EP0919026A1

EP0919026A1 - Method for modifying code sequences and related device

Info

Publication number: EP0919026A1
Application number: EP98930843A
Authority: EP
Inventors: Azad Nassor
Original assignee: Bull CP8 SA
Current assignee: CP8 Technologies SA
Priority date: 1997-06-13
Filing date: 1998-06-12
Publication date: 1999-06-02
Also published as: US6536034B1; FR2764716A1; JP2000500897A; FR2764716B1; JP3563412B2; WO1998057255A1

Abstract

The invention concerns a device for modifying code sequences written in a medium memory (2) comprising a central unit (1), said memory containing a main programme executable by the central unit (1) which also comprises a second non-volatile programmable memory (3), and a third working memory.(4). The invention is characterised in that a rerouting table TAB_DER contained in the second programmable memory contains at least one field containing a new code sequence reference data, rerouting means for delayed rerouting of the executed code sequence towards the new code sequence written in one of the three memories and means in the new code sequence for returning to a point of the sequence before rerouting.

Description

METHOD FOR MODIFYING CODE SEQUENCES AND

ASSOCIATED DEVICE

The present invention relates to a method for modifying code sequences and the associated device.

The present invention relates to computer programs and in particular those intended to be recorded in a medium that cannot be modified, at least easily. These media are integrated into a computer system comprising inter alia, a central processing unit, a working memory, a non-volatile memory and input / output means. More specifically, this computer system can be incorporated into a smart card. In this case, the card contains a circuit comprising at least one microprocessor, a read-only memory containing a program and possibly data, a working memory and a programmable non-volatile memory. Advantageously, the circuit is designed in a monolithic form. Non-volatile memory can store data and / or code; thus, the microprocessor can execute this code in the same way as that recorded in read-only memory. There are therefore two types of memory in a card; the content of the first is entered when the circuit is manufactured and cannot be modified. The content of the second is blank at the start, the values will be entered during the normal use of the object.

Today, smart cards can technically meet many needs. The program incorporated in the card, also called "operating system", allows the functions of the card to be adapted to its end use. Currently, the operating system is stored in a ROM memory which is burned during the development of the integrated circuit. Modifying the program to meet new needs is a time-consuming process that poses a big problem when the customer is in a hurry. In addition, this operation is very expensive; this is why many "small" customers who would like to buy a few thousand cards are discouraged and often content themselves with a card that only partially meets their expectations. One solution would be to use an existing mask and add the functions requested by the client in the programmable memory, or to modify the existing ones in ROM.

The possibility of entering and executing an additional code in programmable memory offers the advantage of being able to easily add new functions to an old program or to adapt old functions to specific needs.

Patent application FR 96/05454 of the applicant describes a particular mechanism for diverting a program during the execution of certain instructions. The previous invention consists in establishing at certain locations of the ROM memory, by respective instructions, question marks and orientation points. A question mark is referenced by a number and allows access to a routine in the programmable memory if there is a code sequence corresponding to the address indicated by this number. If so, a flag is set and a diversion address is stored in RAM memory. An orientation point is active if a question mark has previously been executed. In the favorable case, the diversion is triggered by making the normal program jump to the programmed address. The code sequence to be executed can be in programmable memory or in read-only memory.

This embodiment has several problems, however, if numerous modifications in the course of the program must be able to be taken into account. In the latter case, a large number of orientation points must be implemented in the ROM. At the extreme limit, if one wants a great adaptability, the program contains more code allowing to carry out diversions than of code constituting the main program. The multiplicity of these points is a major drawback if the size of the read-only memory is limited. On the other hand, the execution time is increased in proportion to the number of points. If the number of diversion points is limited to take account of the constraints, the embodiment loses flexibility, since it does not make it possible to divert a program during the execution of any instruction.

The subject of the present invention is a device making it possible to correct certain operating anomalies in a frozen program and thus allow correct operation, or to easily add functionalities to an existing program, while optimizing the sequence of code to be written.

