DE102006058511B4 - Method for receiving messages by means of a portable data carrier and portable data carrier - Google Patents

Abstract

Method for receiving a message by a portable data carrier (1) with a non-volatile memory (5) and an asynchronous input buffer (18) which is continuously filled with partial messages, characterized by the steps: - -transmitting (33, 34) of partial messages present in the input buffer (18) in an intermediate buffer (16) of the data carrier (1); and- storing (40, 41) partial messages present in the intermediate buffer (16) in a non-volatile memory (5) of the data carrier (1) in such a way that the complete message is combined from the partial messages; wherein the steps of transmitting (33, 34) and of storing (40, 41) are synchronized in such a way that partial messages from the intermediate buffer (16) are stored in the non-volatile memory (5) as long as the input buffer (18) has a predetermined value Level does not exceed.

Description

The present invention relates to a method for receiving messages by a portable data carrier and to such a data carrier, in particular a chip card, a secure multimedia card, a USB storage medium, a cellular phone card or the like.

In the field of data communication between portable data carriers and corresponding quiet / writing devices or terminals, new applications and requirements have created the need to receive and send messages whose length exceeds the usual message lengths that can be processed by portable data carriers.

Various possibilities are known for making it possible to receive excessively long messages using a portable data carrier. On the one hand, it is possible to enlarge the reception / transmission buffers used, which, however, leads to increased costs, since reception buffers are usually implemented as expensive RAM memories. It is also possible to split up excessively long messages to be received before they are sent by the sender so that they can be received and processed by the data carrier step by step (“off-card splitting”). However, this has the disadvantage that, on the one hand, comparatively complex transmission protocols have to be used and, on the other hand, each terminal that is to communicate with such portable data carriers has to be converted in order to adapt it to the limited possibilities of the data carriers.

EP 0 811 204 B1 discloses a method in which excessively long messages are stored in a non-volatile memory designed as an EEPROM memory. A distinction is made between direct and indirect storage of excessively long messages in the EEPROM memory, with indirect storage taking place via a RAM memory in order to be able to preprocess messages there before they are finally saved. However, the problem here is that an EEPROM memory has only short storage times and the data carrier is limited when receiving data by the storage speed of its EEPROM memory.

DE 10 2004 040 296 B3 describes a writing of data in a non-volatile memory of a chip card or a chip module, the data being transferred to the memory in parallel to the execution by a processor of the chip card or the chip module.

US 2005/0289291 A1 describes a chip card which is in communication with an external device, a process for writing data in a non-volatile memory of the chip card being carried out in accordance with a command from the external device.

DE 199 28 939 A1 describes a method for data transmission between a data carrier and an external terminal, the data carrier storing data received by the terminal, extracting data to be processed by a processor of the data carrier and copying it from an input / output buffer of the data carrier to a transmission buffer of the data carrier while maintaining the processing sequence become.

DE 100 40 241 A1 describes a method for memory management of portable data carriers, for example chip cards, in order to improve the usability of the memory. For this purpose, methods for defragmenting the memory are described in order to obtain the largest possible contiguous memory areas.

In general, with such solutions there is often the additional problem that a loss of performance is to be expected when partial messages of a message are received sequentially, since the processor of the data carrier has to coordinate the sequential data input and cannot take on any other tasks during this time. It is therefore desirable in digital data transmission to decouple the recording of message blocks of an incoming data stream from the speed of the processor of the receiving data carrier and its clock rate, so that the sending communication partner of the data carrier can specify the transfer rate at least to a certain extent. Separate, asynchronous input buffers, such as B. UART modules ("Universal Asynchronous Receiver / Transmitter") are used, which can directly receive partial messages from the data carrier. The function of such UART modules is therefore independent of the processor speed and does not require any software support for communication at the byte level. However, an asynchronous input buffer does not support the reception of excessively long messages, since with chip cards it usually only holds data volumes the size of one byte.

It is therefore the object of the present invention to enable an efficient reception of excessively long messages by a data carrier.

According to the invention, this object is achieved by a method and a portable data carrier with the features of the independent claims solved. In the dependent claims, advantageous configurations and developments of the invention are given.

A portable data carrier according to the invention, equipped with a processor, comprises a non-volatile memory and an asynchronous input buffer which continuously and sequentially (e.g. bit or byte) receives partial messages of an excessively long message to be received independently of the processor of the data carrier. Partial messages present in the asynchronous input buffer are first transferred to an intermediate buffer of the data carrier, which may not be able to completely accommodate the excessively long message, and from there are stored in the sufficiently large non-volatile memory of the data carrier. When saving, the excessively long message is combined from its partial messages in the non-volatile memory.

The steps of transferring partial messages from the input buffer to the intermediate buffer and storing partial messages in the intermediate buffer in the non-volatile memory are coordinated and synchronized in such a way that partial messages present in the intermediate buffer can only be stored in the non-volatile memory as long as the input buffer does not exceed a specified level. When the specified filling level of the continuously filling input buffer has been reached, the partial messages contained therein are given priority in the intermediate buffer.

The steps of transferring and storing are also synchronized in such a way that partial messages can be transferred from the input buffer to the intermediate buffer when the input buffer exceeds a specified level, i.e. that there is always enough free storage space in the intermediate buffer to store partial messages in the input buffer without a buffer overflow or to transmit data loss in the intermediate buffer.

The advantage of the present invention is that the above-described synchronized filling and emptying of the series-connected asynchronous input buffer, intermediate buffer and non-volatile memory that is large enough for excessively long messages neither increases the size of the input or intermediate buffer which is not sufficiently large Splitting of excessively long messages by the sender is required. Rather, the sender can send his message in blocks sequentially and without prior splitting to the data carrier, where it can be continuously received by the input buffer bit by bit or byte without data loss due to the synchronized further processing of partial messages arriving in the input buffer. The proven communication protocols (e.g. T = 0 and T = 1 in the chip card area) can be used unchanged. In addition, the processor has no dead times, since it can carry out further processing processes while the input buffer is being filled with new partial messages.

The asynchronous input buffer is preferably a UART module (“Universal Asynchronous Receiver / Transmitter”) which is not tied to the speed or clock rate of the processor of the data carrier, since the message reception is implemented on the hardware level. Such a UART module has a relatively small data capacity of usually only one byte.

The intermediate buffer is preferably a buffer area set up in a RAM memory of the data carrier, the size of which exceeds that of the input buffer. The intermediate buffer is preferably implemented as a ring memory that can be continuously filled with data and emptied using coordinated writing and reading processes based on the FIFO principle (“first in first out”).

As a result, the fast RAM intermediate buffer, which is larger than the input buffer, can take on a bridging function between the small, asynchronous input buffer and the large, relatively slow, non-volatile memory, which enables a coordinated recording of partial messages. A direct series connection of the input buffer and the non-volatile memory without the bridging intermediate buffer, on the other hand, could lead to buffer overflows and data loss due to the discrepancy between the transfer rate of incoming partial messages in the input buffer and the storage speed of the non-volatile memory. In addition, the writing speed can be optimized in this way, since the non-volatile memory is written to page by page and the size of the input buffer is usually smaller than the page size of the non-volatile memory.

A portable data carrier according to the invention further comprises an input control which can be executed by the processor and which is set up in such a way that it synchronizes message reception by alternately transmitting partial messages in the input buffer to the intermediate buffer and storing partial messages in the intermediate buffer in the non-volatile memory that the intermediate buffer is not completely filled when the input buffer exceeds a specified level. In addition, the input control carries out the transmission and storage alternately in such a way that, on the other hand, also the input buffer is not completely filled if not all partial messages of the message to be received have yet arrived. These two synchronization conditions guarantee the smooth flow of a message reception from the inclusion of partial messages in the input buffer to the presence of the completely combined message in the non-volatile memory.

