DE102021000077A1 - Integrated subscriber identity module with anti-rollback mechanism - Google Patents

Abstract

The invention provides a method for implementing an anti-rollback mechanism in an integrated subscriber identity module iUICC. The method is characterized in that - the secure processor (SP) further includes a magnetoresistive random access memory, MRAM, (MRAM), which can be used exclusively by the SP core; - An anti-roll-back mechanism is set up in the memory management (Mem Mgr), by means of which it is verified on the occasion of each start of the operating system or whether the operating system meets the requirements of the anti-roll-back mechanism; and - the operating system is only executed on the Secure Processor (SP) under the condition that the operating system meets the requirements of the anti-roll-back mechanism.

Description

field of invention

The invention relates to a method for implementing an anti-rollback mechanism in an integrated subscriber identity module which is integrated in a chipset for a mobile radio-capable terminal.

State of the art

The world is mobile connected, and mobile connectivity is progressing. Cellular-capable end devices communicate via cellphone networks. The classic cell phone-enabled end devices include mobile end devices such as smartphones and mobile phones and cell phone-enabled tablets. Mobile radio-capable end devices also include control devices (control devices or measuring devices or combined control/measuring devices) for industrial facilities in the commercial or private environment. Industrial facilities are, for example, production facilities that have one or more control devices (terminals) that can communicate with a background system and/or with one another via a mobile radio network. Other industrial facilities are smart home facilities such as heaters or electricity consumers with end devices in the form of control devices.

The terminal has a chipset with one or more terminal chips for operating functions of the terminal. Current (and older) smartphones, for example, typically have a chipset that includes at least three end device chips, namely a transceiver IC that performs the physical radio communication, a baseband processor BB (or equivalently modem) that performs data transmission functions via radio communication Protocol level performs, and an application processor AP, on which the operating system and application software, e.g. Applications (e.g. apps) are running. Transceiver ICs for other radio channels can be provided as further terminal chips, in particular for short-range radio channels such as NFC (NFC: Near Field Communication) or Bluetooth. Firmware is implemented on the chipset, in particular on the Application Processor AP, i.e. special software that implements the basic functionalities of the chipset. The firmware includes, for example, the operating system of the application processor and possibly the operating system of other processors that have an operating system, hardware-related software, e.g. the transceiver IC and the baseband processor BB, and possibly programming interfaces (APIs).

In order to use a cellphone-enabled terminal device, such as a smartphone or cellphone, in a cellphone network of a network operator, the terminal device contains a subscriber identity module with a subscription profile, or profile for short. The profile manages the configuration of the terminal and the connection of the terminal in the mobile network. The profile is formed by a structured data set that enables the terminal device to establish, operate and clear down a connection in the mobile radio network, and includes, for example, a cryptographic authentication key Ki and an International Mobile Subscriber Identity IMSI.

The subscriber identity module can conventionally be integrated into carriers of different form factors, in particular plug-in and embedded carriers. Subscriber identity modules in plug-in form factor carriers (e.g. classic SIM card) and embedded (module intended for soldering into an end device) are arranged on a dedicated, proprietary chip or SoC (system-on-chip).

A more recent concept for the form factor of a subscriber identity module is integrated subscriber identity modules that are integrated on a terminal device chip or SoC (system-on-chip) of the terminal device, ie do not have their own chip. Integrated subscriber identity modules are provided with the suffix "integrated" or "i" and are designated, for example, as integrated UICC, iUICC, iSIM or iUSIM. In this concept, the integrated subscriber identity module is integrated as a secure processor in another terminal chip, for example in the baseband processor or the application processor. The secure processor can be designed, for example, as an ARM SC300 core or a comparable secure processor with a high level of security. A disadvantage of such a secure processor is that any memory space has high costs due to the security measures, so that the memory available in the secure processor is usually kept as small as possible. Often only the following memory areas are available within the secure processor: a secure RAM (Secure working memory, RAM = random access memory), a small OTP called one-time-programmable memory (OTP = one-time-programmable = once-programmable), and possibly a internal NVM (NVM = non-volatile memory) called very small non-volatile memory. In order to alleviate the problem of the low storage space in the secure processor, the iUICC concept generally proposes providing an external non-volatile memory in the chipset outside of the secure processor but within the chipset, in which memory contents are stored in such a way that they are secured, e.g. encrypted become so that only the Secure Processor can use them. Applications that belong to the Secure Pro cessor are stored securely in the external non-volatile memory can only be executed in the Secure Processor.