This object is achieved by the fact that the device for modifying code sequences written in a memory of a medium comprising a central unit capable of executing these code sequences, said memory containing a main program executable by the central unit which also includes a second non-volatile programmable memory possibly containing new sequences of executable code, and a third working memory, is characterized in that a diversion table TAB_DER contained in the second programmable memory contains at least one field containing a datum of reference of a new code sequence, diversion means allowing the deferred diversion of the code sequence executed towards the new code sequence written in one of the three memories and means in the new code sequence allowing the return to a point of the code sequence executed before the diversion.

According to another object, the present invention can interrupt the normal execution of a program before the execution of any instruction, even with a limited number of orientation points.

This goal is achieved by the fact that the diversion means consist of orientation instructions (lORi) that can be activated and implemented. beforehand in the memory containing the code of the main program, each orientation instruction being associated with a reference i of the diversion table TAB_DER written in programmable memory.

According to another particular feature, each activated orientation instruction (lORi) triggers the execution of a new sequence of code comprising:

means of reading from the table TAB_DER of the programmable memory a time delay ΔTi corresponding to the reference of the orientation instruction, this time delay making it possible to defer the triggering of an interruption which effects a connection to a sequence code news whose address (Adri) is indicated in the table, in association with the delay time,

means of memorizing the address (Adri) in a memory of the device and

means of launching a time counter of the device to count down the time necessary for the delay time delay of the connection.

According to another object, the present invention makes it possible to mask certain so-called sensitive operations carried out by the central unit.

This object is achieved by the fact that the device for modifying code sequences comprises a second table TAB_SEC stored in the memory of the device and associating with each point (i) diversion a time interval [ΔTmini; ΔTmaxi] associated with the delay time ΔTi prior to the execution of a new code sequence, and means of verification that the delay time is authorized by the associated time interval provided by this table.

According to another particular feature, the device for modifying code sequences comprises means allowing the delay ΔTi delay time delay to be offset by the value of the time interval [ΔTmini; ΔTmaxi]. According to another particular feature, the code sequence device comprises means for triggering an error message when the time delay ΔTi is in the time interval.

According to another particular feature, the code sequence device comprises, consecutively at the end of the time delay (ΔTi), when the counter reaches the zero value, means for triggering an interruption, means for memorizing the current value of a PC program counter register in a stack, then means for diverting the program to the address defined in the part of the ROM memory containing interrupt vectors, which provide the address of the start of the code sequence of the interruption, means of checking that the value of the PC program counter register Val_PC stored in the stack is not a sensitive sequence address value contained in a table TAB_SEC, and means of modifying the course of operations. According to another particular feature, the verification means test whether the value of the program counter register is contained by TAB_SEC in the interval [Adrdeb_i, Adrfin_1], corresponding to an interruption of the program during a sensitive sequence and the means of modifying the course of operations of the card return a message indicating that its security has been reached and is blocked, or the verification means test whether the value of the program counter register Val_PC is contained in the interval] Adrfin_i, Adrdeb_i + 1 [corresponding to an interruption of the program during a non-sensitive sequence and the means of modifying the flow of operations authorize the program to then execute the new code sequence, the start address of which has been stored during the processing of the orientation instruction (lORi).

According to another particularity, the device for modifying code sequences comprises a frequency source for the counter different from a frequency source allowing the central unit to execute the program, the value of the programmed delay time (ΔTi) in the TAB_DER diversion table being calculated to allow the program to be interrupted at a determined address, the TAB_DER table comprises for each value of the timeout delay, an additional element containing this determined address and means for comparing the address of the interrupted instruction by the interruption, to that indicated in the table, and to cause an alarm.

According to another particular feature, the code sequence device comprises means for triggering an alarm to block the medium and indicate an attempt at fraud by writing to the memory.

According to another particular feature, each new sequence of code ends with an orientation instruction to reload the counter with a new time delay value (ΔTi).

A final object is a method of modifying frozen code sequences written in a medium comprising a central unit and a memory.

This object is achieved by the fact that the method for modifying frozen code sequences written in a medium comprising a central unit and a memory consists in providing in at least one fixed code sequence, at least one orientation instruction (lORi) , making it possible to divert the execution by a deferred interruption of a time delay of the program contained in the memory of towards a determined address, by a diversion table TAB_DER, according to a reference i associated with the instruction of orientation and within a time delay, determined by the content of a table row corresponding to the reference i of the orientation instruction, a new sequence of code executable during the interruption generated at the end of the time delay being located at the address contained in the table (TAB_DER).