The input control realizes the two steps of copying and reading out as separate, competing processes by means of a multitasking / multithreading-capable operating system of the data carrier. The arrival of partial messages in the input buffer and / or the exceeding of the specified filling level is registered by an interruption device on the data carrier, which then triggers an interruption signal (“interrupt”). The interruption signal has the effect that the processor temporarily interrupts the process currently being carried out and gives priority to the receipt of messages.

As soon as the interruption device triggers an interruption signal, an interruption processing processing the interruption is carried out by the input control for transferring partial messages present in the input buffer to the intermediate buffer. When the interruption process has transferred a specified volume of data and / or all of the partial messages in the input buffer to the intermediate buffer, it ends its work until there are new partial messages in the input buffer and / or a certain predetermined level of the input buffer is reached or exceeded. The input control then activates a storage process which stores partial messages present in the intermediate buffer in the non-volatile memory of the data carrier. As a result, the intermediate buffer is at least partially emptied so that the interruption process can fill it again if necessary.

The partial messages are stored and combined by the storage process in such a way that after all partial messages of an excessively long message to be received have been received, this message is completely in the non-volatile memory. There the complete message is made available to an application for which the message is intended.

Before the message, which has been put together in the non-volatile memory, is made available to an application, it can be verified, e.g. by the storage process. This verification can include a check preceding the normal processing of the message, for example checking a checksum or performing a cryptographic or other security-related operation. The message can preferably be put together by the storage process in a sufficiently large separate storage area which is set up in the non-volatile storage and which does not correspond to the final storage location of the received message. This is particularly helpful if the received message is an update instruction for data already present in the non-volatile memory, which could no longer be reconstructed if the final memory location was directly overwritten. B. the verification of the message by checking a checksum fails or the message is incomplete due to a transmission error.

The partial messages present in the intermediate buffer are preferably written page by page into the non-volatile memory in accordance with a memory management of the data carrier.

In order to be able to effectively synchronize the execution of the interruption and storage process by the input control, the data carrier includes a multitasking / multithreading-capable operating system, which can execute processes / threads on the processor concurrently, so that the input control can concurrently execute the interruption process and can initiate the storage process. The execution of an interrupt process can then be interrupted in order to continue the execution of an interrupted storage process when the interrupt process has emptied the input buffer. Conversely, the storage process is interrupted in order to continue the interruption process if the input buffer exceeds the specified level.

In addition to the interruption process and the storage process, the control device can initiate the execution of a protocol process, which interprets a partial message present in the intermediate buffer. B. information required for the execution of the storage process is determined from the partial messages of the buffer. Such information can in particular be length information about the length of the message and / or structure information about the structure of the message.

By evaluating certain bytes of a partial message, the protocol process can determine whether the partial message belongs to an excessively long message, so that the storage process can be informed of this for the appropriate handling of the partial messages. This treatment can consist, for example, in storing the partial message in the separate memory area of the non-volatile memory or appending it to partial messages that have already been received. The interpretation can also consist of a pure validity check of the partial messages received in order to detect data transmission errors at an early stage.

After the interpretation of a partial message present in the intermediate buffer, the protocol process is interrupted or terminated by the input control and the storage process is continued or started, the storage process using the information ascertained by the protocol process.

In a multitasking / multithreading-capable operating system, the execution of the interruption process on the one hand and the log process and / or the storage process on the other hand are synchronized in such a way that the execution of the log process and / or the storage process is initiated or continued and the execution of the interruption process is ended or interrupted, if the intermediate buffer exceeds a specified maximum fill level as a result of the partial message transmission of the interruption process. The storage process is preferably started when the input buffer is filled.

Correspondingly, the input control interrupts or ends the execution of the interpretation process and / or the storage process and continues the execution of the interruption process or starts it when the input buffer exceeds a specified level as a result of the continuous filling with further partial messages and / or when the intermediate buffer as a result of the work of the Storage process falls below a specified minimum level.

In order to handle the receipt of an excessively long message, it is therefore necessary to continuously check whether, on the one hand, partial messages are present in the input buffer and / or a specified level is exceeded and, on the other hand, whether the intermediate buffer has sufficient storage space to receive partial messages from the input buffer or storage space must be created.

Exceeding a specified fill level of the input buffer is signaled interrupt-controlled (by means of "interrupts") so that neither the input control nor the operating system of the data carrier have to check whether partial messages are present in the input buffer. In contrast, the intermediate buffer is preferably monitored by an event control in an event-controlled manner, with the input control being notified of a level below a minimum level or exceeding a maximum level by means of a level signal (an “event”).

The handling of a message to be received is initiated when the first partial messages arrive by interrupting and activating the corresponding interruption process by the input control. The processes that are subsequently activated and / or continued by the input control are assigned different execution priorities due to their different importance. It makes sense here to give the interruption process the highest execution priority compared to the other processes, since it has to react immediately to the arrival of partial messages in the small input buffer.

The protocol process to be activated after the termination / interruption of the interruption process is started / continued with a medium execution priority and the storage process to be activated after the termination / interruption of the protocol process is started / continued with a low execution priority. Overall, however, the operating system of the data carrier ensures that all other processes to be carried out by the processor when processing an incoming partial message have lower execution priorities in relation to the three processes mentioned above.

The input control can be implemented both as part of the operating system or the privileged operating system kernel and independently of the operating system of the data carrier. In addition to the use of processes that are activated by the input control, it is also possible to provide the input control itself as an input / output process, within the framework of which an interrupt thread, a protocol thread and a memory thread are implemented the tasks described above can be activated synchronously. The input / output process can then be designed as a process to be activated by the operating system kernel.

In particular, a chip card, a secure multimedia card, a USB storage medium, a cellular phone card or the like is provided as the data carrier according to the invention.

Although the above description only explains the reception of data, the inventive principle can also be applied without restriction to the transmission of data in that the secondary buffer is set up as a virtual output buffer.

• 1 eine zum effizienten Empfang überlanger Nachrichten mit einem RAM-Ringpuffer ausgestattete Chipkarte;
• 2 ein Verfahren zum Nachrichtenempfang durch die in 1 dargestellte Chipkarte;
• 3 eine zum effizienten Nachrichtenempfang mit einem Sekundärpuffer als virtuellem Eingangspuffer ausgestattete Chipkarte; und
• 4 ein Verfahren zum Nachrichtenempfang durch die in 3 gezeigte Chipkarte.

Further features and advantages of the invention emerge from the following description various exemplary embodiments according to the invention and alternative designs in connection with the accompanying drawings. Show in it:

• 1 a chip card equipped with a RAM ring buffer for the efficient reception of excessively long messages;
• 2 a method for receiving messages by the in 1 chip card shown;
• 3 a chip card equipped with a secondary buffer as a virtual input buffer for efficient message reception; and
• 4th a method for receiving messages by the in 3 shown chip card.

The following description of the figures explains a method and a device for receiving excessively long messages by means of a portable data carrier, which is illustrated in the figures by a chip card with a processor. The process consists of two sub-processes that can be used individually or in combination, each in the 2 and 4th are shown while the 1 and 3 the chip card realizing the respective sub-process shows. The possibility of combining the procedures of the 2 and 4th as well as the devices of 1 and 3 is also expressed by the fact that matching method steps and / or components are provided with the same reference symbols in the figures.