The Secure Processor has an operating system that is functionally identical or comparable or analogous to a SIM card operating system. The secure processor operating system is designed, for example, in principle according to a telecommunications standard such as ETSI TS 102 221 or 3GPP TS 31.102, according to which a file system (file system) is provided in the secure processor and authentication measures are provided.

Terminal chip sets of this type or parts thereof are also offered by Sony Semiconductors (formerly Altair), for example under the designation ALT1250.

An important criterion for trustworthy, secure UICCs and eUICCs is a memory content of the non-volatile memory that is secured against unauthorized manipulation, specifically with regard to the memory content of applications and data alike.

The memory content of classic UICCs can no longer be changed after production is complete and is therefore protected against manipulation by blocking write access.

Dedicated allow eUICCs reloading of operating systems, subscription profiles and updates (= updates) for subscription profiles. This creates the conflict that authorized changes to the memory content in the form of reloading operating systems, subscription profiles and updates (= updates) for subscription profiles must be possible, while unauthorized changes to memory content, in particular the import of outdated versions of operating systems or subscriptions, must be possible profiles, must be reliably prevented.

For the concept of an integrated iUICC as well as an eUICC, the mechanism is provided in which, in addition to the profile data, the entire operating system can also be exchanged remotely, since the SIM card cannot simply be physically exchanged. This mechanism is also known as eSIM management.

Anti-roll-back mechanisms for memory are known from the prior art, the aim of which is to recognize an outdated version of the memory content and its memory content in the memory that is updated so that new versions of the memory content are continuously stored Saving or preventing their use, and only allowing the use of the content of the memory on the condition that the version of the content of the memory is not older than the last current version. Monotonic counters, for example, are known as anti-rollback mechanisms, which only allow a new version of a memory content to be loaded or executed under the condition that the newly loaded version is not older than the previous version of the memory content. Alternatively, a memory fingerprint is generated, for example by generating one or more checksums, for example hash values, over the memory content, or only over certain segments of the memory content, of the memory, and as the fingerprint in an anti-roll-back memory get saved. If the memory content is updated, an updated fingerprint is generated and stored in addition to the fingerprint of the previous version. Thus, in parallel with the continuous updating of the memory content, a history of fingerprints of the memory content is stored in the anti-roll-back memory. If a version of the memory content that corresponds to an older version of the memory content is imported later, this version is recognized as not up-to-date and either it is already prevented from being saved or the use of the non-current memory content is prevented later. In this case, either the anti-roll-back memory or the mechanism for generating and/or verifying the fingerprint is secured in order to prevent the fingerprint from being manipulated in an unauthorized manner synchronous with the memory content.

Like the eUICC, the integrated Secure Element, iUICC, is also designed to receive and store continuous updates of operating systems, subscription profiles and updates (= updates) for subscription profiles.

Therefore, an anti-roll-back mechanism is also important for iUICC.

In some current iUICCs, the OTP memory within the Secure Processor is used as anti-roll back memory. Since the OTP memory is within the Secure Processor, the data stored therein, for example a version number of the memory content, is very well protected against manipulation and unauthorized access. Since the memory cells of the OTP can only be programmed once, the amount of new anti-roll-back information that can be stored in the OTP memory is severely limited. Correspondingly, the number of possible updates of the memory content that can be Roll-back mechanism can be accompanied, severely limited.

With iUICCs, on the other hand, it is to be expected that the operating system will be continuously updated over many years. An anti-rollback backup for operating system updates might still be manageable with an OTP memory over a sufficiently long period of time. In addition, new subscription profiles can be imported into the external NVM of the iUICC over many years. In addition to the existing subscription profiles, updates to the subscription profiles are imported at a similar frequency as the operating system updates. Updates to memory contents occur even more frequently while the iUICC is in operation. For example, an incorrect operation counter is changed each time a PIN is entered, with which it is ensured that a PIN can be entered incorrectly a maximum number of times at most, and then the iUICC is blocked for further use. In addition, while the operating system is running, applets and subscription profiles continuously and dynamically generate data that is stored encrypted in the external NVM while the applet or subscription profile is running.

This indicates that an OTP could be overwhelmed with the anti-roll back memory function over the lifetime of an iUICC.

Summary of the Invention

The object of the invention is to create an efficient and durable anti-roll-back mechanism for an iUICC.

The object is achieved by a method according to claim 1. Advantageous refinements of the invention are specified in the dependent claims.

The method according to claim 1 is directed to an implementation of an anti-rollback mechanism in an integrated subscriber identity module iUICC.

