DE102012024250B4 - Process for providing chips with a high level of copy protection, in particular for digital authentication systems such as chip cards or the like, and chips produced therefrom - Google Patents

Abstract

Method for providing chips (6) with a high copy protection function, in particular for digital authentication elements such as chip cards (4) or the like, in which a security operating system (OS) is provided for the chips (6), which is composed of individual program modules (M). , characterized in that the individual program modules (M) of the security operating system (OS) are combined with one another differently with the aid of a linker (14) for different chips (6), so that for a respective chip (6) a chip-specific operating system (C -OS) is generated and read into a memory (10) of the chip (6), the chip-specific operating systems (C-OS) having the same functionality but a different structural design that the linker (14) is integrated in the chip (6). is that the number of program modules (M) is >50, that the linker (14) randomly assembles the program modules (M) and that the program modules (M) have a uniform module size and/or are subsequently brought to a uniform module size, the program modules (M) being transferred in parallel to a plurality of chips (6) and the chip-specific operating system (C-OS) being generated on each of these chips (6).

Description

The invention relates to a method for providing chips with a high copy protection function for embedded systems, in particular, for example, for digital authentication systems such as chip cards or the like, and for other microprocessor-controlled systems. The invention further relates to chips manufactured by this method.

Digital authentication elements such as chip cards are used in many areas to enable access to protected data or systems that are only accessible to a specific group of users. Users are understood to mean both natural persons and automated systems for machine-to-machine communication. Authentication elements are also understood to mean, in particular, elements for creating electronic signatures.

A chip is generally understood here to mean an integrated circuit with at least one memory and one microprocessor. Such a chip need not necessarily be integrated into a card as a carrier. For example, memory sticks (USB sticks) and other media are also available as carrier media. Chip cards are referred to below for the sake of simplicity.

Such chip cards are used, for example, as a means of payment (money cards) as SIM cards for mobile phones, as electronic tickets, as signature cards or as decoder cards, for example for pay-for offers (pay-TV) or other access systems. In particular, chips of this type are also used in identification cards or identity cards, such as passports, ID cards, driver's licenses, health cards, etc.

With these chip cards, also known as smart cards, data security plays a major role. User-specific authentication and access data are usually stored on the card itself as sensitive data, such as user-related keys, which can also be used to generate electronic signatures, among other things. Sensitive personal data (e.g. biometric data) can also be stored.

In order to secure this sensitive data on the card, it is protected from unauthorized access by the microprocessor using a cryptographic process stored on the chip. The aim of every attack is to determine and access sensitive data.

There is a great need to prevent such unauthorized access to sensitive data. Knowing this data enables such systems to be misused and such chip cards, for example for pay-TV, with the corresponding access options to the protected content, can be created by unauthorized third parties.

In the EP 2 249 291 A1 describes a method for increasing the security of an existing contactless chip card technology, which also deals with the same problem.

With today's smart cards, the cryptography process is stored in the security operating system in a ROM memory module on the chip. The encryption algorithm is therefore “hard-wired” into the ROM memory in the manner of firmware by interconnecting the individual electronic components. Based on the circuit pattern of the ROM memory, it is therefore possible to draw conclusions about the structure of the encryption algorithm and the entire structure of the operating system. The operating system also contains other information that is worth protecting, such as a data protocol (IP), in particular for memory management.

The operating system represents a certain security gap, since re-engineering processes pose the risk of its structure being analyzed. In this way, for example, information about the exact timing of program parts stored in the operating system can be obtained, so that targeted attacks or influencing of the process can be carried out. For example, a special command in the sequence program can be influenced in a targeted manner, for example a safety-relevant jump after an (EEPROM) write process.

Exact knowledge of the structure of the operating system, in particular the knowledge of which countermeasures were implemented against eavesdropping or manipulation of the data processing and how these were implemented, makes it easier for an attacker to identify weak points in the operating system and the underlying hardware, in which, for example, an encryption function is integrated is to be detected and exploited in order to access the protected sensitive data.

In this re-engineering, the procedure is usually such that the ROM memory chip is ground successively and the circuit pattern is analyzed layer by layer. Due to the small dimensions of such ROM modules and the high mechanical As a rule, a large number of individual ROM memory components are required for this re-engineering.

In addition to the authentication systems, a copy protection function of chips is generally of particular importance for any sensitive applications or also in principle to prevent the chip from being copied (reengineered), for example to avoid the copying of original components with integrated chips. This is an advantage for intelligent machines or vehicles in which functions are taken over by integrated chips.

