Java Card against attack is based on software and hardware countermeasures, and the ability of the Java platform to check the correct behaviour of Java code (by using bytecode verification for instance). Recently, the idea to combine logical attacks with a physical attack in order to bypass bytecode verification has emerged. For instance, correct and legitimate Java Card applications...

book

Construction and Analysis of Safe, Secure, and Interoperable Smart Devices

Gilles Barthe, Benjamin Grégoire, Marieke Huisman, Jean-Louis Lanet

Lecture Notes in Computer Science

INFONA - science communication portal

Search results for: Jean-Louis Lanet

A systematic approach toward security in Fog computing: Assets, vulnerabilities, possible countermeasures

Reverse engineering Java Card and vulnerability exploitation: a shortcut to ROM

Persistent fault injection attack from white-box to black-box

An Automated Formal Process for Detecting Fault Injection Vulnerabilities in Binaries and Case Study on PRESENT

Reverse engineering a Java Card memory management algorithm

When time meets test

Trust can be misplaced

Evaluation of the Ability to Transform SIM Applications into Hostile Applications

COGITO: Code polymorphism to secure devices

Chronicle of a Java Card death

Formal Proof of Smart Card Applets Correctness

FACADE: A Typed Intermediate Language Dedicated to Smart Cards

Combined Software and Hardware Attacks on the Java Card Control Flow

Enforcing High-Level Security Properties for Applets

Are Smart Cards the Ideal Domain for Applying Formal Methods

Java Applet Correctness: A Developer-Oriented Approach

A load balancing task allocation scheme in a hard real time system

JACK — A Tool for Validation of Security and Behaviour of Java Applications

Checking the Paths to Identify Mutant Application on Embedded Systems

Construction and Analysis of Safe, Secure, and Interoperable Smart Devices

Filter options

Publication date

Content availability

Publication type

Keywords

Data set

Journal

INFONA - science communication portal

Search results for: Jean-Louis Lanet

Add recipient

Sending message cancelled

Are you sure you want to cancel sending this message?

Send message

Filter options

Publication date

Date range setting

Set the date range to filter the displayed results. You can set a starting date, ending date or both. You can enter the dates manually or choose them from the calendar.

Content availability

Publication type

Keywords

Data set

Journal

Reporting an error / abuse

Sending the report failed

Accessibility options