How does Javacard s-off work?

Just to preface my question, I do not have an M9. My previous phone was a M7 that I got s-off using rumrunner and now I have an S6, so I am only asking this question out of curiosity. I see a lot of references to buying and using a javacard to obtain s-off and root on the M9 and I'm wondering how it works but can't find too much info on it. I have never even heard of a javacard before and I am just asking for a general description of how it works. Is it a component that needs physically installed by actually disassembling the phone? Or is it something that plugs into the micro USB port somehow and can access parts of the system that cannot be reached by using ADB commands?

Thanks