Multifunctional IC-card

Field of the Invention

The invention relates to the integration of multiple applications on a smart card.

State of the art

As data carrier cards or smart cards today are portable cards, usually approximately in credit card format, and preferably made of plastic or metal, designated therein integrated electronic chip. A distinction between simple memory cards (also known as a memory chip cards or memory cards are) and intelligent data carrier cards (also multifunctional chip cards, or smart cards called), which has its own processor to control the data stored on the chip of the data carrier card in addition to a storage area Data. This allows a better protection of the data and resulting in an improved functionality of the smart card. Simple memory cards generally permit only a writing and reading of data. Smart Disk cards still also have functions for structuring the data to locate the data for data management and protection of data.

Typically, a chip card contains a chip, on which a microprocessor and a memory are integrated. The memory is further divided into a plurality of individual areas, which are implemented differently depending on the function.

As a first memory area, the smart card contains a non-volatile and non-rewritable memory, which is generally described as a ROM (Read Only Memory) pronounced, and will be referred to hereinafter also as ROM. The ROM generally contains the operating system of the chip card. in ROM programs Furthermore example be stored, have the general functions such. convert a data stream encoding, or for performing an input / output with a vending machine (z. B. by means of a 'handshaking' procedure with an ATM) provided are.

As another storage area, the smart card in a non-volatile, rewritable memory, which is generally referred to as EEPROM (Electrical Erasable Programmable Read Only Memory) or EPROM (Electrical Programmable ROM) or as OT / PROM (One Time PROM) pronounced. For simplicity, will be referred to hereinafter, the non-volatile writeable memory as EEPROM, without this being a limitation of the non-volatile writeable memory is meant only EEPROMs. In the EEPROM application programs for use with the smart card are stored in general.

Finally, the smart card still has generally a volatile, writable memory, which is usually as a RAM (Random Access Memory) to be pronounced and hereinafter referred to as RAM. The RAM serves as a working memory for the microprocessor of the chip card, in particular for the intermediate storage of data.

The operating principle of the smart card will be explained in the example of a cash smart card. After inserting the smart card in an ATM, the microprocessor of the smart card is connected via the smart card contacts on the machine and put into operation. For data exchange ( 'handshaking'), the chip card sends in a first step, a random number to the machine. The machine is encrypted in a second step, this random number and sends it as an encrypted number to the smart card back. In a third step, the IC card decrypts the received number with the aid of a key, and compares the received result using a pre-calculated result. The random number and the decrypted calculations this in memory of the chip card (RAM). The encryption key, however, is stored in ROM, since the key must be specially protected to prevent tampering.

In a fourth step, the machine sends a random number to the smart card, which in turn encrypts the smart card in a fifth step and returned to the machine. Decryption on the machine side is similar in a sixth step, the third step. When the process up to this point successfully passed, the smart card and the machine are ready for data exchange, the exchange of data generally is done with encrypted data. For this, a corresponding, stored in the smart card application is invoked. As an application, a Geldnachladen is to be performed with a certain sum here in this example. The machine asks for this by the chip card, which application should be carried out, and the smart card responds to this: "reload money". Furthermore, the machine asks for the sum that is to be loaded and gets called the desired amount in response from the smart card. At this point, a command is issued by the application program on the smart card, to describe a corresponding area in the EEPROM again with the desired cash sum.

This example makes it clear that the application program after his call the 'violence' on the smart card, thus also about the data stored on the chip card takes over. To date, only one application is implemented on each smart card. However, if several application programs are loaded on a smart card, a protection must for those applications that involve sensitive data, be guaranteed, so that neither this sensitive data, even possibly the entire application program, can be read. The problem with the use of smart cards with several application programs (the so-called multi-function or multi-functional smart card) that the operator of an application (eg. As a bank), access to the application program must be given. Has he, however, via the application program once access to the chip card obtained and is thus allowed him by the application program, the disposal of the chip card, it can be "freely" on the smart card. He can, if he intends to write his application program so that the program can exercise alongside the imaginary function other activities without the owner or user of the smart card is noted, or can remember. Here, the operator of the application program can also get the secrets of other applications out such. B. secret key or the nature and extent of the activities of the other application programs. Conversely, another operator of another application program or a masquerading as such, look into the secrets of other applications and modify its application according to load z. B. by the knowledge of how a cash application money abusive on the map.

