Mass memory card for microcomputer

The mass memory cards movibles for microcomputers (or personal computers or PC English ' "personal computer") have appeared recently as computer accessories personal, especially for laptops. They could in the future replace diskettes and other mass storage means of the magnetic type. They can be used as mass storage capacity than magnetic disks (order size: one million bytes); their size is not greater (credit card size, thickness of 3 to 5 millimeters); they are much faster Access (several thousand times faster).

They can even be used as RAM directly executable by the microcomputer. In this case, unlike the mass storage magnetic, they do not have to be unloaded in random access memory (RAM) of the PC to be executed next. The programs contained therein are executed directly by the PC.

The mass memory cards, sometimes called even PC-Cards, contain several chips memory and a connector (female connector 68 Pin according to PCMCIA standard for "Personal Computer Memory Card International Association "1030B East Duane Avenue Sunnyvale, California). The card can be plugged in a corresponding connector (male) of the computer. The connections are such that memory can be addressed by a parallel input-output port PC, or as if the memory was memory magnetic mass, or as if it were an extension RAM of the computer.

According to the invention, we thought it would be desirable secure as possible cards mass memory for personal computers. Indeed, their great capacity that they can contain either large databases deserving protected read and write or program expensive not wishing to see or use duplicate without authorization; or finally, they can serve ensuring confidential transactions according to more sophisticated than those currently existing programs, or involving amounts of data greater than what can store single smart card secure transactions that have a chip.

The solutions currently available for provide security are:<ul><li>First the same types of protection may be used as for magnetic memories; among those there is the ability to hide files Software attributes that make them invisible to the user when it tries to access it by the microcomputer. This is a classic solution for PCs running DOS. But we know that a power user can easily turn these protections by going in software the attributes of files and modifying them. This therefore constitutes a summary protection;</li><li>there is then used all the traditional protections by software manufacturers to protect them against copying. These solutions are more or less effective, and serve at least not protect against use;</li><li>is finally known the use of smart cards security to protect a computer (or other devices) against use by a non-incumbent authorized. This solution will be remembered more detail below.</li></ul>

Also known as EP 0152024 a smart card containing a microprocessor, a first specific memory for storing access rules for zones a second memory of the chip card.

To ensure access permission to a PC it was proposed to add to a PC card reader secure chip: the chip card reader is connected PC; it is besides the keyboard and computer screen that interface for the exchange of data for authorization operations; the map chip includes a single chip that is a module security. The security is to prevent the use of PC if the user does not provide privacy codes adequate. These codes are introduced from PC keyboard, according to an exchange protocol specifically provided between the PC and the card. This is the PC for use is to be protected which may itself be used to provide exchanges. The smart card is not part of the PC. The user carries his security card after using the device not to leave freely available to unauthorized third parties; Security is indeed based primarily on the simultaneous possession of the card and a confidential code assigned to that card.

If we want now not protect the PC a whole (because we want that it can serve to others for common uses) but the card mass memory that will connect to it, there must be whereas the security adapter connected to the drive map associated with the PC will not cause the ban Total PC operation but selectively ban operation of the port that is connected the mass memory card.

We think however that this solution disadvantages and does not ensure safety sufficient against undesired use of the card.

According to the invention there is provided an original solution of incorporating the memory card removable mass itself (which comprises several integrated circuits memory) at least one integrated circuit security adapted to control access to memory areas the mass memory.

The control is done in principle in accordance with information Enabling the user must be provided by via the computer (PIN introduced keyboard or other authorization mode).

For safety circuit here means a chip single integrated circuit comprising a memory not volatile with confidential information that can not be transmitted to the external terminals the integrated circuit, and a programmed safety circuitry, able to use such confidential information and other information provided by the user, to deliver validation instructions after checking a predetermined relationship between these two types of information: confidential data do not come to outside the integrated circuit.

This safety circuit is preferably the same the single circuit of a smart card enabling (The one above, and we talked about that can be used to allow the operation of a computer when the holder introduced into the computer). But here we do not use a removable clearance card for enabling the operation of the computer or the connection port with the mass memory. directly placing a security chip in the mass memory to secure the content thereof.