According to another particular feature, a step triggering the interruption is preceded by a verification step and the delay time is not not included in an interval defined by a second table TAB_SEC called safe written in the non-volatile memory of the support.

Other characteristics and advantages of the present invention will appear more clearly on reading the description below made with reference to the appended drawings in which:

FIG. 1 represents a schematic view of the electronic circuits necessary for the implementation of the present invention;

FIG. 2A represents the time diagram of the code sequences necessary for the implementation of the present invention;

FIG. 2B represents the flow diagram of the code sequence corresponding to the activation of a diversion point;

FIG. 2C represents the code sequence corresponding to the processing of the interrupt generated by the counter;

figure 2D represents the diversion table TAB_DER;

FIG. 3 represents a time diagram of the nesting of the code sequences of the application program for processing the orientation instruction and for processing the interrupt, in an example of application of the invention;

FIG. 4A represents the security table TAB_SEC;

FIG. 4B represents the modification of the flow diagram of the diversion sequence in the case of the use of a security table jointly with the diversion table of the invention.

FIG. 5 represents the flow diagram of the program for writing to the diversion table. The present invention will now be explained with the aid of an example which is in the field of "smart cards" and more particularly microprocessor cards. These cards generally have an integrated circuit, the general diagram of which is shown in FIG. 1. This circuit has a Central Unit (1) connected by an address and data bus to a non-volatile memory, for example of the ROM type ( 2), containing the main program, a non-volatile EEPROM type memory (3), a RAM working memory (4), an I / O input / output interface (5) and a counter (6). The counter can generate an interruption and thus interrupt the normal course of the program executed by the Central Unit. The interruption is associated with a vector. The latter is the start address of the interrupt routine. It is the address of the first instruction in the sequence which manages the interrupt. Integrated or external to the counter, a means of inhibiting the interruption makes it possible to delay and even cancel the interruption. This will then be taken into account later or not at all.

The programmable memory (3) is divided into several parts. A first part, called the system area, contains system information that cannot be read from the outside, this part notably contains the values of the pointers making it possible to delimit each of the other parts of the memory. A second part (32) is denoted data area, it is accessible from the outside and mainly contains user data. A third part (33) contains an orientation table TAB_DER, this table contains elements with identical formats composed of at least three fields (Ref No., ΔTi and Adri). A fourth part (34), denoted sequence zone, contains the code sequences which can be called by the main program from the reference numbers (Ref No.) of the orientation point and the address (Adri) read in Table. It should be noted that in a variant of the invention, the orientation table, or one or more code sequences, can be loaded into RAM working memory rather than non-volatile programmable memory.

The start address, called AD_TAB, of the orientation table

TAB_DER is stored in the system area (31). A specific location is provided to contain this value. The actual writing of this location constitutes in itself an indication that the table is present and that the orientation points can be operational.

The ROM memory (2) which contains, among other things, the main program, is divided into three parts. The first (21) performs the initialization of the program upon power up. The second part (22) contains the application program. The third part (23) contains code

"dormant" whose role is explained below.

When the program arrives at a diversion or orientation point (220), it executes a diversion sequence shown in Figure 2B, which consists of a first step in which the program examines whether an interruption is already in progress. If so, the program is aborted. In the negative case, the program continues with step 2202, in which it examines whether an indicator corresponding to the diversion point i is active.

If not, the program performs an error treatment of the type described in the previous request. In the affirmative, the program continues with the step of searching in the table TAB_DER written in the third part (33) of the EEPROM memory, the value (ΔTi) for programming the counter corresponding to the diversion i and the address of jump (Adrsi).

The next step 2205 allows the loading of the time counter (6) with the time value (ΔTi) given by line i of the table TAB_DER. Then the next step of program 2206 allows the launch of the timer. On certain microprocessors the writing of a new value in the counter causes its activation, and in this case the two steps 2205 and 2206 are confused. After this step, the diversion sequence is reconnected by step 2207 to the next instruction of the program that it was executing when it encountered a diversion or orientation instruction (IOR), materializing a diversion point.