From the IBM Technical Disclosure Bulletin, Vol 32, No. 5a, October 1989, pp 416-417, hereinafter called TDB document -.. Discloses a memory protection for smart cards. The memory of the chip card is for this purpose subdivided into a protected and an unprotected area, located in the protected area, the operating system and special keys are, while in the unprotected area, a number of application programs can be stored. The memory is monitored by an address decoder. The address decoder outputs a "true" signal when the address is on the address bus within the monitored area. When the application program attempts to gain access to the protected memory area, this is recognized by the address decode unit, and outputs a non-maskable interrupt signal to the microprocessor. The microprocessor then deletes immediately loaded in the register data. In the protected area of ​​memory can thus only the operating system itself access. Application programs thus do not have access to the data stored in the protected memory area key and the operating system. The problem with this solution, however, that only the operating system or specific data to be protected, such as keys, can be protected against unauthorized access to the application programs on the smart card. Among themselves, however, the application programs can access completely undisturbed each other so that no mutual protection exists.

Summary of the Invention

The object of the invention to enable the integration of multiple applications on a smart card without the data stored on the smart card application programs have access to each other. The object of the invention is achieved by the independent claims.

According to an integration of multiple applications on a smart card through a separation and isolation of the individual programs with each other.

In a first embodiment of an integration of a plurality of mutually independent units are each composed of a processor unit and a memory unit. Each of these independent units substantially corresponds in structure and function to the chip of a conventional chip card with the appropriate security and encryption system. A communication of these independent units with the outside world, and possibly also with each other on the chip card is performed via a control unit, the 'managed' the individual independent units. A communication of the independent units with one another can take place only through the respective processor units, so that can not be accessed by bypassing the corresponding processor unit on the connected storage units.

The integration of several separate units on the chip card according to the first embodiment allows a simple and safe coexistence of multiple applications, without their being able to influence each other or to perform an unauthorized access to each other. A smart card with, for example, four independent units so lets at least four independent applications with the same physical chip card at ensuring maximum safety.

Since the processors for each of the independent units may be the same pronounced, and also generally contain no information or secrets and only the corresponding memory areas for each application are different and may contain secret information, an integration of the processors of the independent units would be desirable. Also, an integration of the processors would mean a single processor on the smart card a significant reduction of the cost and the space requirement on the chip as the processor part generally requires more area on the chip as the memory section. However, such integration leads again as described at the beginning, that have an influence and an unauthorized access to the applications must be ensured among themselves in the same problems.

According to the invention the separation of different applications carried out on a chip card having a processor by inserting one, preferably hardware-based, separation of the application parts in the memory area of ​​the chip card. The separation causes each application can only access a definable range in memory, and that accesses outside of the predetermined memory area for this application can be prevented. Preferably, the predetermined access area of ​​an application to the memory area required for storing this application, supplemented by a possible buffer area defined. Furthermore, the access to areas of memory can be made possible, containing generally accessible data or operating system data, eg so general features may be used by the operating system of the smart card.

When accessing an application on a storage area outside the allowable for the application memory area, takes place, preferably a non-maskable (non-maskable interrupt), interrupt signal, which then as a blocking of the smart card or to a resetting of the application, ie the application is can before the first step in the 'handshaking' with the mission of the random number, rerun. In another process, a storage area (for example, in the EPROM) may be provided, wherein it is noted that application had tried to access addresses outside the area provided for it. This region can then be queried, so that a safety check of the applications is made possible. Instead of the non-maskable interrupt can also be the storage area outside the intended area of ​​application are disabled, so that access to this is not successful, and as returns only one or ones Nullen- chain.