The ones in the 1 and 3 The chip cards shown are suitable both for receiving and sending messages without restriction, the receiving method of 2 and 4th for sending messages are in principle implemented in reverse order by the same components. In this respect, the figures and the following description do not represent a restriction of the invention to the reception of messages, but rather describe this only by way of example and are therefore also to be applied to the transmission of messages.

In the chip card area, the transmission protocols T = 0 and T = 1 have become established for data transmission and communication with external readers, terminals or other communication partners, which represent standardized block-oriented half-duplex protocols for mobile radio cards and chip cards. The byte-oriented T = 0 protocol is mainly used for GSM mobile radio smart cards, while the T = 1 protocol is used for other smart cards and portable data carriers similar to smart cards.

With a chip card operating system that supports multitasking (or multithreading), several protected processes (“tasks”) or process threads (“threads”) are apparently carried out concurrently through frequent process or thread changes. A process usually comprises an address space and at least one process thread. In the following description, processes that are activated by the operating system kernel are primarily used for the tasks to be processed concurrently by the processor of the chip card in the context of handling incoming messages. The same tasks can also be performed by threads, provided that the operating system is a multithreaded operating system. The administrative effort for threads is usually less than that for processes, since a complete context change (status, register contents, etc.) does not have to be made when changing threads, because concurrent threads perform partial tasks of a process and use a common part of the process context. Communication between tasks is possible with the help of interprocess communication (IPC). Threads that are assigned to the same process can synchronize with the help of the IPC. All of the functionalities and tasks explained in this description can be implemented equally as processes or as threads, with the advantages and disadvantages of processes and threads with regard to the present invention also being comparable, apart from the administrative differences described.

1 shows a chip card 1 , which is set up to efficiently receive and send excessively long messages, the data volume of which exceeds the recording capacity of conventional receive / transmit memories or buffers provided for data communication. The chip card 1 includes a processor as a common hardware component 2 (CPU), a communication interface 3 , a UART input buffer 18th and a memory arrangement consisting of a permanent ROM memory 4th , a non-volatile EEPROM memory 5 and a volatile RAM memory 6th . The chip card 1 comprises a total of three buffers connected in series to receive and handle incoming, excessively long messages: The UART module 18th , which is a separate hardware chip in the chip card 1 is integrated, an intermediate buffer 16 at the in 1 illustrated embodiment as a ring buffer in RAM memory 6th and finally a separate storage area 14th (NVM) in non-volatile EEPROM memory 5 . The UART module 18th can support a suitable protocol such as USB or MMC.

It also includes the chip card 1 an operating system 7th , which is usually in permanent ROM memory 4th is filed. The operating system 7th includes the operating system kernel 8th (KERNEL), which in addition to other basic tasks is a Operating system also has an interrupt control 9 as an "interrupt handler". There is also an input control 10 (I / O-CNTL), which processes incoming partial messages of a message by synchronized activation of various processes, and an event control 11 (EVENT), which handles certain events ("events") by calling associated event handling routines ("event handlers"), as part of the operating system 7th realized. During the interrupt handling 9 usually part of the operating system kernel 8th can use event control 11 and the input control 10 of course also as part of the operating system kernel 8th be realized, or as in the EEPROM memory 5 Stored extended system software or as applications.

Running applications 13th (APP), routines of the operating system kernel 8th or input control processes 10 leads to separate, from the processor 2 running processes or threads 19th , 20th , 21 , 22nd , 24 . This involves routines and processes of the operating system kernel 8th as processes 24 in privileged system mode 26th executed while that of the input control 10 initiated interruption processes 20th (IR-PROC), protocol processes 21 (PRTCL-PROC) and storage processes 22nd (NVM-PROC) and application processes 19th (APP-PROC) in restricted, safe user mode 27 are executed.

In the 1 and 2 the reception of an excessively long message is illustrated, which consists of partial messages B1 - B8 is constructed. In this context, "excess length" means that the chip card 1 the excessively long message cannot be completely absorbed in any (RAM) buffer usually used for this purpose. The in 1 illustrated chip card 1 the UART buffer 18th and the intermediate buffer 16 each not large enough to accommodate excessively long messages that are more than 255 bytes.

The entire message B1-B8 is sent continuously by a sender, bit by bit sequentially via the communication interface 3 the chip card 1 into the UART input buffer 18th fed in or taken from this. In 1 a scenario is shown in which the reception of the excessively long message B1-B8 has already progressed so far that the partial messages B1, B2 are already in the non-volatile memory area 14th are combined while the message segments B3, B4 are in the RAM ring buffer 16 the partial message B5 are in the UART input buffer 18th and the concluding partial messages B6, B7, B8 are not yet on the chip card 1 have arrived.

In connection with the 1 and 2 the term partial message is not to be understood as a standardized message block in the sense of a byte, but can in principle comprise a variable number of bits that do not necessarily correspond to the size of the input buffer 18th or a memory management of the operating system 7th is adapted.

• - Zunächst nimmt der UART-Eingangspuffer 18 einige Bits einer eingehenden Nachricht als Teilnachrichten auf (30). Die eingehende Teilnachricht ist insbesondere eine Kommando-APDU („Application Protocol Data Unit“) als grundlegende Kommunikationseinheit zur Datenübertragung von einem Terminal an eine Chipkarte.
• - Bei Vorliegen einer Teilnachricht in dem Eingangspuffer 18 und/ oder bei Überschreiten eines vorgegebenen Füllstands des Eingangspuffers 18 wird eine Unterbrechung (Interrupt) unabhängig von dem Betriebssystemkern 24 ausgelöst, wobei eine Unterbrechungstabelle die bei dem vorliegenden Unterbrechungstyp „DATA AVAILABLE“ (31) auszuführende Unterbrechungsbehandlungsroutine (ISR) bestimmt.
• - Aufgrund der ausgelösten Unterbrechung (31) unterbricht der Betriebssystemkern 24 die Ausführung des momentan von dem Prozessor 2 ausgeführten Anwendungsprozesses, um den Nachrichteneingang prioritär zu bearbeiten. Durch die Unterbrechung DATA AVAILABLE wird der Unterbrechungsprozess 20 von dem Betriebssystemkern 24 mit höchster Ausführungspriorität aktiviert (32), so dass Teilnachrichten aus dem Eingangspuffer 18 in den Zwischenpuffer 16 übertragen werden, sobald der Eingangspuffer 16 einen vorgegebenen Füllstand überschreitet.