The integrated subscriber identity module includes a secure processor integrated in a chipset for a mobile radio-capable terminal. The Secure Processor in turn includes an SP Core, i.e. the CPU of the Secure Processor, an exclusive main memory of the Secure Processor, which can only be used by the SP Core, and a memory management (memory manager) of the Secure Processor, which can only be used by the SP Core is.

The integrated subscriber identity module further comprises an external non-volatile memory integrated in the chipset and thereby outside the Secure Processor, in which encrypted SIM data are stored, which can only be decrypted by the Secure Processor and executed within the Secure Processor. Physically, the external non-volatile memory is not located in the Secure Processor unit, logically and at runtime, when code (operating system, application, ...) is executed by the SP Core in the main memory, the external non-volatile memory belongs on the other hand to the Secure Processor unit.

The subscriber identity module is set up to receive data and store it as SIM data or as additional SIM data in the external non-volatile memory.

The SIM data include at least one operating system or multiple operating systems of the integrated subscriber identity module.

• - der Secure Processor weiter einen Magnetoresistive-Random-Access-Memory-Speicher, MRAM-Speicher, umfasst, welcher ausschließlich durch den SP Core nutzbar ist;
• - in der Speicherverwaltung ein Anti-Roll-Back-Mechanismus eingerichtet ist, durch welchen anlässlich jedes Start des Betriebssystems - oder im Fall dass mehrere Betriebssysteme implementiert sind anlässlich jedes Start eines Betriebssystems - verifiziert wird, ob das Betriebssystem Vorgaben des Anti-Roll-Back-Mechanismus genügt; und
• - das Betriebssystem nur unter der Bedingung auf dem Secure Processor zur Ausführung gebracht wird, dass das Betriebssystem Vorgaben des Anti-Roll-Back-Mechanismus genügt.

The procedure is characterized in that:

• - the secure processor further comprises magnetoresistive random access memory, MRAM memory, which can only be used by the SP core;
• - an anti-roll-back mechanism is set up in the memory management, by means of which it is verified each time the operating system is started - or, in the event that multiple operating systems are implemented, each time an operating system is started -- whether the operating system meets anti-roll-back requirements -mechanism is sufficient; and
• - the operating system is only executed on the Secure Processor under the condition that the operating system meets the requirements of the anti-roll-back mechanism.

A magnetoresistive random access memory, MRAM memory, has the advantage over an OTP memory conventionally used for an anti-roll-back mechanism to enable a high number of write cycles, so that with an MRAM memory as Anti-roll back memory a variety of changes in SIM data can be recorded. On the other hand, an MRAM memory has sufficiently small structure sizes and a suitable manufacturing technology that it can be manufactured together with the other elements of the secure processor in a single manufacturing process. Compared to an MRAM, for example, an EEPROM memory could not be combined with the other elements of the memory in a single production process Secure Processor are manufactured. In addition, MRAM memories are very powerful.

Therefore, according to claim 1, a powerful and durable anti-roll-back mechanism for an iUICC is created.

• - Anlässlich eines Starts des Betriebssystems, um zu veranlassen, dass das Betriebssystem zur Ausführung gebracht wird, Bilden einer Prüfsumme über die gesamten SIM-Daten oder über eine definierten Teilmenge der SIM-Daten, gemäß Prüfsummen-Bildungsvorschriften;
• - Vergleichen der Prüfsumme mit mindestens einer im MRAM-Speicher gespeicherten Referenz-Prüfsumme;

wobei das Betriebssystem den Vorgaben des Anti-Roll-Back-Mechanismus genügt, wenn die Prüfsumme gleich der im MRAM-Speicher gespeicherten Referenz-Prüfsumme ist.Optionally, the anti-roll back mechanism includes:

• - When the operating system is started, in order to cause the operating system to be executed, forming a checksum over the entire SIM data or over a defined subset of the SIM data, in accordance with checksum formation rules;
• - comparing the checksum with at least one reference checksum stored in the MRAM memory;

wherein the operating system satisfies the requirements of the anti-rollback mechanism if the checksum is equal to the reference checksum stored in MRAM memory.

Optionally, on the occasion of a shutdown of the operating system, in order to cause the execution of the operating system to be terminated, the reference checksum in the MRAM memory is replaced or supplemented by a new reference checksum, with the new reference Checksum is used as a checksum for the anti-roll back mechanism.