Note that the secure chips used to protect the read or write a data memory used up to now to protect the contents of the internal memory of the chip itself, Using the fact that in the case of a single chip the Data protection is not transmitted outside of the chip. And it was no also no memories mass but very small memories, just because These memories were placed in the chip. And otherwise the secure chips used to protect Other devices were incorporated into a security card separate device to protect card users ability carries with him and does not let in the device to be protected. Here, we do not use smart card separate from the device to be protected and transported away of the device to be protected, but rather a chip integrated circuit undetachably mounted in the memory card whose use must be protected.

By this arrangement is achieved protection files, reading and / or writing much higher to that obtained by standard means (of such software: hidden files) file protection personal computers.

The secure chip (hereinafter referred to also Security Module) control (directly or indirectly) the means of access to different chips card memory.

In practice, we prefer to use a chip standard type of security, that is to say, of the type used in security access cards or devices local, or in transaction cards secure: these chips use a communication mode series: they generally have six or eight studs connection with the outside, only one communication pad of data or instruction.

then it is preferred to place in the memory card an additional chip constituting a processor control map. This processor or microcontroller will serve to provide an interface between the card connector and the safety chip and an interface between the security chip and memory chips. In practice, the conduct of an audit program empowerment of a holder may be under the control of control processor: This program may then be contained in a memory program as part of the same chip as the Control Processor: or else the program will optionally be contained in a part of the memory mass itself, if that party is connected an executable bus control processor.

The secure chip itself comprises a microprocessor and memories, with among these memories programmable non-volatile memories electrically and possibly electrically erasable. The operation of this microprocessor program principle is recorded in a memory died of bullet, but it can also be partially stored in non-volatile programmable memory and electrically erasable. The content of at least some non-volatile memories is not readable on the outer limits of chip. This content is used exclusively by the microprocessor for its own needs, including for the implementation of safety programs involving secret codes placed in these memoirs inaccessible.

One can for example consider that memory confidential security chip data contains a word of empowerment for each memory area mass memory: if 24 memory chips there may be 24 different access words: it can also have access hierarchies to access multiple memory areas.

In addition, for added security, we may provide that the data stored in the memory mass is encrypted and the security module includes an encryption and decryption program. The memory data can be communicated through the security module (read or write). The security module can perform himself the encryption or decryption, but it can also providing a calculation key to the control processor then conduct itself encryption and decryption (Only in the presence of a clearance recognized by the security chip).

The invention has particular purpose a mass memory card according to claim 1.

Other features and advantages of the invention will appear on the reader detailed description which follows and which is given with reference to the drawings attached in which:<ul><li>Figure 1 shows the architecture of the memory card Mass according to the invention:</li><li>2 shows a circuit detail.</li></ul>

CC map shown in Figure 1 is intended to be inserted into a personal computer (called PC below for "personal computer"): map includes a standard pluggable connector CNC, preferably of the type defined by the PCMCIA standard and the PC has a corresponding connector to receive the map.

The card is a smart card, that is to say, it is intended to be used primarily to store Datas. For this function, the card has to be several different types of memory (static RAM or dynamic, ROM, EPROM, EEPROM, FLASHEPROM are the most common types) is one type of memory. If the memories are RAM, by Volatile gasoline, there may be a supply battery Backup for data backup.

For greater storage capacity, several integrated circuit chips are provided, each a memory chip. These chips are generally designated with the reference MEM. he can be several dozen chips on the card for large storage capacities (several megabytes for example).

CC card is a removable device body the PC. It can be used either as mass storage device or as extension of RAM. This is the computer that manages this choice (when a choice is possible, that is to say, especially when there are several types of memory in the card).

In addition to the memories MEM, the card includes, according to the invention, a security module, which is a chip of MPS integrated circuit comprising a microprocessor, small stores, and programs for operation of the microprocessor: this module is essential function to ensure the safety of access to Memories MEM from the computer.

Preferably, the card includes CC yet an additional chip that is a control processor or microcontroller MPC, that is to say a microprocessor having associated program memories. This microcontroller MPC's function issuing flea access control signal memory based data security information by the security module MPS and query functions access made from the PC. Note that this microcontroller has parallel data outputs to directly provide more signal to memory control. The security module has meanwhile that in principle the data outputs in series on a single input / output terminal, and This is why two different chips MPS and MPC are provided with each microprocessor. If the MPS unit has data outputs parallel could be dispensed from the MPC chip: the functions of these two systems will be performed by a single chip microprocessor comprising memories programs for the different functions to perform.

The security module MPS acts as a "slave" compared to a "master" who is the microcontroller MPC.