• - Der Unterbrechungsprozess 20 liest eine vorgegebene Anzahl oder alle Bits aus dem UART-Eingangspuffer 18 aus (33) und schreibt sie in den RAM-Ringpuffer 16 (34). Durch die Synchronisation der Prozesse 20, 21 und 22 wird dafür gesorgt, dass der Ringpuffer 16 niemals gänzlich gefüllt ist, wenn im UART-Eingangspuffer 18 auszulesende Daten vorliegen, da andernfalls ein Datenverlust auftreten kann.
• - Der Unterbrechungsprozess 20 wird nach Erledigung seiner Aufgabe wieder inaktiv und wartet auf die nächste Aktivierung durch eine Unterbrechung aufgrund von im Eingangspuffer 18 vorliegenden weiteren Teilnachrichten. Ebenso gut kann der Unterbrechungsprozess 20 auch wieder aktiviert werden, wenn der Zwischenpuffer 16 vollständig geleert ist, selbst wenn der UART-Eingangspuffer 18 noch nicht den zum Auslösen einer Unterbrechung erforderlichen Füllstand erreicht hat. Die Signalisierung, dass der Ringpuffer 16 vollständig geleert ist, kann durch einen Event ausgelöst werden oder dem Unterbrechungsprozess 20 durch Interprozesskommunikation (IPC) von dem Speicherprozess 22, der den Ringpuffer 16 ausliest, mitgeteilt werden.
• - Sobald der hochprioritäre Unterbrechungsprozess 16 inaktiv wird, wird der Protokollprozess 21 mit mittlerer Priorität von dem Betriebssystemkern 24 bzw. der Eingangssteuerung 10 aktiviert (35).
• - Der Protokollprozess 21, der unter Umständen bereits unmittelbar nach kontaktieren der Chipkarte mit dem Sendeterminal im Rahmen einer Initialisierungsphase der Chipkarte aktiviert wurde (der Protokollprozess sendet bei der Initialisierung eine ATR-Nachricht („Answer to Reset“) an das Terminal mit diversen Chipkarten- und Übertragungsparametern, z.B. auch der Größe des Ringpuffers 16, um eintreffende übergroße Nachrichten erkennen zu können), wird nun durch den Betriebssystemkern 24 aktiviert oder fortgesetzt, falls er temporär inaktiv ist. Optional ist es auch möglich, dass der Protokollprozess 21 prüft, ob Teilnachrichten für ihn im Zwischenpuffer 16 liegen. Ebenso kann der Protokollprozess 21 durch ein Event „Neue Daten im Zwischenpuffer“ von dem Betriebssystemkern 24 aktiviert werden.
• - Der Protokollprozess 21 interpretiert die im Zwischenpuffer 16 liegenden Bytes der Kommando-APDU, um Informationen über die Gesamtlänge der zu empfangenden Nachricht oder Strukturinformationen über die Nachricht zu erhalten, welche zu ihrer weiteren Bearbeitung benötigt werden. Hierbei werden bestimmte Bytes der eingehenden Kommando-APDU ausgewertet, z. B. das Class-Byte CLA, welches gemäß ISO/IEC 7816-4 im Bit 5 anzeigt, ob die aktuell eintreffende Kommando-APDU das letzte/einzige Kommando (CLA Bit 5 = 0) einer Kette von Kommandos ist, oder ob die aktuelle Kommando-APDU nicht das letzte Kommando der Kette ist (CLA Bit 5 = 1) und noch weitere Kommandos folgen. Derartige miteinander verknüpfte Ketten von Kommandos („Command Chaining“) sind für einige Kommandotypen, z. B. PUT DATA, die mehr als 255 Bytes an zur Chipkarte zu übertragende Daten umfassen, geeignet. Falls der Protokollprozess 21 daraus schließen kann, dass mehr Teilnachrichten zu erwarten sind, als in den Ringpuffer 16 passen, wird der Speicherprozess 22 entweder von dem Betriebssystemkern 24 oder von dem Protokollprozess 21 veranlasst, den Ringpuffer 16 zu leeren.
• - Ebenso kann der Protokollprozess 21 bei der Interpretation der eintreffenden Daten das INS-Byte, welches einen Rückschluss auf das von der Kommando-APDU übertragene Kommando zulässt, auswerten, um eine Gültigkeitsprüfung der vorliegenden Daten durchzuführen. Ebenso ist es -möglich, dass die Interpretation den endgültigen Speicherort der Daten im EEPROM-Speicher 5 der Chipkarte 1 ermittelt, um diese Information dem Speicherprozess 22 per Interprozess-Kommunikation (IPC) mitzuteilen (39).
• - Der Protokollprozess 21 wird nach Erledigung seiner Aufgabe inaktiv und wartet auf die nächste Aktivierung durch den Betriebssystemkern 24 oder die Eingangssteuerung 10 aufgrund im Ringpuffer 16 vorliegender Daten.
• - Nun wird der mit niedriger Priorität ausgeführte Speicherprozess 22 von dem Betriebssystemkern 24 bzw. der Eingangssteuerung 10 aktiviert (37). Ebenso kann der Speicherprozess 22 aktiviert werden, wenn der Ringpuffer 16 einen bestimmten vorgegebenen Füllstand überschritten hat, um diesen rechtzeitig zu leeren, damit weitere eingehende Daten aus dem Eingangspuffer 18 in den Ringpuffer 16 übertragen werden können. Das Überschreiten des Füllstandes kann dann mittels eines Ereignisses (Event) gemeldet werden. Ebenso ist es möglich, dass der Speicherprozess 22 aufgrund eines Ablaufens einer Zeitscheibe oder abhängig von dem Ergebnis einer aktiven Prüfung des Füllstandes des Ringpuffers 16 („Polling“) aktiviert wird.
• - Der Speicherprozess 22 liest (40) die in dem Ringpuffer 16 vorliegenden Daten und schreibt (41) diese in den nicht-volatilen Speicherbereich 14. Vorzugsweise kann der Speicherprozess 22 auch warten, bis eine Speicherseite in dem Ringpuffer 16 vollständig vorliegt, d.h. beispielsweise 32 Byte, da ein Speicherzugriff auf den nicht-volatilen Speicher 5 ohnehin zumeist seitenweise erfolgt.
• - Der Speicherprozess 22 kann die Nachricht 16 direkt in einen im EEPROM-Speicher 5 angelegten Zielspeicherbereich des Applikationsprozesses 19, für den die Daten bestimmt sind, aus den Teilnachrichten B1 - B8 zusammenfügen. In der Regel existiert jedoch ein spezieller nicht-volatiler Speicherbereich 14, um eine Nachricht dort einerseits aus den empfangenen Teilnachrichten zusammenfügen zu können und andererseits dort eine Vorprüfung der empfangenen Nachricht durchzuführen, z. B. eine kryptographische Sicherheitsoperation oder eine Prüfsummenverifikation. Die Verwendung eines speziellen Speicherbereichs 14 ist insbesondere bei Aktualisierungskommandos sinnvoll (z.B. UPDATE DATA), da ein sofortiges Überschreiben der zu aktualisierenden Daten im Zielspeicherbereich zu einer unerwünschten Dateninkonsistenz führen kann, falls das Aktualisierungskommando unvollständig oder fehlerhaft übertragen wird oder falls eine Verifikation durch einen Prüfsummenvergleich fehlschlägt. Ein unvollständiges oder fehlerhaftes Aktualisierungskommando kann demgegenüber aus einem separaten nicht-volatilen Speicherbereich 14 gelöscht werden, ohne dass die eigentlichen zu aktualisierenden Daten beschädigt werden.
• - In dem nicht-volatilen Speicherbereich 14 fügt der Speicherprozess 22 die vollständige Nachricht B1 - B8 so zusammen, dass die Nachricht vorverarbeitet oder im Hinblick auf ihre Gültigkeit oder sicherheitsrelevante Aspekte verifiziert werden kann.
• - Da der Speicherprozess 22 eine niedrigere Priorität als der Unterbrechungsprozess 20 hat, kann er nur zwischen zwei Unterbrechungsphasen, wenn der Unterbrechungsprozess 20 inaktiv ist, aktiviert werden, um aus dem Ringpuffer 16 Teilnachrichten auszulesen. Der Speicherprozess 22 ist also nur für die Zeitdauer der Übertragung von Daten von dem Terminal in den UART-Eingangspuffer 18 aktiv, da er Teilnachrichten nur solange aus dem Zwischenpuffer 16 auslesen kann, wie der Eingangspuffer 18 einen vorgegebenen Füllstand nicht überschreitet. Dann wird wieder der hochprioritäre Unterbrechungsprozess 20 aktiviert.
• - Falls die Nachricht vollständig im nicht-volatilen Speicherbereich 14 vorliegt, was von dem Protokollprozess 22 durch Auswerten des CLA-Bytes ermittelt werden kann, wird abschließend der Applikationsprozess 19 per Interprozesskommunikation (IPC) informiert. Die Aktivierung des Applikationsprozesses 19 kann durch den Speicherprozess 22 selbst, den Betriebssystemkern 24, die Eingangssteuerung 10 oder event-gesteuert erfolgen.
• - Die im nicht-volatilen Speicherbereich 14 nunmehr vollständig vorliegende Nachricht kann auch direkt in den Adressbereich der Applikation 19 kopiert werden, was ein Aufrufen des Kommandointerpreters erforderlich macht, um die Applikation zu ermitteln. Andererseits kann die Applikation aufgefordert werden, auf die Daten ihrerseits zuzugreifen (42).