When the counter, launched in step 2206, has elapsed the time (ΔTi) provided by line i of the table TAB_DER, the counter (6) triggers on the microprocessor (1) an interruption which gives rise to the processing of a interrupt sequence (221; Figure 2A). This interruption sequence, the details of which are given in FIG. 2C, begins with a step of possibly stacking the jump context (2210) in the RAM memory (4). Then the processing of the interruption continues with a step (2211) of execution of the new code sequence contained, either in the fourth part (34) of the EEPROM (3), or in the third part (23) ROM, at the address previously stored in step 2204. Then the interruption ends with step (2212) of possible use of the stacked context to return to the main program, that is to say to the following instruction (2212A ) of that executed before the interruption by using, for example, an instruction RTI of return of interruption, either by making a jump (for example, by a JUMP instruction), as represented by the reference 2212B of FIG. 2A.

It is thus understood that by recording a table in the EEPROM, an interrupt sequence in the ROM and a diversion sequence in a volatile memory or not, it is possible to intervene at any point of the program d application stored in the ROM, and modify or add new functionalities by the implementation of the parts of dormant code, or of new parts of code registered in EEPROM for example. The orientation point existed before the program part which we now want to modify. This orientation point has its own reference number, in this case "1".

The TAB_DER table has been entered in programmable memory and the entry corresponding to the reference number "1" is filled in as follows for example:

ΔT1 has been calculated so that it corresponds to the time necessary to interrupt the running of the main program at the desired address Adr_2 (Figure 3). To make this calculation, we take into account the number of instructions to "reach" the address Adr_2 and the counting frequency of the counter.

First, the presence of the orientation table is tested. We said earlier that this can be equivalent to testing whether or not the location containing the start address of the table TAB_DER has been written. Then, the presence of an interruption in progress of the counter is tested. If the counter is in progress, the execution of the diversion point must be prohibited, only the code sequence corresponding to a previous orientation point will be executed. Otherwise, the program searches for the values written in the second and third elements corresponding to orientation point number 1. The values ΔT1 and Adr_1 are extracted respectively from the first and second fields of the element. The data register of the counter is then loaded with the value ΔT1 and, the interruption vector associated with the interruption caused by the counter is loaded with the value Adr _1. Finally, just before leaving the orientation point sequence, the counter is started and the value stored in its data register decreases as a function of time. The value ΔT1 must be determined with great precision, it depends directly on the number of cycles which separates the moment of the executions of the instruction to start the counter and the first instruction that one does not want to execute. If the counter is synchronized with the clock of the Central Unit, it suffices to add the number of cycles of each of the instructions separating the two previously named instructions. If the counter is not synchronized with the same frequency as the CPU, the approximate calculation is difficult.

If the frequency source of the counter is different from that allowing the program to run, then the method of the invention makes it possible, for example, to perform a safety control task. Indeed, the values programmed in the table TAB_DER make it possible to interrupt at a determined address, which address has been indicated as an additional element in the table TAB_DER, and once the interruption active, we can compare the address of the instruction interrupted to that indicated in the table. If they are not equal, then we can conclude that there is a disruption of the frequency sources, perhaps due to an attempt at fraud, and the program can act in the appropriate way (by blocking for example).

A preferred way of implementing the invention consists in developing a table (FIG. 2D) in programmable memory, the first element of this table is the reference number of the orientation point, the second element is a counter loading value and, the third element is the address of the code sequence to be executed.

This table (Figure 2D) has a maximum size of 30 bytes divided into 6 lines of 5 bytes. The first element of the table includes a byte, which allows to install in the ROM code, 255 orientation points, numbered from 1 to 255. The value zero indicates that there is no more value and the end table is reached. The second value is expressed in two bytes, which authorizes 65536 different counter loading values. Finally, the jump address is noted on two bytes, a traditional value for chip card type microprocessors. This address must make it possible to execute sequences of codes written in EEPROM programmable memory as well as code in ROM (dormant code).