SIM data, in particular subscription profiles, can be reloaded into an iUICC and change during operation. A new reference checksum must be created after each reloading and/or modification of SIM data. With an OTP as anti-roll back storage, the OTP would soon be exhausted. With an MRAM memory as an anti-roll-back memory, on the other hand, a large number of new reference checksums are possible via reloaded or changed SIM data. As a result, the MRAM memory according to the invention with an anti-roll-back mechanism has a long service life, even with frequent changes to the SIM data.

Optionally, the SIM data includes dynamic SIM data, dynamic SIM data being included in the checksum and in the reference checksum and possibly the new reference checksum. In particular, the dynamic SIM data are characterized in that they are changed or are changeable during the execution of the operating system, or can change or can be changed.

Optionally, continuously updated reference checksums are formed during the execution of the operating system and stored in the MRAM memory, the new reference checksum referred to above being formed on the basis of an updated reference checksum last stored in the MRAM memory when the operating system was shut down .

• - (1) entweder auf die gleiche Weise wie die Prüfsumme und die neue Referenz-Prüfsumme; wobei die zuletzt in den MRAM-Speicher gespeicherten aktualisierten Referenz-Prüfsumme als neue Referenz-Prüfsumme nach Anspruch 3 verwendet wird;
• - (2) oder indem:
  • --- im externen nicht-flüchtigen Speicher (ext NVM) fortlaufend Änderungs-Information über während der Ausführung des Betriebssystems auftretende Veränderungen an denjenigen dynamischen SIM-Daten, die in die Prüfsumme und die Referenz-Prüfsumme und eingehen, gespeichert wird;
  • — die fortlaufend geänderten aktualisierten Referenz-Prüfsummen über die jeweilige Änderungs-Information berechnet werden; und
  • --- die neue Referenz-Prüfsumme nach Anspruch 3 unter Verwendung der zuletzt in den MRAM-Speicher gespeicherten aktualisierten Referenz-Prüfsumme berechnet wird.

The continuously changing updated reference checksums stored in MRAM memory are optionally calculated:

• - (1) either in the same way as the checksum and the new reference checksum; wherein the updated reference checksum last stored in the MRAM memory is used as the new reference checksum according to claim 3;
• - (2) or by:
  • --- in the external non-volatile memory (ext NVM) continuous change information about changes occurring during the execution of the operating system to those dynamic SIM data that are included in the checksum and the reference checksum and is stored;
  • - the continuously changed updated reference checksums are calculated via the respective change information; and
  • --- the new reference checksum according to claim 3 is calculated using the last updated reference checksum stored in the MRAM memory.

Option (1) has the advantage that a current reference checksum is available at all times, which also survives, for example, a sudden failure of the supply of voltage or current to the subscriber identity module.

Option (2) of continuously collecting change information has the advantage that the entire reference checksum only has to be calculated once, so that computing resources are saved and the method is accelerated.

• - entweder: außerhalb des integrierten Teilnehmeridentitätsmoduls gebildet wird, wobei die Referenz-Prüfsumme anlässlich des Implementierens des Betriebssystems in das integrierte Teilnehmeridentitätsmodul in den MRAM-Speicher gespeichert wird;
• - oder: innerhalb des integrierten Teilnehmeridentitätsmoduls gebildet wird, nachdem das Betriebssystem in das integrierte Teilnehmeridentitätsmodul implementiert worden ist, und anlässlich eines initialen Boot-Vorgangs des Betriebssystems, der erfolgt, bevor das Betriebssystem erstmalig zur Ausführung gebracht wird.

Optionally, an initial reference checksum is formed with operating system code before the operating system code is first executed and provided as a reference checksum for the anti-rollback mechanism in MRAM memory, the initial reference checksum:

• - either: is formed outside of the integrated subscriber identity module, the reference checksum being made on the occasion of the implementation of the operating system in the integrated subscriber identity module is stored in the MRAM memory;
• - or: is formed within the integrated subscriber identity module after the operating system has been implemented in the integrated subscriber identity module, and on the occasion of an initial boot process of the operating system, which takes place before the operating system is brought to execution for the first time.

