EP0224639B1 - Method to control the memory access of an ic card and implementing device - Google Patents

Abstract

A method for controlling memory access to a user area and an initial code area of a main memory of a chip card includes carrying out an internal release procedure with a data comparison of an initial code from the initial code area and a data word from a terminal; firmly coupling addresses of the main memory and of a control memory to each other; marking several storage locations of the main memory as the initial code area with one control bit at a time in the control memory; marking a first code deposited in the associated storage location of the first code area as activated or deactivated with one further control bit at a time in the control memory; generating an initial release signal in a release procedure only if a storage location is addressed by an activated initial code and if agreement with the data word entered by the terminal prevails; and preventing generation of the initial release signal if a deactivated code word is addressed and/or if the respective first code does not agree with the data word, and an apparatus for carrying out the method.

Description

The invention relates to a method for controlling memory access on a chip card and an arrangement for carrying out the method, as described in the preambles of claims 1 and 7.

For cashless payment of goods or for billing services or the like, data-controlled payment systems are known, which are described, for example, in the journal "Betriebsspraxis", B. Bl. 2/1982, page 48. R. Nowak and W. Röder under the title "The chip card - next generation of the automatic card". The cards used in this case have a non-volatile electrical data memory as an essential element, which can be accessed via electrical node clocks on the card surface. A computing unit accesses the memory content each time it is used, which is changed if necessary.

Cards of this type are used in security and access systems, in accounting or registration systems and in debit or credit systems. In order to ensure the widespread use and frequent use of the cards, there are operators of such systems which issue a large number of cards and which offer a wide-ranging network of reading devices and computing systems. To rule out misuse of the data, however, high Security requirements are placed on the card systems. Carrier cards in particular, the distribution of which cannot always be controlled, must be protected against unauthorized use.

This can be achieved by a release operation in which a data comparison is carried out between a personal PIN code word entered by an operator or encrypted by a computer system with a stored reference word. In a further check, the card is identified within a terminal using a card-related code which is stored on the card and in the terminal. In this way, the use of a specific card in one or more specific terminals is checked for its authorization. Depending on the comparison result, access is enabled or prevented. If a card-related secret code is stored in the same number in a large number of cards and terminals, there is a risk that this secret code will also become known to an unauthorized person, who could thus install even valid cards or terminals without authorization.

Protection by means of a card-related code therefore fails if the data becomes known, for example, through betrayal. A safeguard against this, however, is to limit the validity period of circulating cards. However, this restriction requires regular issuance of new cards and is therefore difficult and difficult to handle.

In EP-A1-0 127 809 a monolithically integrable circuit arrangement is described, consisting of a memory with non-volatile, electrically writable and erasable memory cells, a control circuit for reading, writing and erasing partial areas of the memory and a control unit which via the control circuit makes access to a part of the memory addresses dependent on an input operation with a data comparison between stored reference data and code data input from outside, the control unit is designed so that it has a comparator unit for performing comparison operations between a plurality of code data and reference data, that the address space of the memory area containing the reference data is divided into a plurality of first subsets, each defined by a first selection logic, with several addresses each, and that the address lines defining the first subsets are connected to an address control unit, from which a first enable signal can be tapped if at least one address from each first subset has been selected in the course of the comparison operations. If it is necessary for the use of the card, the user inputs one or more individual code words via a data input unit to a computer system for transmission to the circuit arrangement. Such a circuit arrangement can be built into a card which can be coupled to a data input unit. If it is necessary for the use of the card, the user enters one or more code words via a data input unit to a computer system for forwarding to the circuit arrangement. The memory space of the non-volatile memory can be controlled via a line decoder and a block decoder. The block decoder defines a first subset of addresses within the address space. The address lines corresponding to these first subsets are led to the address control unit via a first selection logic. The function of the selection logic can also be taken over by the block decoder. The address lines leading from the row decoder to the memory are also connected to the address control unit via a further selection logic. The address space of the memory can be subdivided into second partial areas which overlap the block subdivision via this second subset of the address lines. In this way, for example, the storage operation can be subdivided into a user data store and a code data store, which in turn are divided into blocks. The code data area can be used to hold the reference data. Its memory content can therefore not be read out via the register. Depending on the application, there is access to the user data memory, for example to write to or to delete, can only be carried out after a successful comparison operation, at the end of which the second enable signal must be generated. Via the address control unit and the selection logic, the circuit arrangement is impressed with which first and second subsets of the address lines have to be selected during an enable operation. If at least one address has been selected for a data comparison in each of the first subsets of address lines in the course of a release operation, and / or if addressing is also carried out in a predetermined sequence, a first release signal can be tapped from the addressing control unit, which together with the output signal the error register is fed to a logic unit. Irrespective of this, an error register is set for each comparison that results in a deviation between the reference data word and the code word. If the access conditions to the address space of the memory have been met and if the comparison unit has determined that all code data and reference data match, the linking unit generates the release signal. This can be linked with control signals that cause reading, writing or deleting the user data area in an access protection.