2 illustrates a method for receiving an excessively long message by the in 1 shown chip card 1 . The operating system kernel is at the center of the diagram 24 (KERNEL), which also controls the entrance 10 and / or event control 11 may include. The operating system kernel 24 or the reception control 10 activated to handle an incoming message synchronizes the interruption process 20th (INTERRUPT PROC) with high priority (PRIORITY = HIGH), the protocol process 21 (PROTOCOL PROC) with medium priority (PRIORITY = MEDIUM) and the storage process 22nd (NVM PROC) with low priority (PRIORITY = LOW). By synchronizing the activation and deactivation of these processes 20th , 21 , 22nd received partial messages B1-B8 of an excessively long message from the UART input buffer 18th via the RAM ring buffer 16 finally in the non-volatile memory area 14th combined to form the complete message and an application process 19th (APP PROC). The procedure of this procedure is as follows, whereby bracketed reference symbols characterize data streams:

• - First, the UART takes the input buffer 18th some bits of an incoming message as partial messages on ( 30th ). The incoming partial message is in particular a command APDU (“Application Protocol Data Unit”) as a basic communication unit for data transmission from a terminal to a chip card.
• - If there is a partial message in the input buffer 18th and / or when a specified fill level of the input buffer is exceeded 18th is an interruption independent of the operating system kernel 24 triggered, whereby an interrupt table contains the "DATA AVAILABLE" ( 31 ) determines the interrupt handling routine (ISR) to be executed.
• - Due to the interruption triggered ( 31 ) interrupts the operating system kernel 24 the execution of the momentary by the processor 2 executed application process in order to process the incoming message with priority. The interruption process becomes the DATA AVAILABLE interruption 20th from the operating system kernel 24 activated with highest execution priority ( 32 ), so that partial messages from the input buffer 18th in the intermediate buffer 16 be transferred as soon as the input buffer 16 exceeds a specified level.

• - The interruption process 20th reads a specified number or all bits from the UART input buffer 18th out ( 33 ) and writes them to the RAM ring buffer 16 ( 34 ). By synchronizing the processes 20th , 21 and 22nd it is ensured that the ring buffer 16 is never completely filled when in the UART input buffer 18th data to be read is available, otherwise data loss may occur.
• - The interruption process 20th becomes inactive again after completing its task and waits for the next activation due to an interruption in the input buffer 18th present further partial messages. The interruption process can do just as well 20th also be reactivated when the intermediate buffer 16 is completely emptied, even if the UART input buffer 18th has not yet reached the level required to trigger an interruption. The signaling that the ring buffer 16 is completely emptied, can be triggered by an event or the interruption process 20th through interprocess communication (IPC) from the storage process 22nd , of the ring buffer 16 reads out, communicated.
• - Once the high priority interrupt process 16 becomes inactive, the log process becomes inactive 21 with medium priority from the operating system kernel 24 or the input control 10 activated ( 35 ).
• - The log process 21 which may have been activated immediately after contacting the chip card with the transmitter terminal as part of an initialization phase of the chip card (the protocol process sends an ATR message ("Answer to Reset") to the terminal with various chip card and transmission parameters, e.g. during initialization also the size of the ring buffer 16 in order to be able to recognize incoming oversized messages) is now processed by the operating system kernel 24 activated or continued if it is temporarily inactive. Optionally it is also possible that the protocol process 21 checks whether partial messages are in the intermediate buffer for it 16 lie. The protocol process 21 by an event "New data in the intermediate buffer" from the operating system kernel 24 to be activated.
• - The log process 21 interprets the in the intermediate buffer 16 lying bytes of the command APDU in order to receive information about the total length of the message to be received or structural information about the message, which is required for its further processing. Certain bytes of the incoming command APDU are evaluated here, e.g. B. the class byte CLA, which according to ISO / IEC 7816-4 in the bit 5 indicates whether the currently incoming command APDU is the last / only command (CLA bit 5 = 0) in a chain of commands, or whether the current command APDU is not the last command in the chain (CLA bit 5 = 1) and still further commands follow. Such interlinked chains of commands (“command chaining”) are necessary for some command types, e.g. B. PUT DATA, which comprise more than 255 bytes of data to be transmitted to the chip card, are suitable. If the log process 21 can conclude from this that more partial messages are to be expected than in the ring buffer 16 will fit, the save process 22nd either from the operating system kernel 24 or from the log process 21 causes the ring buffer 16 to empty.
• - Likewise, the protocol process 21 When interpreting the incoming data, evaluate the INS byte, which allows conclusions to be drawn about the command transmitted by the command APDU, in order to carry out a validity check of the data available. It is also possible for the interpretation to determine the final storage location of the data in the EEPROM memory 5 the chip card 1 determined to this information the storage process 22nd to be communicated via interprocess communication (IPC) ( 39 ).
• - The log process 21 becomes inactive after completion of its task and waits for the next activation by the operating system kernel 24 or the input control 10 due to the ring buffer 16 existing data.
• - Now the save process will be executed with low priority 22nd from the operating system kernel 24 or the input control 10 activated ( 37 ). Likewise, the storage process 22nd activated when the ring buffer 16 has exceeded a certain specified level in order to empty it in time, so that further incoming data from the input buffer 18th in the ring buffer 16 can be transferred. Exceeding the fill level can then be reported by means of an event. It is also possible that the storage process 22nd due to the expiry of a time slice or depending on the result of an active check of the fill level of the ring buffer 16 ("Polling") is activated.
• - The storage process 22nd read ( 40 ) those in the ring buffer 16 available data and writes ( 41 ) these into the non-volatile memory area 14th . Preferably, the storage process 22nd also wait for a page of memory in the ring buffer 16 is complete, ie 32 bytes, for example, because there is a memory access to the non-volatile memory 5 anyway mostly done page by page.
• - The storage process 22nd can the message 16 directly into one in the EEPROM memory 5 created target memory area of the application process 19th , for which the data is intended, from the partial messages B1 - B8 put together. As a rule, however, there is a special non-volatile storage area 14th in order to be able to combine a message there on the one hand from the received partial messages and on the other hand to perform a preliminary check of the received message there, e.g. B. a cryptographic security operation or a checksum verification. The use of a special memory area 14th This is particularly useful for update commands (e.g. UPDATE DATA), since immediate overwriting of the data to be updated in the target memory area can lead to undesired data inconsistency if the update command is transmitted incompletely or incorrectly or if verification by means of a checksum comparison fails. In contrast, an incomplete or faulty update command can be stored in a separate, non-volatile memory area 14th deleted without damaging the actual data being updated.
• - In the non-volatile memory area 14th adds the save process 22nd the full message B1 - B8 together in such a way that the message can be preprocessed or verified with regard to its validity or security-relevant aspects.
• - As the storage process 22nd a lower priority than the interrupt process 20th he can only switch between two interruption phases when the interruption process 20th is inactive, activated to get out of the ring buffer 16 Read out partial messages. The storage process 22nd is therefore only for the duration of the transfer of data from the terminal to the UART input buffer 18th active, since it only holds partial messages from the intermediate buffer for as long 16 like the input buffer 18th does not exceed a specified level. Then the high priority interrupt process becomes again 20th activated.
• - If the message is completely in the non-volatile memory area 14th what is present from the log process 22nd can be determined by evaluating the CLA byte, then the application process 19th informed via interprocess communication (IPC). Activation of the application process 19th can go through the storage process 22nd itself, the kernel of the operating system 24 , the input control 10 or event-controlled.
• - Those in the non-volatile memory area 14th The message that is now complete can also be entered directly in the address area of the application 19th must be copied, which makes it necessary to call the command interpreter in order to determine the application. On the other hand, the application can be requested to access the data for its part (42).