The memories MEM are connected to the PC via several buses: an address bus, a data bus, and a control signal bus. However, these buses are controlled by a circuit verrrouillage CV, itself controlled by the microcontroller MPC, so that the memory access is not completely free, unless permission is given by the microcontroller MPC.

In the example shown, it is assumed that the locking circuit CV acts on the address bus and on the control signal bus but not on the bus of data. Other solutions are however possible.

Therefore shows firstly a bus BD1 data directly from the connector CNC to the memory MEM: a second address bus from the connector to the memory and interrupted by the Locking circuit CV: this bus is referenced in AD1 upstream of the latch circuit (the connector side) and AD3 downstream (on the side of the memory): Finally, a bus control signals (SC1 upstream, downstream SC3) also interrupted by the locking circuit CV temporarily be noted that another (circuit AA switch) is interposed between the bus SC3 and memory. Its function is to refer to memory SC3 is the bus control signals from PC or of a SC2 bus control signals from the microcontroller MPC. We will come back this later. Control signal bus leading finally in the memory is denoted by SC in downstream of the switching circuit.

As a simplified illustrative example, one can consider for example that the SC1 control bus, or SC2 or SC3 or SC carry signals such as read commands (RD1, RD2, RD3, RD) or write (WR1, WR2, WR3, WR) or selection orders a chip of several (CEA1, CEA2, CEA3, CEa for selecting a memory chip A from among several chips A, B, C; or CEB1, CEb2, CEb3, for CEb the chip B, etc.).

The locking circuit CV is directly controlled by an enabling bus SH from the microcontroller MPC. This bus carries authorization signals or prohibition of passage control signals address or that transit through the latch circuit CV. For example always, one can imagine that there is a reading clearance signal SHR, a write enable signal SHW, clearance signals for each memory chip SHA for the chip A SHB for the chip B, SHC for the chip C.

The peculiarity is that the clearance signals directly from the microcontroller MPC.

The microcontroller MPC has the possibility electronically and selectively prohibit access read or write to some parts of memory MEM map.

To complete the general description of architecture of Figure 1, it still will signal the points following:<ul><li>the microcontroller MPC can access at will to memory MEM: the easiest way is to provide that this memory is dual-ported and therefore a bus and a bus address AD2 is shown in BD2 data between the microcontroller and memory: but this solution is not required, a memory single access is also possible:</li><li>access by the microcontroller MPC to the memory made using a control signal bus SC2 from the microcontroller, but, as has been said, bus passes through the switching circuit AA: this provision is intended to allow operation of the Closed circuit microcontroller with memory MEM during certain program phases:</li></ul><ul><li>a general switching signal SGA from the microcontroller MPC AA referral.</li><li>Finally, in the general case where requests by external PC systematically pass by the memory MEM before reaching the microcontroller to be interpreted and executed, it is useful to provide for the write commands WR1 from the PC are applied directly to the microcontroller MPC: in this way, the latter may namely that an application has been made and can fetch possibly an instruction to interpret: This is why a direct connection WR1 has been shown between the connector CNC and the microcontroller.</li></ul>

Access to certain areas of memory (some eg chips or certain chip areas) is authorized by the microcontroller MPC based predefined security criteria and according confirmations provided by the security module.

The security module is the chip for example IC component sold by SGS-ITS-THOM under reference ST16612, having incorporated therein memory program you nonvolatile MCOS the company Gemplus. This component has the particularities following: the memory data are invisible for the user because they do not pass on the input-output chip. They are also invisible Optically (masked). The chip includes a microprocessor alone can fetch and process data in memory. The program memory dead are performed by masking. They are therefore not modifiable. These programs do not allow access to all memory areas of the chip. when PIN empowerment is presented on the inputs of the chip, it is processed by the microprocessor which provides in response to enabling or prohibitory, and at no time the nature of the verification processing can be detected on the input / output terminals of the chip.

The procedure is for example follows: inserting the memory card mass in the computer starts operations following: demand from the PC PIN Enabling holder; This code is entered by the user on the PC keyboard according to a communication protocol Standard parallel to a PC. It is transmitted MPC control processor card and retransmitted by it to the security module MPS in a format understandable by it (in principle therefore as standard on the single terminal input / output available on the chip MPS). The module Security checks the PIN and send to control processor control word representing the data state permits (total prohibition, total authorization, partial authorization of certain areas Memory for example). The control processor MPC receives this word in serial form and establishes while on the bus SH the corresponding clearance signals (SHA, SHB, SHC, SHR, SHW ...) that control access to the various memory chips. then control processor returns to the PC a state word indicating that the security procedure was performed and indicating the result of this procedure.