We can notice that the sixth line of this table TAB_DER (figure 2D) is at "00", there are therefore, in this case only 5 operational orientation points: The n ° 1, 3 4 (2 entries ) and 6. Orientation points 3 and 6 have the same jump address Adr_3, which means that the program modification is the same for these two points. Three diversion sequences are therefore planned. These rerouting sequences can be stored in the programmable memory and in a part of the ROM code, this "dormant" code can thus be executed using the orientation points.

Another way to manage the orientation table, which avoids the programmer having to store in memory information corresponding to the size of the table, consists in providing an additional field, which contains the address value of the next element of the orientation table. For more details, reference may be made to the patent application referenced above.

Advantageously, a new code sequence can end with an orientation point which makes it possible to reload the counter and therefore to add a new time delay, as shown in the previous table for the reference number "4". This is particularly useful for making very long timers that exceed the capacity of the counter. We then implement in the code sequence, the management of an interrupt counter which is initialized at a certain starting value, this value represents the number of maximum time delays to be carried out before programming in the timer counter the value entered in TAB_DER. Following this last delay, the part of the code sequence relating to the modification of the main program is executed

An example of application of the invention is represented in FIG. 3, in which an application program written in ROM memory can contain a certain number of interrogation instructions (Ni), FOLLOWED by code sequences separating them from the corresponding orientation instruction (IOI), according to the principle of French patent application No. 96/05454 filed by the applicant

These interrogation instructions (Ni) make it possible to determine whether the corresponding orientation instruction (lORi) is active or not, and if it is active, when the program arrives at the orientation instruction, to divert the program to an orientation point (i) or diversion, whose reference number for the orientation instruction (IOi) is i

The execution of the orientation instruction (lORi) triggers several operations. It first triggers the reading of the derivation or diversion table TAB_DER written in area 33 of the EEPROM memory to determine whether, at address i from this table, the values ΔT1 of counter and jump address (Adri) have been filled and in the case where these values are present, the corresponding information ΔTi counter value and Adri jump address, are temporarily stored, for example , in the RAM memory (4) Then, the orientation instruction ends with the launching of the time counter 6

Once the orientation instruction has been executed, the application program continues to run its sequence in order, arrives at the execution of the instruction identified by the address Adr_1 corresponding to the example of executable code appearing in appendix 1, executes the instruction series of this sequence, then arrives at the instruction identified by the address Adr_2, for which we chose to modify the value corresponding value used in the subsequent operation of the instruction of the sequence of the program normally saved in ROM memory by another value. For this, ΔT1 is determined so that the interruption occurs before the program executes the instruction of the address (Adr_2) and the interruption routs the program to a code sequence at the address Adri. Thus, in the example given in the program of appendix 1, we want to replace the value 10 by the value 20 in the multiplication which is then carried out at the address Adr_3.

This is obtained by the code sequence appearing in appendix 2. It is thus conceived that the accumulator B was charged with the value 20 instead of the value 10, which will change the result of the multiplication without having to modify the program written in ROM.

Thus by inscriptions of new sequences of code in EEPROM in the area 34, like that represented in figure 3, in the square 341, by the inscription of a diversion table TAB_DER in the area 33 of the EEPROM (3 ) and, by setting up orientation instructions in the operating system (Operating System) stored in the ROM of the smart card, we will be able to intervene and modify all the instructions at will by choosing the time delay ΔTi and of the intervention address Adri, at which the new code sequence written in one of the card memories will be found.

The beginning of this part of the program in appendix 1 includes the call for an orientation point, numbered "01". Instructions then exist. Then, a particular sequence is described. First, the value of the byte pointed by X is multiplied by the value 10, the result on two bytes is stored in two registers, then the subroutine for writing in programmable memory is executed. The program being frozen in ROM, it can no longer be modified, but it turns out that the value "10" must be changed to "20". We We will now describe how the present invention can solve this problem.

The Central Unit then continues the execution of the main program (PP; figure 3). When the microprocessor will start the execution of the instruction of the address noted adr_2, the data register of the counter (6) initialized at the diversion point with the value ΔTi, reaches the value zero, which triggers an interruption (IT; figure 3) which allows the connection of the Adri address. The instruction "LDB # 01 Od" is therefore not executed. The Central Unit is diverted to the Adri address where we find the code sequence which appears in appendix 2:

This small code sequence described in appendix 2 makes it possible to load the value "20" in the register B which is used for the multiplication, then to return in the main program, ie the address adr_3, immediately after l instruction that you want to modify or not execute. The multiplication instruction at this address no longer takes into account the value "10" contained in the previous instruction in the ROM code, but the value "20" contained in the new code sequence.