The method described above has the advantage that the time in which the UART input buffer 18th fills up from the log process 21 or the storage process 22nd can be used so that there is no dead time (CPU idle time) of the processor 2 occurs when sending and receiving.

This in 2 The outlined procedure is implemented by synchronization mechanisms that depend on the data transmission speed and the internal processor clock of the chip card 1 are dependent. The minimum time remaining for the save process 22nd With the T = 1 protocol results as 11 ETU ("Elementary Time Unit"; the duration of a bit in data transmission to the chip card; it depends, among other things, on the processor clock) minus the respective time required for the process change and the interrupt handling. The maximum remaining time for the save process 22nd depends on the CWT ("Character Waiting Time"), which specifies the maximum waiting time between two bytes before data reception is considered to have ended.

The method described above can be used with a memory area 14th in the non-volatile memory 5 be performed. However, since the write times can be limited with a classic EEPROM memory, other non-volatile memories, such as e. B. Flash memory, or future storage technologies such. B. M-RAM or FeRAM can be used.

The through the in the 1 and 2 The illustrated embodiment variant made possible to receive excessively long messages can be provided by the 3 and 4th The further measures shown can be implemented particularly efficiently. In practice, these further technical measures are preferably implemented in the embodiment variant of 1 and 2 integrated, although they are shown and described separately here for the sake of clarity.

3 shows a chip card 1 which is set up to receive excessively long messages efficiently. This includes the chip card 1 analogous to the in 1 shown chip card 1 a processor 2 (CPU), a communication interface 3 , a UART input buffer 18th as well as a memory arrangement consisting of a permanent ROM Storage 4th , a non-volatile EEPROM memory 5 and a volatile RAM memory 6th .

In RAM memory 6th is one of the intermediate buffer 16 the 1 various secondary buffers 17th (SEC.BUFF) for receiving partial messages from the UART input buffer 18th arranged. The secondary buffer 17th can be implemented in different ways, e.g. B. also as a selected memory area in a non-volatile memory, e.g. B. the EEPROM memory 5 or a flash memory, or as the UART input buffer 18th downstream hardware memory chip. How the secondary buffer works 17th is determined less by its implementation than by its functionality and its size, since it acts as a virtual input buffer in the functional sequence of the operating system 7th is integrated and has a larger data capacity than the actual input buffer 18th . Preferably the secondary buffer has 17th a multiple capacity of the input buffer 18th , for example five bytes, compared to the usual UART capacity of less than five bytes, usually one byte.

With regard to the variant of the 1 becomes the secondary buffer when partial messages are received between the UART input buffer 18th and the intermediate buffer 16 arranged so that an incoming partial message from the UART input buffer 18th via the secondary buffer 17th in the intermediate buffer 16 and finally in the EEPROM memory area 14th got.

In the RAM memory 6th there is a reserved memory area 15th (BUFFER), which is intended to store the incoming partial messages from the virtual input buffer while a message is being received 17th to record. The storage area 15th can with a combined implementation of the execution variants of the 1 and 3 the intermediate buffer 16 the 1 correspond. In this case the interruption process would 20th not directly to the UART input buffer 18th but partial messages from the secondary buffer 17th read out ( 33 ) and into the memory area 15th or the intermediate buffer 16 write ( 34 ).

The multitasking / multithreading-capable operating system kernel 8th distributes the processor time to different processes / threads that are in a special user mode 27 (USER MODE), whose access options to the hardware are very limited for security reasons, so that the process can only access operating system routines or hardware drivers via special system calls. In user mode 27 Executed programs and applications therefore do not cause serious system damage or crashes in the event of errors. In general, at least application processes 19th (APP-PROC) as well as the protocol process 21 in restricted user mode 27 running while the kernel 24 , together with z. B. device drivers, process control, file system control, interrupt control etc. in privileged system mode 26th (SYSTEM MODE) is being operated.

In ROM memory 4th lies as part of the operating system 7th a secondary buffer control 12th (VIRTUAL FIRMWARE), which is not considered conventional by the operating system kernel 8th in user mode 27 process to be executed is implemented, rather than in system mode 26th Virtual firmware of the secondary buffer to be executed 17th . The secondary buffer control 12th can in this respect also be part of the operating system kernel 8th or as an application in the EEPROM memory 5 will be realized. It is preferably implemented close to the hardware and is located as a control program of the secondary buffer 17th at a relatively low level of abstraction in the operating system 7th . Therefore, the secondary buffer control becomes 12th from the operating system 7th as virtual firmware 12th of a virtual UART input buffer, which is used as a secondary buffer 17th in RAM memory 6th the chip card 1 is realized.

4th illustrates the process sequence and data streams in a method for handling incoming messages in a chip card 1 to 3 . The operating system kernel is at the center of the process 24 (KERNEL), its routines in privileged system mode 26th (SYSTEM MODE) must be executed. If partial messages of an incoming message are in the UART input buffer 18th present ( 30th ), ie when a specified fill level of the UART input buffer 18th is exceeded, an interruption is triggered ( 31 ) to the data input in the UART input buffer 18th to be able to treat with priority.

Contrary to what is associated with 2 the procedure described is now not the standard interrupt routine (ISR) 20th in restricted user mode 27 activated by means of a complex process change, instead the secondary buffer control is used 12th (SECONDARY BUFFER CONTROL) activated by means of a corresponding interrupt request (IRQ) ( 32 ). The secondary buffer control 12th is due to its specialized implementation as virtual firmware of the secondary buffer 17th from the operating system kernel 24 in privileged system mode 26th activated without a process change. The execution of the secondary buffer control 12th instead of the traditional interruption process 20th when an interruption occurs ( 31 ) can be realized by the secondary buffer control 12th in an interrupt table with the data in the UART input buffer 18th triggered interrupt is linked as an associated interrupt handling routine (ISR). The secondary buffer control 12th can intervene faster than the interruption process 20th as they have immediate access to the secondary buffer 17th set up area of the RAM main memory 6th and when running in system mode 26th no time-consuming process change has to take place.

The secondary buffer control 12th read ( 33 ) the data from the UART input buffer 18th and writes ( 34 ) them in the secondary buffer 17th . As the secondary buffer 17th compared to the UART input buffer 18th preferably has a multiple data capacity, the storage volume of the UART input buffer is also multiple 18th in the virtual input buffer 17th through the efficient activation of the secondary buffer control 12th collected. Only when the secondary buffer 17th If a certain predetermined level exceeds, a function, but not in its implementation and activation, is triggered by the interruption process 20th the 1 comparable secondary interruption process 23 (SECONDARY INTERRUPT PROC) in user mode 27 activated by process change. The secondary buffer 17th So acts as one of the actual input buffer 18th Downstream virtual input buffer, since incoming partial messages are handled regularly by processes in user mode 27 is only initiated when in the secondary buffer 17th there is enough data.