Proceeding from this, the object of the invention is to increase the security for chips of this type, in particular by protecting the operating system against re-engineering.

The object is achieved by a method for providing chips for such digital authentication elements as chip cards or the like, in which a common security operating system is provided for several, preferably for all chips of a common authentication system, which is made up of individual program modules. The individual program modules are combined with one another in different ways using a linker for different chips, so that a chip-specific, executable operating system is generated for a respective chip and read into a preferably writable memory of this chip. The various chip-specific operating systems have the same functionality among themselves and are therefore identical in terms of their function. However, due to the different combination of the individual program modules, they have a different structure. A large number of differently structured operating systems are therefore provided for the total number of all chips in a common authentication system.

This refinement is initially based on the consideration that in newer systems the non-writable ROM memories are replaced by writable memories, in particular flash memories. The writable memory is therefore preferably such a flash memory or another memory that can be written at least once, for example a PROM (programmable read-only memory), EPROM (erasable programmable read-only memory) or an EEPROM (electrically erasable programmable read-only memory).

As an alternative to using writable memories, ROM memories are also used. A ROM memory is generally structured with the help of so-called masks, so that the desired data can be stored. When using ROM memories, a large number of different masks are preferably used to structure the multiple ROM memories, which are identical in terms of the function of the operating system generated by them, but different in terms of the structural design of the operating system generated, so that as a result again chip-specific operating systems are designed for at least a large number of the chips. A number of differently structured “chip-specific” operating systems corresponding to the number of different masks used are therefore provided. In principle, the number of different masks can correspond to the number of chips.

A different chip-specific operating system is preferably formed on each chip. In principle, however, this is not absolutely necessary. The number of differently structured operating systems (i.e. the number of different masks in the case of ROM) is at least in the two-digit range.

Furthermore, the invention is based on the consideration that the operating system is made up of a large number of individual program parts, the so-called program modules, with each individual program module usually defining a self-contained subfunction of the operating system. Finally, it is also taken into account here that the composition of the individual program modules can vary for an identical common overall functionality, ie for an operating system that is functionally identical for all chip cards. Accordingly, it is provided that the individual program modules are put together differently via the so-called linker. This makes re-engineering significantly more difficult, since a large number of individual memory modules is usually required for a respective re-engineering method. However, re-engineering requires that all memory modules are identical in terms of their structural design, which is defined by the burned-in algorithm, i.e. the algorithm stored in the memory (program code) must be used for a meaningful re-engineering with a large number of individual Chips must be identical not only in terms of their function but also in terms of their structural design.

This is precisely what is prevented by the method presented here, so that re-engineering is made more difficult, if not impossible.

This is based in particular on the fact that through the provision of chip-specific Operating systems in writable memory chip-specific, different (hardware) structures are generated. "Different structural design" means that different hardware structures are generated in the memory, i.e. that the program code is "burned in" when writing to the non-volatile flash memory, so that chip-specific, different hardware structures can be used at the same time identical function are generated.

Even if re-engineering of a chip-specific operating system is successful, an attacker still has no access to the chip-specific operating system of another chip. Because the code of this additional chip-specific operating system cannot be predicted.

A further advantage can be seen in the fact that the temporal (sequence) behavior of the chip-specific operating system also differs from chip to chip. Because if the entire program code (i.e. the sum of the individual program modules) is composed differently, temporary storage (cache), for example, is used differently, which can lead to different processes in terms of time. The cache behavior and thus the temporal behavior of the chip-specific operating system therefore changes from chip to chip and cannot be predicted.

The individual program modules are usually first generated by a programmer in a suitable programming language and then translated from this program or source language into machine code or the target language by means of a so-called compiler. These compiled program modules are then available to the linker.

A linker is generally understood to mean a computer program which compiles such individual program modules into an executable program. As already mentioned, the individual program modules are self-contained functional units, also referred to as so-called object files. In addition, so-called libraries can also be provided. These are compiled into a static, executable program file via the linker. So this is static linking to create an executable program. The individual program modules are linked to one another in such a way that the function and the program sequence are reliably guaranteed.

The individual program modules are expediently linked on the chip. The linker is therefore integrated on the chip as an "on board linker". This also increases security, since no finished program but only individual program modules are transferred to the chip. Eavesdropping on the data transfer from a computer on which the compilation was carried out to a remote computer, which is ultimately used to read the data into the flash memory, also does not result in a successful attack in order to gain possession of the security operating software bring.