The variant of the invention below takes into account security needs. For security reasons, it may be important not to be able to stop the execution of a part of a program by an interrupt. This is the case for example of an authentication with cryptographic calculation and comparison between received and calculated values. Thus, as long as the secret key is in working memory and therefore visible by a diversion sequence, you must not authorize interruptions. This is possible by inhibiting during the execution of a "sensitive" program all the interruptions or at least those of the counter.

The inhibition of interruptions and their reactivation are each carried out by an instruction interpretable by almost all of the microprocessors. These instructions generally modify a bit of the status register of the microprocessor which, as long as it is active, prevents the triggering of the interrupt, and as long as it is inactive, authorizes the interruptions. The presence of an instruction to inhibit interruption in ROM memory before a sensitive sequence has the consequence that the sensitive sequence is definitively protected if the reactivation instruction is placed after the sensitive sequence.

Another method to prohibit the triggering of interruptions during the execution of a sensitive sequence is to test, during the exploitation of the table TAB_DER, and this for each orientation point, the programming value of the timer. A TAB_SEC table is therefore provided in ROM memory or in locked E ² PROM memory which includes for each orientation point of the main program, a value pair [Δ Tmini, ΔTmaxi] defining an interval in which any programming value of the counter is prohibited. Advantageously, the table TAB_SEC can include several couples [ΔTmini, ΔTmaxi] for the same orientation point, as shown in FIG. 4A.

The presence of the table TAB_SEC in ROM freezes the sensitive sequences, as before, while the presence in E ² PROM makes it possible to modify the zones of sensitive sequence until locking by a key.

For orientation points 3 and 5, two time intervals are programmed.

When processing the information in the TAB_DER table, the operating system tests whether the value ΔTi to be written corresponding to the orientation point i does not belong to intervals [ΔTmini, ΔTmaxi]. If this is the case, a sensitive sequence would be interrupted, this being prohibited, the operating system refuses to write and returns an error message. If on the other hand, corresponding to this orientation point, the value ΔTi is not included in the unauthorized time interval, the writing is carried out and the orientation point becomes operational.

In the variant where a security table TAB_SEC is used, the diversion sequence corresponds to FIG. 4B. This sequence comprises, in addition to the steps of FIG. 2B, the following steps, added between step 2204 and step 2205 of FIG. 2B:

a first step 22041, which consists in reading the security table TAB_SEC in line i to determine the interval [ΔTmini, ΔTmaxi], and to verify, for example, that the value ΔTi of initialization of the time counter is not not included in this interval f ΔTmaxi, ΔTmini]. The opposite logic is also possible. If the value ΔTi is not included, we continue with step 2205. If the value (ΔTi) is included, we continue either with step 22043A which allows the display of an error message, or by step 22043B, which executes an instruction making it possible to reload the timer with the value (ΔTi) increased by the interval. This differs from triggering the interrupt in the length of the interval.

This last variant nevertheless makes it possible to trigger the interruptions, but not to be able to intervene on sequences of the application program which must be protected as being part of the secure portions.

For the rest, the diversion sequence continues in the same way as for FIG. 2B.

Finally, the application program or a part of the dormant code can include the writing program which can be called, for example, by an orientation to an initial fixed address, so as to allow by orientation to this program write, the write of the diversion table TAB_DER according to the sequence described in figure 5. This program begins with a step of reception of order of inscription of one or more elements in the table TAB_DER, the elements ΔTi, and Adri having to be written in line i of the element in the table. This step is followed by a test step on the write flag of the ECA table to check whether it is active or inactive. If ECA is active, the program continues with an error message in step 61. In the case where ECA is inactive, the program continues with a step 53 of analysis of each element ΔTi with respect to the corresponding value in the security table TAB_SEC. This step includes a test 54 to determine if the value ΔTi is in the interval [ΔTmaxi, ΔTmini]. If so, the program continues at step 22043B by modifying the ΔTi representing the value of the interval, so as to delay the interruption so as not to fall into the prohibited sequence. A variant shown in parallel consists in sending an error message 22043A. This is represented in step 59 by the operation of replacing