In this system we understand that it is the microcontroller MPC that handles security programs memory card. It defines the permissions and prohibitions, and uses the security module as organ specialized verification of an authorization code confidential. No access security operation is managed by the PC.

The latch circuits and switch CV and AA are wired logic circuits extremely Simple. An example is given in Figure 2 for facilitate understanding of the principle of the invention.

for example it is assumed that access to the various memory chips in reading and writing requires the presence of chip select signals ( "chip enable ") CEa, CEb, CEc for chips A, B, C, respectively, and the presence of read commands RD or WR writing. The CEa signals CEb, CEc form So in this example the contents of the control bus SC leading to the memory MEM.

access requests are made by the external PC in the form of CEA1 signals CEB1, CEC1, RD1, WR1 on the bus SC1. SHA signals, SHB, SHC, SHR, SHW are present on the Enabling bus SH. Each of these signals controls the opening or closing of a respective AND gate: each gates receives a respective control signal. Outputs of these gates constitute the bus SC3 of FIG 1, carrying or not control signals as received PC according to the authorizations given by the microcontroller.

The control signals carried on the bus SC3 are applied to the switching circuit AA which was partially shown in Figure 2.

The switching circuit is controlled by a signal SGA referral. Depending on the state of this signal is transferred to the SC bus (that is to say towards the memory MEM) is control signals from the bus SC3 (eg RD3, WR3, etc.) so the PC under control of the microcontroller, or the control signals (RD2, WR2, etc.) from the microcontroller itself.

For example, for the switching of the signal Playback Control RD, an AND gate receives RD3 and is controlled by the signal SGA; another receives RD2 and is controlled by the logic complement of SGA, and an OR gate receives the outputs of these two gates and provides the RD read signal; this signal is either RD2 RD3 is in the state of SGA.

The action of the locking circuit CV was represented on control signals only, but it will be understood, in accordance with the designed architecture in Figure 1, it can also be exercised on the bit address sent by the PC.

In enhanced security structure, data stored in the memory is encrypted using a secret key. The secret decryption key is not known to the user. It is contained in the security module. On presentation of an authorization code valid, the security module provides the secret key MPC microcontroller can then run a memory data decryption program and forward them to the PC decrypted. This ensures and data stored in the memory can not be copied by a person not usefully authorized. The inclusion of data in the memory can also be encrypted with the same manner encryption key, and again only after recognition empowerment of the user.

Note that we are not out of data in encrypted form as is the case in some security applications, but the data is encrypted stored within the memory card to a copy of the data unusable by someone is not entitled.

This means in particular that even if fraudulently forced the SGA signal or signals RD, WR, for reading the data of the card, these data remain unusable.

of the invention variations are possible: for example, we can predict is that the addresses and data freely pass from the PC to the memory and conversely when the authorization was given, or the addresses and / or data still pass by the microcontroller.

In this embodiment, it was assumed, for convenience of rapid communication with the PC the map of IO is a connector parallel to the PCMCIA standard. But in some case, it is conceivable that the output is on connector flush contact with the ISO standard 7816, with only a few contacts, including one contact O communication mode series. Thus a memory card secure high-capacity standard cards Credit can be inserted into a credit card reader classic on the sole condition that the thickness of the card in the region which is to be inserted is thin enough to enter the drive slot. A map area thinned may be provided if necessary; this zone will the flush contacts to ISO standard 7816.

To complete this description, we can give an example of operation with enhanced security in which certain files from the memory MEM are further protected. Each file is protected associate a certain "signature" that represents this file and that is altered if the file is modified. this signature is made from the contents of the file itself For example this is the concatenation of all bits of the file. This signature is stored in a memory non-volatile, non-accessible by the security module. When the file is to be used (especially where it will serve as executable program by the microcontroller MPC), we will first check there was no alteration of the file. If there has been alteration, it will prevent any use. For this, the First microcontroller will recalculate the file signature (Which they have access); it will request the module security what is the expected signature; then do the compare and validate the use if the signatures correspond. The comparison may also be inside the security module. There can be in the security module as many as stored signatures which files to protect. There is therefore in the module Security an "image" files to protect the memory MEM in the form of a signature file corresponding to the various parties to protect.