Exceeding a specified fill level of the secondary buffer 17th is through the event monitoring 11 registered and by means of a secondary interruption signal ( 43 ) signals. In terms of software, this can be implemented as an "event". Conceptually, the secondary interruption signal ( 43 ) in the present context, however, is not a conventional event, but functions as a virtual interruption caused by the presence of partial messages in the virtual input buffer 17th is triggered. Alternatively, the event handling can also be carried out by the operating system kernel 24 or from the secondary buffer controller acting as virtual firmware 12th of the secondary buffer 17th to be provided.

Then the secondary interruption process 23 in user mode 27 started to partial messages from the secondary buffer 17th to read out ( 44 ) and in the memory area provided for this purpose 15th (BUFFER) to write ( 45 ). When combining the devices of the 1 and 3 (or the procedures of the 2 and 4th ) transmits ( 33 , 34 ) the secondary interruption process 23 Partial messages from the secondary buffer 17th in the ring buffer 16 where they are from the logging and storage process 21 , 22nd according to the in 4th illustrated procedure can be further processed.

As a result, a time-consuming process change in the in 4th outlined procedure does not apply to each in the UART input buffer 18th incoming byte carried out, but only if the larger secondary buffer 17th is filled. The resulting time gain can be achieved by the process control of the operating system kernel 8th for processing other application processes 19th can be used efficiently, with the expected increase in efficiency depending on the size of the virtual input buffer 17th is dependent.

Claims (56)