The on-board linker is preferably also designed for subsequent changes, for example expansion or partial replacement of the security operating software, for example as part of updates.

Furthermore, to increase security, the program modules generated on the compiler computer are encrypted in a preferred development. In a preferred embodiment, these are then transmitted as an encrypted data set to the linker, in which the data set is decrypted and then the program modules are assembled to form the executable operating system.

In an expedient development, a further, first linker, referred to below as a compiler linker, is provided, which links the program modules to a first operating system. This first operating system - which is, for example, a master template operating system - is then changed to the actual operating system to be read into the memory of the chip by the actual linker, possibly taking into account further additional information, such as the relationships between the individual program modules in the first operating system . In contrast to the on-board linker, the compiler linker is preferably integrated on the compiler computer, at least not on the chip. The operating system generated by the compiler linker, ie the program modules linked to one another, is preferably transferred to the chip as the encrypted data record.

When assembling the individual program modules, the linker preferably uses the random principle, i.e. the linker contains a random number generator which determines which program modules are lined up in which order and how. This is done on the premise that the desired overall functionality and functionality is maintained, so that functionally identical security operating software is contained on all chips.

The number of individual program modules for the security operating system is expediently >50 and in particular >100. Usually, a higher number makes sense in order to appropriately limit the size of the individual modules. In combination with the random principle, there is a very large number of different combinations, so that re-engineering is virtually impossible.

In an expedient further development, a so-called boot loader is also integrated on the chip, which is responsible for external communication and which, in particular, also receives the program modules from the compiler computer. The linker receives the program modules from the boot loader and then links them to the chip-specific operating system, which is then read into the non-volatile memory (especially flash memory) by the linker.

Alternatively, it is fundamentally also possible for the program modules to first be read directly into the flash memory and only then assembled by the linker to form the chip-specific operating system.

Both the boot loader and the linker are therefore themselves executable programs that are assigned certain functionalities. The boot loader and/or the linker are preferably also contained in the flash memory. Alternatively, however, these can also be stored in a ROM memory.

The chip-specific operating system is preferably generated in parallel on a plurality of chips. For this purpose, in particular, a common contacting and data transmission unit is provided, via which in particular a power and communication channel is provided, so that the program modules or the template operating system are transmitted in parallel and simultaneously to the individual chips. The chip-specific operating system is then generated on the individual chips by the respective linker.

Several individual chips are usually produced together on a wafer. The individual chips on the wafer are expediently interconnected to form a simplified contacting and transmission unit. The communication channel - or path - is therefore already formed on the wafer side. Preferably in those areas of the wafer where the individual chips are mechanically separated from one another during further processing. The program modules are therefore transferred before the wafer is separated.

This aspect of the parallel transmission of the program modules, in particular also with the integration of the communication channel in the wafer, is regarded as an independent invention. The filing of a divisional application on this aspect - regardless of the generation of the chip-specific operating system remains reserved.

In an expedient development, the program modules (M) have a uniform module size or are brought to a uniform module size before they are linked individually via the linker. This increases the number of possible permutations. Because with different module sizes, the program modules usually cannot be interchanged arbitrarily, since, for example, positions are specified by a template depending on the size. In this context, module size is understood to mean, in particular, the memory requirement of the respective module, ie the byte size.

As a rule, the individual program modules have different module sizes because of their usually different range of functions. In order to standardize the module size, small modules in particular are enlarged, for example by adding empty information. Large modules can be divided and then, if necessary, enlarged again to the desired uniform module size.

An embodiment of the invention is explained in more detail below with reference to the figures. The only figure shows the basic process sequence in a simplified representation using a block diagram.

First, the individual program modules M of an operating software OS are programmed by a first service provider D1 and then fed to a compiler computer 2 in which the individual program modules M are compiled into the program modules M' into a machine-readable code. According to a first variant shown in the figure, these compiled program modules M′ are then encrypted and made available in a data file F(M′) as an encrypted data set.