Preferably, the separation of applications is performed using an application table according to the invention. The application table stores the beginning and the end of the memory area in which a specific application is stored or expires or may occur - so must have access. Each application gets the corresponding storage area, preferably fixed, assigned, eg when programming the application. The application table includes information about a start address and an end address of a particular application. A call to a particular application, the beginning and the end address of the application is loaded in the designated start and tail register from the application table. Using a Adreßvergleiches continuously monitors whether the application has left the predetermined storage area or not. Exits the application the assigned to them by the start and end address range, for example by providing an address bus as the next address an address outside of this range, preferably a non-maskable interrupt signal that the current program of the application and its execution is triggered, interrupts. A non-maskable interrupt signal is meant a non-disconnectable or repressible by the application program signal. This ensures that the application program operates in a closed environment similar to the environment in a smart card with only one application.

Unlike the aforementioned TDB document can be registered in the application table several storage areas dynamically and thus protected from unauthorized access. However, according to said TDB document must the area to be protected are fixed and the rest of the storage area, which can not be protected in itself remains freely accessible, so that applications are not separated from each other in this area, and thus can have access to each other. According to the teachings of the invention can be in contrast, a plurality of memory define which can be dynamically activated so that an activated area is freely accessible, but the non-activated areas remain protected.

The start and tail register are loaded when a respective application with the appropriate start and end address of the memory area to be activated. The memory area in which the application can run is defined as dynamic.

It is to be understood that the start and end addresses of the respective memory areas should be registered in the application table such that a redefinition of these addresses through the, or another application is not possible. Therefore, the set of addresses in the application table is preferably carried out by a fixed programming in the operating system, which determines the address from the content of the application table occupied at load time of application. This process can be performed automatically and independent of the application. From the occupied addresses the new start address can be calculated. The end address then results from the size of the application. This process is transparent to all applications and firmly secured in the operating system and are therefore no targets for possible tampering.

For separation of the application in the memory of the chip card can be used instead of the application table also hardware-based agents, which are preferably dynamically loaded with a particular application and separate storage areas of applications from each other dynamically. As such means may be, for example, register bits that identify and activate the selected application. Also, a plurality of separate memory areas can be connected via a Selektorbaustein to the processor. The control of the selector is preferably carried out by setting coding bits. Managing and storing the allocation of the coding bits or register bits to each application must be an extra Reported storage medium, similar to the application table. This must be done transparent to all applications.

In a further embodiment of the invention, a separation of the applications with the aid of a multiplexer or other electronic circuits which are suitable is made to turn off a certain number of receiving input signals in each case a selected to the output. A processor of a smart card is here connected to such a multiplexer which in turn is connected to a plurality of storage areas and are dynamically selectable via the multiplexer. The in memory areas each stored application programs can occupy the same address space, that is, all application programs can start at the same address. This facilitates the compilation of application programs. The management of applications is simple, it is the programming of applications on separate smart card closer. The multiplexer has vozugsweise on a register that can be dynamically loaded and makes a corresponding portion of the plurality of storage areas to the processor either accessible or locked. This embodiment corresponds to the image of plurality of chips on a single smart card, wherein the processor is used several times. Switching between the memory areas via the multiplexer corresponds to the electronic withdrawing and replacing a respective smart card or memory card.

The invention thus enables a secure and easy deployment of multiple application programs in a smart card without the implemented application programs have access to one another or may influence each other.

It should be understood that certain exceptions for access to the memory or on certain memory areas are generally allowed, such as so general features may be used by the operating system or data that do not need to be protected to read.

The invention has particular application for multifunctional smart cards, and only allows their safe applicability in accordance with the prescribed safety conditions.

Further advantageous embodiments of the invention can be found in the dependent claims.