Method for receiving a message by a portable data carrier (1) with a non-volatile memory (5) and an asynchronous input buffer (18) which is continuously filled with partial messages, characterized by the steps: - -transmitting (33, 34) from partial messages present in the input buffer (18) in an intermediate buffer (16) of the data carrier (1); and - storing (40, 41) partial messages present in the intermediate buffer (16) in a non-volatile memory (5) of the data carrier (1) in such a way that the complete message is combined from the partial messages; wherein the steps of transferring (33, 34) and of storing (40, 41) are synchronized in such a way that partial messages from the intermediate buffer (16) are stored in the non-volatile memory (5) as long as the input buffer (18) has a predetermined value Level does not exceed. Procedure according to Claim 1 , characterized in that the steps of transferring (33, 34) partial messages in the intermediate buffer (16) and storing (40, 41) the partial messages in the non-volatile memory (5) are synchronized in such a way that partial messages from the input buffer (18) are transferred to the intermediate buffer (16) when the input buffer (18) exceeds a predetermined level. Procedure according to Claim 1 or 2 , characterized in that in the step of transferring (33, 34) partial messages into the intermediate buffer (16), the partial messages are transferred to an intermediate buffer (16) which is set up in a RAM memory (6) of the data carrier (1) and which is larger than the input buffer (18). Method according to one of the Claims 1 to 3 , characterized in that in the step of storing (40, 41) partial messages in the non-volatile memory (5) the message in a separate memory area (14) of the non-volatile Memory (5) is completely assembled and verified there. Method according to one of the Claims 1 to 4th , characterized in that the message assembled in the non-volatile memory (5) is made available to an application (13, 19) for which the message is intended. Method according to one of the Claims 1 to 5 , characterized in that the partial messages are stored page by page in the non-volatile memory (5). Method according to one of the Claims 1 to 6th , characterized in that partial messages are stored in the non-volatile memory (5) while the input buffer (18) emptied by the step of transmitting (33, 34) is being filled. Method according to one of the Claims 1 to 7th , characterized by the further step of ascertaining (38) information from partial messages present in the intermediate buffer (16), the ascertained information being length information about the length of the message and / or structure information about the structure of the message. Procedure according to Claim 8 , characterized in that after the step of determining (38) the information from the partial messages present in the intermediate buffer (16), the step of storing (40, 41) the partial messages in the non-volatile memory (5) is initiated, the determined Information is taken into account in the step of storing (40, 41). Procedure according to Claim 8 or 9 , characterized in that the determination (38) of the information and / or the storage (40, 41) of the partial messages in the non-volatile memory (5) is initiated or continued and the transmission (33, 34) of partial messages in the intermediate buffer (16) is set or interrupted when the intermediate buffer (16) exceeds a predetermined maximum level when transmitting (33, 34) partial messages into the intermediate buffer (16). Method according to one of the Claims 8 to 10 , characterized in that the transmission (33, 34) of partial messages in the intermediate buffer (16) is initiated or continued and the determination (38) of the information and / or the storage (40, 41) of the partial messages in the non-volatile memory (5) is set or interrupted when the intermediate buffer (16) falls below a predetermined minimum level and / or when the input buffer (18) exceeds a predetermined level. Method according to one of the Claims 8 to 11 , characterized in that the steps of transmitting (33, 34) partial messages in the intermediate buffer (16) and / or storing (40, 41) the partial messages in the non-volatile memory (5) and / or determining (38 ) the information are carried out as at least partially concurrent processes by a processor (2) on the data carrier (1). Method according to one of the Claims 1 to 12th , characterized in that an interruption (31) of the work of a processor (2) of the data carrier (1) is triggered and the transmission (33, 34) of partial messages to the intermediate buffer (16) is initiated as soon as the input buffer (18) has a exceeds the specified level. Method according to one of the Claims 8 to 12th with 13, characterized in that the transmission (33, 34) of partial messages in the intermediate buffer (16) as a process with high execution priority, the determination (38) of the information as a process with medium execution priority and the storage (40, 41) of the partial messages is executed in the non-volatile memory (5) as a process with low execution priority on the processor (2). Procedure according to Claim 14 , characterized in that further processes to be executed by the processor (2) are executed with a lower execution priority than the process of storing (40, 41) the partial messages in the non-volatile memory (5). Portable data carrier (1), comprising a processor (2), a non-volatile memory (5) and an asynchronous input buffer (18) which is continuously filled with partial messages of the message when a message is received, characterized by an intermediate buffer (16) and a Input control (10) which can be executed by the processor (2) and which is set up to transfer partial messages present in the input buffer (18) to the intermediate buffer (16); - to store partial messages present in the intermediate buffer (16) in the non-volatile memory (5); and - to synchronize the transmission (33, 34) and the storage (40, 41) in such a way that partial messages from the intermediate buffer (16) are stored in the non-volatile memory (5) as long as the input buffer (18) has a predetermined filling level does not exceed. Disk (1) Claim 16 , characterized in that the input control (10) is set up to transmit (33, 34) partial messages in the intermediate buffer (16) and the storage (40, 41) of the partial messages in the non- to synchronize volatile memory (5) in such a way that partial messages are transferred from the input buffer (18) to the intermediate buffer (16) when the input buffer (18) exceeds a predetermined level. Disk (1) Claim 16 or 17th , characterized in that the asynchronous input buffer (18) is a UART memory module. Disk (1) after one of the Claims 16 to 18th , characterized in that the intermediate buffer (16) is a memory area set up in a RAM memory (6) of the data carrier (1), in particular a ring memory. Disk (1) Claim 19 , characterized in that the intermediate buffer (16) has a larger storage capacity than the input buffer (18). Disk (1) after one of the Claims 16 to 20th , characterized in that the data carrier (1) comprises an interruption device (9) which is set up to trigger an interruption (31) of a work of the processor (2) when the input buffer (18) exceeds a predetermined level. Disk (1) Claim 21 , characterized in that the input control (10) is set up to initiate execution of an interruption process (20) for the transmission (33, 34) of partial messages present in the input buffer (18) by the processor (2) in the event of an interruption (31). Disk (1) after one of the Claims 16 to 22nd , characterized in that the input control (10) is set up to execute a storage process (22) for storing (40, 41) partial messages present in the intermediate buffer (16) in the non-volatile memory (5) by the processor (2 ) to initiate. Disk (1) Claim 23 , characterized in that the storage process (22) is set up to store the partial messages page by page in the non-volatile memory (5). Disk (1) Claim 23 or 24 , characterized in that the storage process (22) is set up to provide the assembled message to an application (13, 19) for which the message is intended. Disk (1) after one of the Claims 23 to 25th , characterized in that a separate memory area (14) is set up in the non-volatile memory (5), and the storage process (22) is set up to output the message in the separate memory area (14) of the non-volatile memory (5) to merge the partial messages and to verify there. Disk (1) after one of the Claims 16 to 26th , characterized in that the input control (10) is set up to initiate execution of a protocol process (21) by the processor (2) which determines information from partial messages in the intermediate buffer (16), the information determined being length information about the length of the message and / or structure information about the structure of the message. Disk (1) after one of the Claims 23 to 26th with 27, characterized in that the input control (10) is set up to initiate an execution of the storage process (22) after the execution of the protocol process (21) has ended, the information ascertained by the protocol process (21) being transferred from the storage process (22 ) is taken into account. Disk (1) Claim 28 , characterized in that the input control (10) is set up to initiate or continue the execution of the protocol process (21) and / or the storage process (22) and to end or interrupt the execution of the interruption process (20) when the intermediate buffer (16 ) exceeds a predetermined maximum level as a result of the transfer (33, 34) of the interruption process (20). Disk (1) Claim 28 or 29 , characterized in that the input control (10) is set up to interrupt or terminate the execution of the protocol process (21) and / or the storage process (22) and to continue or start the execution of the interruption process (20) when the input buffer ( 18) exceeds a predetermined level and / or when the intermediate buffer (16) falls below a predetermined minimum level. Disk (1) after one of the Claims 16 to 30th , characterized by event monitoring (11) of the data carrier (1), which is set up to detect exceeding a predetermined maximum level and / or falling below a predetermined minimum level of the intermediate buffer (16) and to notify the input control (10) by means of a level signal. Disk (1) after one of the Claims 16 to 31 , characterized in that the data carrier (1) comprises an operating system (7) which is set up to process processes on the processor (2) to be executed concurrently, and the input control (10) is set up to initiate an at least partially concurrent execution of an interrupt process (20) and / or a protocol process (21) and / or a storage process (22). Disk (1) Claim 32 , characterized in that the input control (10) is set up to initiate the execution of the interruption process (20) with high execution priority, initiate the execution of the protocol process (21) with medium execution priority, and initiate the execution of the storage process (22) with lower execution priority. Disk (1) Claim 33 characterized in that the operating system (7) is set up to execute further processes to be executed by the processor (2) with lower execution priorities than the storage process (22). Disk (1) after one of the Claims 16 to 34 , characterized in that the input control (10) is part of an operating system (7) of the data carrier (1) and / or an operating system kernel (8) of the data carrier (1). Disk (1) after one of the Claims 16 to 35 , characterized in that the data carrier (1) is a chip card, a secure multimedia card, a USB storage medium or a cellular phone card. Method according to one of the Claims 1 to 15th for receiving a message by a portable data carrier (1) with an operating system (7) which supports a system mode (26) and a restricted user mode (27), characterized by the step of forwarding (33, 34) from in the input buffer ( 18) present partial messages in a secondary buffer (17) of the data carrier (1) which is larger than the input buffer (18), the step of forwarding (33, 34) being carried out by the operating system (7) in the privileged system mode (26) becomes. Procedure according to Claim 37 , characterized in that an interruption (31) of a work of the processor (2) is triggered and the step of forwarding (33, 34) is initiated when the input buffer (18) exceeds a predetermined level. Procedure according to Claim 38 , characterized in that a secondary buffer control (12, 25) is activated in response to the interruption (31), which carries out the forwarding (33, 34) of partial messages from the input buffer (18) into the secondary buffer (17) in such a way that no Process change must be made by the operating system (7). Method according to one of the Claims 37 to 39 , characterized in that a fill level of the secondary buffer (17) is monitored and a secondary interrupt signal (43) is triggered when the secondary buffer (17) exceeds a predetermined fill level. Procedure according to Claim 40 , characterized in that in response to the secondary interruption signal (43) a secondary interruption process (23) is activated, which transmits partial messages present in the secondary buffer (17) to a memory area (15) of the data carrier (1), in particular into the intermediate buffer (16) . Procedure according to Claim 41 , characterized in that the secondary interruption process (23) is executed by the operating system (7) in the restricted user mode (27). Procedure according to Claim 41 or 42 , characterized in that a process change is carried out by the operating system (18) in order to carry out the secondary interruption process (23). Method according to one of the Claims 41 to 43 , characterized in that partial messages present in the memory area (15) of the data carrier (1) are processed and / or are stored in a target memory area and / or are made available to an application (13, 19). Method according to one of the Claims 37 to 44 , characterized in that method steps are carried out by the processor (2) in the form of at least partially concurrent operations and / or processes. Portable data carrier (1) according to one of the Claims 16 to 36 , comprise an operating system (7) which supports a system mode (26) and a restricted user mode (27), characterized in that the data carrier (1) has a secondary buffer (17) which is larger than the input buffer (18), and a secondary buffer control (12, 25) which can be executed by the processor (2) in the privileged system mode (26) and which is set up to forward (33, 34) partial messages present in the input buffer (18) to the secondary buffer (17). Disk (1) Claim 46 , characterized in that the secondary buffer (17) is implemented as a storage area in a RAM memory (6) of the data carrier (1). Disk (1) Claim 46 or 47 , characterized in that the secondary buffer control (12, 25) is integrated into the operating system (7) as virtual firmware (12, 25) of the secondary buffer (17) which can be operated in the system mode (26). Disk (1) after one of the Claims 46 to 48 , characterized in that the data carrier (1) comprises an interrupt device (9) which is set up to activate the secondary buffer control (12, 25), which can be operated in the system mode (26), as the interrupt handling routine assigned to the interruption (31) during the interruption (31) . Disk (1) Claim 49 , characterized in that the secondary buffer control (12, 25) is set up to be activated by the operating system (7) in the event of an interruption (31) without a process change. Disk (1) after one of the Claims 46 to 50 , characterized in that the data carrier (1) comprises an event monitoring (11) which is set up to monitor a fill level of the secondary buffer (17) and to trigger a secondary interrupt signal (43) if the secondary buffer (17) exceeds a predetermined fill level. Disk (1) Claim 51 , characterized in that the data carrier (1) comprises an input control (10) which is set up, in response to a secondary interrupt signal (43), to execute a secondary interrupt process (23) for transferring (44, 45) from in the secondary buffer (17) present partial messages in a memory area (15) of the data carrier (1), in particular in the intermediate buffer (16). Disk (1) Claim 52 , characterized in that the operating system (18) is arranged to operate the secondary interruption process (23) in the restricted user mode (27). Disk (1) Claim 52 or 53 , characterized in that the input control (10) is set up to process partial messages present in the memory area (15) and / or to copy them into a target memory area and / or to make them available to an application (13, 19). Disk (1) after one of the Claims 46 to 54 , characterized in that the operating system (7) is set up to execute processes on the processor (2) concurrently. Disk (1) after one of the Claims 46 to 55 , characterized in that the input buffer (18) can hold fewer than five bytes, preferably one byte, and the secondary buffer (17) can hold at least five bytes.

Images