The invention is based on the object of specifying a method and an arrangement of the type mentioned above, which prevent misuse with the card-related secret data used for identification or authentication protect and limit the validity period of the secret code without restricting the circulation of cards.

This object is achieved in accordance with the characterizing parts of claims 1 and 7, respectively.

The invention is based on the fact that the card chip has logic and a control memory which enables a change in the card-related secret data used for identification or authentication in the chip, which are referred to below as the first code. For this purpose, several of these first codes are programmed in a main memory on the chip. The activation of an address of the main memory in order to program a first code is protected by a second code. If this second secret code is activated, the relevant address of the main memory must be automatically blocked against reading and instead the action on a comparator logic must be released. The second code is to be used as a system secret, neither on the card nor on a terminal nor by the cardholder, but only in a headquarters environment that is well protected against fraud.

For use in a chip card system, several first codes are pre-programmed as a precaution when the chip cards are issued, using the second code. Of these, only a single first code is accessed when the card is used, optionally set in the terminal. The other precautionary codes prepared as a precaution are not subject to fraud risk as long as they are not used in the terminal. If the validity period of a code has expired, the current first code can easily be replaced in the terminals. In practice, the number of these terminals is comparatively small. After changing over to a changed first code, it can also be used in all circulating chip cards and, when reused in any terminal, block an invalid first code simply by writing to the control memory or by deleting it. This reduces the risk that the owners of chip cards can be harmed by unauthorized manipulation of terminals via expired and therefore no longer secret first code words.

Further developments of the invention result from the subclaims.

In the following the invention is further described with the aid of an exemplary embodiment.

The figure shows a memory arrangement with a logic unit for securing access.

The arrangement of the figure has a memory arrangement 1, a row decoder 2, a comparator 4, a data register 3 and a logic unit 5. The memory arrangement 1 is composed of a main memory 11 with a large number n of memory locations which can be addressed word by word, a control memory 13, the memory locations of which are assigned to the memory locations of the main memory 13 and can be addressed together via n address lines A, and a further independent area (second code area) 14) together. The main memory 11 is divided into a user area 15 and a first code area 16 depending on the programming state of the control memory 13. In the example shown, this has memory locations with addresses A1, A2 to AK. The addresses of the user memory 15 are A (K + 1) to An. The data register 3 for input and output of data in the memory arrangement is for the word length of the main memory 11 and the second code area 14 and additionally for the width of the control memory 13 designed. With a word length of m bits for the main memory 11 and 2 bits for the control memory 13, it must therefore take up m + 2 bits. Between the data register 3 and the common input-output of the main memory 11 and the second code area 14 is the m-bit wide data comparator 4 for comparing a memory content with a register content.

The control logic 5 - in the example shown here - consists of two flip-flops 6 and AND and NOR gates. It generates an enable signal F1, which controls the write-read and erase access to the main memory 11. Another enable signal F2 controls the writing of a control bit B2 in the control memory 13.

The function of the entire arrangement is described below using examples. For this purpose, it is assumed that a first code, which is already deactivated, is stored in the first memory location (address A1) of the first code area. The second memory location (address A2) contains a first code that is currently used for the user memory accesses. As a precaution, further first codes are stored in the remaining memory locations (address AK), which are not yet needed during the current memory accesses, but which are available in the second memory location if the code is deactivated. The number of such precautionary stored first codes depends on how often a code change can be expected.

The control memory 13 preferably has two bit positions, each with a control bit B1 or B2, for each memory address A1 to An. You determine whether the associated memory locations in the main memory 11 as user memory 15 (B1 = 1 and B2 = 1) or as the first Serve code memory (B2 = 0), and whether it is a valid first code (B1 = 1) or a deactivated first code (B1 = 0).

Assuming that a m-bit wide data word taken over from the terminal and stored in the data register 3 authorizes access to the user memory 15, the comparator signal K will be logic 1 after a comparison with the current first code stored under the address A2. As a further prerequisite for access to the user memory 15, it must be ensured that a current first code and the main memory 11 and not the independent area 14 were actually used for the comparison. This check is carried out, on the one hand, using the control bits B1, B2 via a NOR gate 17 and, on the other hand, via the address lines A on a NOR gate 20 and then also via the NOR gate 17. If all of these conditions exist, the control signal T1 is also present to logic 1 and the enable flip-flop 6 is set via an AND gate 22. The Q output of the enable flip-flop is linked to the output of the NOR gate via a NOR gate 18 and the enable signal F1 assumes a log.1 level.