DESCRIPTION OF THE DRAWINGS

For further explanation of the invention embodiments are described with reference to the drawings in the following. Functionally identical elements should bear like reference numerals.<dl id="dl0001"><dt>Fig. 1</dt><dd>shows a first embodiment of the invention a smart card for receiving a plurality of applications,</dd><dt>FIG. 2</dt><dd>shows the architecture of a further embodiment of the invention with a single (common) memory, and a (common) processor,</dd><dt>Fig. 3</dt><dd>shows an inventive arrangement with register bits, represented for the memory shown in FIG. 2,</dd><dt>Fig. 4</dt><dd>shows an inventive arrangement according to FIG. 3, wherein the extended protection instead of a one-bit request a combination is implemented by a plurality of bits as a combination of requirements,</dd><dt>Fig. 5</dt><dd>shows a further inventive arrangement for separation of different application programs, wherein a processor of a smart card is connected to a multiplexer, which in turn is coupled to a plurality of storage areas.</dd></dl>

Detailed Description of the Invention

Fig. 1 shows a first embodiment of the invention a smart card 10 for receiving a variety of applications. The chip card 10 has a contact pad 20, which represents the physical contact with the outside world. On the touch panel 20, a control unit 30 connects, which is in turn connected to a number of independent units 40th Each one of the independent units 40 consists of a separate microprocessor 50 and a separate storage unit 60. Each one of the independent units 40 constitutes a self-contained functional unit. The respective storage unit 60 one of the independent units 40 accessible only through the corresponding, associated microprocessor 50 and can by means of corresponding, known in the art, safety procedures are protected. Unauthorized access one of the independent units 40 on another one of the independent units 40, and a corresponding influence from one another can therefore be known by means of the safety precautions for smart cards prevented. In other words, each of the independent units 40 is functionally equivalent to a separate smart card. Each of the independent units 40 can continue to receive at least one application program in its memory 60, preferably each of the independent units 40 each having only one application program.

The control unit 30 is preferably implemented as an electronic switch which is controlled by the machine, communicates with the chip card. This switch has to redirect the data contacts of the selected application in the corresponding independent unit the task. This process is similar to the selection process of several smart card and must not generally be protected separately.

Fig. 2 shows the architecture of a further embodiment of the invention. In contrast to the embodiment in Fig. 1, this embodiment has only one (common) memory 100 which is connected to a (common) processor portion 110 via a data bus 120 and an address bus 130 connected. The processor 110 exemplarily shown in Fig. 2 comprises, in addition to a number not shown here the functional units, connected through the data bus 120 to the memory 100 Betriebssys temcode register 140, which in turn is connected to an operating system-decoding logic 150, on. The processor 110 further includes an interrupt logic 160, coupled to the data bus 120 and address bus 130 to the next-step logic 170 and a program counter 180 which is coupled to both the next-step logic 170 and the address bus 130, to. Other functional units of the processor 110 are not shown for simplicity and mentioned herein.

Further connected to the address bus 130 and the data bus 120, a start register 200, a tail register 210 and an address comparator 220. The initial register 200 and the tail register 210 are further coupled to an application table 230th The address comparator 220 is connected to a Unterbrechungsdekodier logic 240, which in turn is coupled both to the operating system code register 140, the operating system-decoding logic 150 and interrupt logic 160th

In the memory 100 a number of application programs 300, 310, 320 and 330 are stored. Each of the application programs 300 to 330 in this case has a start address and an end address A E, as shown by way of example for the application program 320 on. In the application table 230, these start and end addresses stored in the memory 100 are application programs 300 to 330 stored with a reference to the relevant application program. For example, the application program 320 is called, the start address A of the application program 320 of the application table 230 in the initial register 200 and accordingly, the end address E of the application program 320 of the application table 230, loaded into the tail register 210th

During the processing of the application program 320, the address comparator 220 compares the address bus 130 applied to the memory 100 for the addresses with the in the initial register 200 and the tail register 210 stored addresses. Recognizes the address comparators 220 a voltage applied to the memory 100 on the address bus 130 address that is described outside, through the stored in the initial register 200 start address A and the information stored in the tail register 210 end address E, the address range, thus initiating the Adreßvegleicher 220 a signal the Unterbrechungsdekodier logic 240, which in turn acts on the interruption logic 160th It is to be understood that both the Unterbrechungsdekodier logic 240 and that acting on the interrupt logic 160 signal represents a non-maskable interrupt signal, can be suppressed by the application 320, for example not.