(ΔTi) by the value (ΔTi + x), x being the interval (ΔTmaxi-ΔTmini). In the case where the ΔT is not in the interval or after modification of the value ΔTi, the program continues with step 55, where the flag ECA for writing the table is set in the active state . Once this step has been completed, the program continues with step 56 for updating the diversion table and for writing verification. This verification is carried out by a test represented in step 57, in the case where the test confirms the correct writing, the program continues with the examination of whether there is another element to write, in the negative, the program ends in step 62, if so, the program loops back to step 53.

If the verification test is negative, the program continues with step 60 of positioning the writing flag in the inactive state. In a variant of the invention by the table TAB_DER it is even possible to protect certain parts of codes without hampering the possibilities of modification of the other parts.

A third variant consists in storing in the table TAB_SEC in ROM the start and end addresses associated with each of the sensitive sequences. The address values are easily determined and are not the result of a calculation to determine a duration as previously.

for example

TAB_SEC: where each line represents the start and end addresses of sensitive sequences

Advantageously, the address windows [Adrdeb_i, Adrfin_1] are stored by increasing addresses, this facilitating the reading of the table. Consequently, the values located in the intervals] Adrfin_i, Adrdeb_i + 1 [are address values of the non-sensitive program.

Verification of the interruption of a sensitive sequence is carried out consecutively at the end of the delay time. When the counter reaches the zero value, an interrupt is triggered and the current value of the PC is put in the stack, then the program diverted to the address defined in the part of the ROM memory more commonly called: "interrupt vector ". The designer of the program has taken care to initialize the value of the vector corresponding to the interrupt generated by the end of the counting with the address of the start of the code sequence of the interrupt. Said routine is in ROM, and therefore cannot be modified, for security reasons, it will therefore always be executed.

At the start of said interrupt code sequence, it is checked that the value of the PC: Val_PC stored in the stack (that is to say the address of the instruction that the microprocessor should execute if it does not was not interrupted) is not a sensitive sequence address value. If the table TAB_SEC does not exist or is empty, the test is not carried out and the program directly executes the new code sequence. Otherwise, the routine program extracts the value Val_PC from the stack and searches the table TAB_SEC between which address values it is located.

If the values are of the type [Adrdeb_i, AdrfinJ], the program has been interrupted during a sensitive sequence, the card may return a message indicating that its security has been reached and may block. If the values are of the type] Adrfin_i, Adrdeb_i + 1 [the program was interrupted during a non-sensitive sequence, the program then executes the new code sequence whose start address was memorized during the processing of the orientation point .

Other modifications are also part of the spirit of the invention.

Annex 1

Here below is a part of executable code of a main program, is written in MOTOROLA 6805 assembler:

adr 0 LDX # 01 Load pointer with orientation point number

JSR INS ORT Jump to NOP orientation point

adr 1 LDX # 080H Loading of the hexadecimal value 80 in the pointer X.

LDA, χ Charging accumulator A with the contents of address 80.

BEQ V ZERO Connection if equal zero to V_ZERO, otherwise following instruction adr_2 LDB # 01 Od Charging of accumulator B with decimal value 10 adr_3 MUL multiplication of A by B

STA Reg_H Storage of the content of H in accumulator A.

STB Reg_L Storage of the content of L in accumulator B.

JSR Ecrit_Mot V ZERO JMP Suite

Annex 2

Adri LDB # 020d JMP adr 3

Claims

1. Device for modifying code sequences in a medium comprising a central unit (1) capable of executing these code sequences, a first memory (2) containing a program comprising at least one code sequence executable by the central unit (1), and a second programmable memory (3), characterized in that a diversion table TAB_DER contained in the second programmable memory contains at least one field containing reference data of a new code sequence stored in one of said memories, diversion means allowing deferred diversion from a code sequence of said running program to said new code sequence, and means provided in the new code sequence for allowing, once the new code sequence has been executed , a return to a point of said program code sequence.