So if the enable flip-flop 6 is set, reading or another application of the user memory 15 is possible.

However, if at least one of the conditions described above is not met when checking the data word specified by the user, the release signal F1 is not generated and access to the user memory 15 is not released.

The activation of a storage area as storage space for a first code takes place using the second Codes 14 by writing one or more bits in the control memory 13. In the present example, it is the control bit B2. Activation as a code word (B1 = 1, B2 = 0) blocks reading, enabling for comparison operations and protection against changes by writing or deleting. A valid first code can be blocked without using the second code. In the example, control bit B1 assumes the log.0 state.

In the case of a memory 1 of the E²PROM type, the deactivation can also be carried out directly by deleting (state log. 1) the control bit B2 in the control memory 13 together with the first code word which has become invalid. In this case, deletion must be possible without using the second code, while the deactivation of a code word by control bit B1 can also be made dependent on the application of the second code.

A control memory 13 written with a first code is only deleted together with the associated first code that has become invalid. This prevents unauthorized deactivation of preprogrammed first code words from making them readable.

Writing the control memory 13, in particular the control bit B2 for converting a user memory 15 into a first code memory 16 requires the activation of a second enable signal F2. After a positive comparison of an externally entered data word with the second code word from the second code area 14 in the comparator 4, a second enable flip-flop 7 is set when the second code area 14 is activated via its address T2.

The two enable flip-flops 6, 7 are reset when the arrangement is switched on via a reset signal POR.

Finally, the essential features of the exemplary embodiment are listed again. Depending on the programming state of the control memory 13, the main memory 11 is either a user memory 15 or a first code area 16. In the first case, the control bit B2 = 1. In the second case, the control bit B2 = 0 by writing using the code in the second code area 14. There are deactivated first codes, which are identified by the control bit B1 = 0, and which are only converted back to a user area by deletion (status log.1). A memory release obtained by the first code always refers to the part of the main memory that still acts as a user area due to the control bit B1 = 1. For the first code area 16 (control bit B2 = 0), reading or changing - with the exception of complete deletion together with control bit B2 (B2 = 1) - is not possible without the second code.

Claims (8)

1. Method of controlling a memory access to a user area (15) and a first code area (16) of a main memory (11) of a chip card, an internal release procedure being carried out with a data comparison of a first code from the first code area (16) and a data word from a terminal, characterised in that the addresses (A) of the main memory (11) and of a control memory (13) are permanently associated with one another, in that a plurality of storage locations of the main memory (11) are marked as the first code area (16) with in each case one control bit (B2) in the control memory (13), in that a first code deposited in the associated storage location of the first code area (16) is marked as activated or deactivated in each case with one further control bit (B1) in the control memory (13), in that a release signal (F1) is generated in a release procedure only when a storage location is addressed with an activated first code and when these memory contents match the data word input by the terminal, and in that the first release signal (F1) is not generated when a deactivated code word is addressed and/or when the respective first code does not match the data word.
2. Method according to Claim 1, characterised in that a second release signal (F2) is generated only when a second code deposited in a second code area (14) is addressed and when this second code matches an externally input data word, and in that a programming of the control memory (13) for a, at least partial, conversion of the user area (15) into a first code area (16) can be carried out only after generation of the second release signal (F2).
3. Method according to Claim 2, characterised in that activated first code data can be deactivated, blocked or erased without using the second code data.
4. Method according to one of the preceding claims, characterised in that at least one second bit (B1) is written into the control memory (13) for deactivating first code data.
5. Method according to one of the preceding claims, characterised in that an address-associated storage location in the first code area (16) and in the control memory (13) are erased together.
6. Method according to one of the preceding claims, characterised in that, for reactivating a storage location of the first code area (16) as a user area (15), the bits written in the control memory (13) are erased together with the first code data which have become invalid.
7. Apparatus for carrying out the method according to Claim 1, having a first code area (16) in a memory arrangement (1) with a plurality of storage locations for receiving a plurality of first code data, and an arrangement (4) for comparing the first code data with an externally input data word, characterised by a control memory (13), the storage locations of which are associated in terms of addresses with the storage locations of the first code area (16), and by a release logic means (5), at the output side of which a release signal (F1) can be picked up at least only when the code data contained in the associated code area (16) have been marked as "activated" by the contents of the control memory (13) and when the comparison between the first code data and an externally specified data word has been successful.
8. Apparatus according to Claim 7, characterised by a second code area (14) independent in terms of address from the other memory areas for receiving second code data, and by a release logic means (5), at the output side of which a further release signal (F2) can be picked up for programming access to the control memory (13) only after a successful data comparison between the second code data and an externally input data word.

Images