This encrypted data set F(M') is transmitted to a second service provider D2, usually a service provider commissioned with the production of the individual chip cards. This provides a chip card 4 with an integrated chip 6 which has a microprocessor 8 and a non-volatile, writable memory 10 (flash memory). In the embodiment variant described here, the memory 10 has a boot loader 12 and a linker 14 which are designed as executable programs and are, for example, already preinstalled. The program of the boot loader 12 and/or the linker 14 is preferably also transmitted in a separate, encrypted file (once) by the software service provider D1. Alternatively, the linker 14 is included in the encrypted file F(M') as a first step.

The encrypted file F(M') is received by a loading computer 16 of the service provider D2. This is connected to a card device, not shown here, in order to transfer the data to memory 10 . In this case, the communication is preferably carried out via the boot loader 12 , which therefore receives the encrypted file F(M′) from the loading computer 16 , decrypts the encrypted program modules M′ again and makes them available to the linker 14 . With the help of a random number generator, the linker 14 then assembles the individual program modules M into a chip-specific operating system C-OS and stores this in a corresponding memory area of the memory 10 . All activities of the boot loader 12 and the linker 14 are controlled by the microprocessor 8 in this case.

According to a preferred alternative not shown here, in addition to the actual linker 14, a first linker, referred to as a compiler linker, is provided which, before the program modules M' are transferred to the chip 6, links them to a first operating system OS. The program modules M′ linked to one another in this way are preferably transmitted in encrypted form as the encrypted data record F(M′). The decryption is again performed, for example, by the loading computer 16 before the linker 14 then generates the chip-specific operating system C-OS.

In this case, the compiler linker creates the operating system OS as a kind of template from the program modules, ie from the object files and the program libraries, from which the actual chip-specific operating system C-OS is then generated. In addition to the individual program modules, the template also contains the relationships/references between the modules. When generating the chip-specific operating system C-OS, the linker 14 assigns specific addresses, ie links between the program modules, to the individual program modules using the known relationships.

The process of generating the chip-specific operating system C-OS is repeated for each individual chip card in a chip card system with a large number (several thousand) of chip cards from a system provider, i.e. the encrypted file F (M') only needs to be sent once to the chip card manufacturer D2 become. The charging computer 16 transmits this protected file F (M') to each individual memory 10 of the smart cards 4. All smart cards of the smart card system have the operating software OS, which is identical in terms of functionality, but which differs through the individual chip design in terms of their structural design, so the sequence of the program modules M differ.

The random number generator ensures that virtually no chip card has an identical chip-specific operating system C-OS. This means that re-engineering is virtually impossible.

reference list

2

compiler calculator

4

chip card

6

chip

8th

microprocessor

10

Flash memory

12

bootloader

14

leftist

16

charging calculator

M

program modules

M'

compiled program modules

F (M')

encrypted file

OS

operating system

C OS

chip-specific operating system

D1

Service provider 1 (software developer)

D2

Service provider 2 (chip card manufacturer)

Claims (8)

Method for providing chips (6) with a high copy protection function, in particular for digital authentication elements such as chip cards (4) or the like, in which a security operating system (OS) is provided for the chips (6), which is composed of individual program modules (M). is characterized in that the individual program modules (M) of the security operating system (OS) are combined with one another differently with the aid of a linker (14) for different chips (6), so that a chip-specific operating system ( C-OS) is generated and read into a memory (10) of the chip (6), the chip-specific operating systems (C-OS) having the same che functionality, however, have a different structural design, that the linker (14) is integrated in the chip (6), that the number of program modules (M) is >50, that the linker (14) assembles the program modules (M) randomly and that the program modules (M) have a uniform module size and/or are subsequently brought to a uniform module size, the program modules (M) being transferred in parallel to a number of chips (6) and the chip-specific operating system ( C-OS) is generated. procedure after claim 1 , characterized in that the chip-specific operating system (C-OS) is read into a flash memory (10). Procedure according to one of Claims 1 until 2 , characterized in that the program modules (M) are transmitted as an encrypted data set on the chip (6). Procedure according to one of Claims 1 until 3 , characterized in that a compiler linker is provided, which links the program modules (M) to a first operating system (OS), from which the linker (14) then generates the chip-specific operating system (C-OS). Procedure according to one of Claims 1 until 4 , characterized in that the number is >100. Procedure according to one of Claims 1 until 6 , characterized in that on the chip (6) a boot loader (12) is integrated, which receives the program modules (M). Method according to one of the preceding claims, characterized in that the program modules (M') are transmitted in parallel to a plurality of chips (6) with the aid of a common contacting and transmission unit. Chips (6) produced using a method according to one of the preceding claims.

Images