2. Device for modifying code sequences according to claim 1 characterized in that the diversion means consist of orientation instructions (lORi) which can be activated and installed beforehand in the memory containing the program code, each orientation instruction being associated with a reference i of the diversion table TAB_DER written in programmable memory (3).

3. Device for modifying code sequences according to claim 2, characterized in that each activated orientation instruction (lORi) triggers the execution of a new code sequence comprising:

means of reading from the table TAB_DER of the programmable memory (3) a time delay ΔTi corresponding to the reference of the orientation instruction, this time delay allowing defer the triggering of an interrupt which connects to a new code sequence whose address (Adri) is indicated in the table, in association with the delay time,

means of memorizing the address (Adri) in a memory of the device and

- Means of launching a time counter (6) of the device to count down the time necessary for the connection delay time.

4. Device for modifying code sequences according to claim 3, characterized in that it comprises a second table TAB_SEC stored in the memory of the device and associating with each point (i) diversion a time interval [ΔTmini; ΔTmaxi] associated with the delay time ΔTi prior to the execution of a new code sequence, and means of verification that the delay time is authorized by the associated time interval provided by this table.

5. Device for modifying code sequences according to claim 4, characterized in that it includes means allowing the delay ΔTi delay delay to be offset by the value of the time interval [ΔTmini; ΔTmaxi].

6. Device for modifying code sequences according to claim 4, characterized in that it includes means for triggering an error message when the time delay ΔTi is in the time interval.

7. Device for modifying code sequences according to claim 3, characterized in that it consecutively at the end of the delay time (ΔTi), when the counter (6) reaches the zero value, means for triggering an interruption means for memorizing the current value of a PC program counter register in a stack, then means of diverting the program to the address defined in the part of the ROM memory containing interrupt vectors, which supply the address of the start of the interrupt code sequence, means of verifying that the value of the PC program counter register Val_PC stored in the stack is not a sensitive sequence address value contained in a table TAB_SEC, and means for modifying the sequence of operations.

8. Device for modifying code sequences according to claim 7, characterized in that either the verification means test whether the value of the program counter register is contained by TAB_SEC in the interval [Adrdeb_i, Adrfin_1], corresponding to an interruption of the program during a sensitive sequence and the means of modifying the course of the operations of the card return a message indicating that its security is reached and is blocked, either the means of verification test if the value of the register counter program Val_PC is contained in the interval] Adrfin_i, Adrdeb_i + 1 [corresponding to an interruption of the program during a non-sensitive sequence and the means of modifying the sequence of operations authorize the program then to execute the new code sequence whose start address was memorized during the processing of the orientation instruction (lORi).

9. Device for modifying code sequences according to claim 1, characterized in that it comprises a frequency source for the counter (6), different from a frequency source allowing the central unit (1) to execute the program, the value of the delay time (ΔTi) programmed in the diversion table TAB_DER being calculated to allow the program to be interrupted at a determined address, the table TAB_DER comprises for each value of the delay time, an additional element containing this determined address and means to compare the address of the instruction interrupted by the interrupt, to that indicated in the table, and cause an alarm.

10. Device for modifying code sequences according to the preceding claim, characterized in that it includes means for triggering an alarm to block the support and indicate an attempt at fraud by writing to the memory.

11. Device for modifying code sequences according to claim 1 or 3, characterized in that each new code sequence ends with an orientation instruction to reload the counter (6) with a new time delay value (ΔTi ).

12. Method for modifying frozen code sequences written in a support comprising a central unit and a memory (2), characterized in that it consists in providing in at least one fixed code sequence, at least one orientation instruction (lORi), allowing to divert, by a deferred interruption of a time delay, the execution of a program contained in the memory to a determined address, by a diversion table TAB_DER, according to an associated reference i to the orientation instruction and within a timeout period, determined by the content of a table row corresponding to the reference i of the orientation instruction, a new sequence of code executable during the interruption generated at the end of the delay time being located at the address contained in the table (TAB_DER).

13. Method according to claim 12, characterized in that a step triggering the interruption is preceded by a verification step, consisting in verifying that the delay time is not included in an interval defined by a second table TAB_SEC said safe registered in the non-volatile memory of the support.