Preferably, the data stored in the application table 230 start and end addresses of the application programs 300-330 are permanently stored when the application programs on the smart card in the application table 230 and can no longer be as modified by one of the application programs 300-330. This is preferably done by a baking of the addresses in a memory area of ​​the application table 230. The baking of the addresses is a hard-coded process which is not accessible and always writes the new address as a result of calculations of occupied addresses. This ensures that no overlap of the memory areas are possible. This process is preferably hard coded into the operating system and can only be initiated. It is completely transparent and can not be manipulated.

By the application table 230 in connection with the initial register 200, the tail register 210 and the address comparator 220 provides a safe separation of the application programs 300 to 330 to each other is ensured in the memory 100th The application table 230 is preferably used as an extra memory in EEPROM, or OT-PROM of the smart card, for example constructed, and has its own, only access mechanism.

Instead of the address comparator 220, which continuously monitors the applied on the address bus 130 addresses, a decoder can be employed which decodes the one permitted by the start and tail register, address range and permits. Addresses outside the range are ignored, the effect is as if a 'resorted to nothing' is.

The initial register 200 and the tail register 210 are loaded when you call one of the applications 300-330 from the memory 100 with the associated start and end addresses of the application table 230 and thus represent a dynamic memory protection.

A separation of the loaded in the memory 100 application programs 300-330 may further be achieved with the aid of extra hardware components, for example in the form of register bits that are dynamically loaded with each of the application programs stored. This extra register bits as can the selected memory area in the memory 100 mark and activate. For this purpose, the entire memory area of ​​the memory 100, or according to any part thereof, is divided into blocks, each having a separate "Enable" - or request input have. Instead of activating or deactivating memory ranges with the application table 230 in FIG. 2, the corresponding areas are in the memory 100 to the register bits either enabled or disabled. The setting of the register bits is preferably performed via an automatic mechanism that sets the corresponding bits in the selection of the application. The assignment of the application of the register bits is implemented in a specially protected memory area, in accordance with what has been said for the application table and organized. If a register set, can not be read from the corresponding region in the memory 100th

Fig. 3 shows such an arrangement with register bits illustrated for memory 100 of FIG. 2. The memory 100 is here in accordance with the application programs 300 to 330 divided into individual memory areas. Each of the individual memory areas can now be activated or deactivated by means of a plurality of request registers 350th In the example shown in Fig. 3 only the memory area for the application program 320 by setting a corresponding register bits in this storage area associated request register 360 is activated.

In the example in FIG. 3 is to be understood that the request register 350 may each an entire application programs 300-330, or only portions thereof enable, or disable. A similar fine subdivision of the memory areas of the memory 100 may be required depending on the application, for example, can take an application more bits to complete. The number of bits specifies the size of the application.

The separation of the application programs in the memory of FIG. 3 is simple to implement, but can be changed by intentional or unintentional voltage shock, for example by brief power disturbances, so that the register bits in the request registers 350 unintentionally 'tilt' can. Instead of individual register bits therefore bit strings for the activation or deactivation of the request registers can be used 350th

As additional protection can be implemented by a plurality of bits as a requirement combination instead of a one-bit request a combination. Fig. 4 shows such an arrangement. A request combination 400 in FIG. 4 is connected via a decoding logic 410 to the memory 100. Through a combination of zeros and ones, the problem can be avoided that the individual bits not tilt during voltage disturbances to zero or to one. Belonging to a selected application bit strings are loaded when the application with a predefined pattern that is preferably made of a combination of ones and zeros. Only the decoding of the correct pattern allows access. Such a pattern can only be very unlikely randomly generate.

Fig. 5 shows a further inventive arrangement for separation of different application programs. A processor 500 a smart card is here connected to a multiplexer 510 which in turn is coupled to a plurality of storage areas 520, 530, 540 and 550th The individual memory areas 520 to 550 are selected dynamically via the multiplexer 510 in this embodiment. The in memory areas 520-550 each stored application programs can occupy the same address space, that is, all application programs can start at the same address. The multiplexer 510 preferably includes a register 560, which can be dynamically loaded and makes a corresponding portion of the plurality of storage areas 520-550 the processor 500 either accessible or locked. The switching between the storage areas 520 to 550 by means of the multiplexer 510 corresponds to the electronic extracting and replacing a respective chip card.