• - ein Zählerstand eines PIN-Fehlbedienungszählers;
• - ein Zählerstand eines Zählers;
• - während der Ausführung des Betriebssystems vom Betriebssystem erzeugte Daten;
• - während der Ausführung des Betriebssystems von einem im externen nicht-flüchtigen Speicher gespeicherten, ausschließlich im Secure Processor ausführbaren Applet erzeugte Daten;
• - während der Ausführung des Betriebssystems von einem im externen nicht-flüchtigen Speicher gespeicherten, ausschließlich im Secure Processor ausführbaren Subskriptions-Profil erzeugte Daten;
• - Aktualisierungsdaten, mit denen während der Ausführung des Betriebssystems SIM-Daten aktualisiert werden;
• - Applet-Aktualisierungsdaten, mit denen während der Ausführung des Betriebssystems ein im externen nicht-flüchtigen Speicher gespeichertes, ausschließlich im Secure Processor ausführbares Applet aktualisiert wird;
• - Profil-Aktualisierungsdaten, mit denen während der Ausführung des Betriebssystems ein im externen nicht-flüchtigen Speicher gespeichertes, ausschließlich im Secure Processor ausführbares Subskriptions-Profil aktualisiert wird.

Optionally, one or more of the following data elements are included in the dynamic SIM data:

• - a count of a PIN misoperation counter;
• - a count of a counter;
• - data generated by the operating system during the execution of the operating system;
• - data generated during the execution of the operating system by an applet stored in the external non-volatile memory and executable exclusively in the Secure Processor;
• - data generated during the execution of the operating system by a subscription profile stored in the external non-volatile memory and executable exclusively in the Secure Processor;
• - update data used to update SIM data while the operating system is running;
• - Applet update data used to update an applet stored in external non-volatile memory and executable exclusively in the Secure Processor while the operating system is running;
• - Profile update data used to update a subscription profile stored in external non-volatile memory and executable exclusively in the Secure Processor while the operating system is running.

Optionally, the SIM data further comprise a subscription profile or multiple subscription profiles of the integrated subscriber identity module, wherein the subscription profile or multiple subscription profiles are formed by a combination of code and/or data, and wherein the checksum and in the reference checksum includes code and/or data of the subscription profile or multiple subscription profiles, or parts of the code and/or data of the respective subscription profile.

Optionally, the operating system comprises operating system code and/or operating system data, and wherein in the checksum, and/or in the reference checksum, and/or in the new reference checksum, and/or in the updated reference checksums, and/or in the initial reference checksum at least the operating system code and/or the operating system data or one or more defined parts of the operating system code and/or the operating system data.

character list

• 1 ein System zur Veranschaulichung der Erfindung;
• 2 einen Ausschnitt aus dem System von 1, zur Veranschaulichung des Berechnens einer aktualisierten Referenzprüfsumme nachdem sich SIM-Daten geändert haben, gemäß einer Ausführungsform der Erfindung.

The invention is explained in more detail below using exemplary embodiments and with reference to the drawings, in which:

• 1 a system illustrating the invention;
• 2 a section of the system 1 13, illustrating calculating an updated reference checksum after SIM data has changed according to an embodiment of the invention.

Detailed description of exemplary embodiments

1 shows, in a schematic representation, an exemplary chipset suitable for a method according to the invention. The chipset includes the following components: a Secure Processor SP, a Baseband Core Processor BB (a BB is sometimes also referred to as a modem), an Application Processor AP (with one or more, here several, processor cores, ie processor cores or CPUs), a memory chip with a rewritable non-volatile memory NVM located outside the Secure Processor SP but inside the chipset. The chipset is housed in a chipset package. The non-volatile memory NVM is off in the example 1 as an external memory ext NVM arranged inside the chip package but outside the Secure Processor SP (i.e. not internal, located directly on the chip of the Secure Processor SP), but can alternatively also be located completely outside the chip package. In a further form, which 1 is shown in dashed lines, the non-volatile memory NVM is an internal memory int NVM of the Secure Processor SP, which is permanently assigned to the Secure Processor SP and is integrated into the chip of the Secure Processor SP, for example integrated at the level of the integrated semiconductor manufacturing technology. The components are in 1 coupled to each other via a system bus. Physically speaking, via the system bus, a communication channel CH is set up between the Secure Processor SP and the Baseband Core Processor BB, via which the Secure Processor SP and the Baseband Core Pro cessor BB can exchange data. The data is exchanged between Secure Processor SP and Baseband Core Processor BB in the communication channel CH at the protocol level as APDU commands according to the currently widely used ISO 7816 standard. Alternatively, the data is exchanged in a format other than the ISO 7816 APDU format. The communication channel CH can optionally also be designed as a secure channel S-CH, which is set up through authentication and key agreement and is operated through the subsequent encrypted exchange of data.

The Secure Processor SP comprises an SP Core (i.e. a CPU), the MRAM memory according to the invention, a read-only memory SP ROM (this is optional; in particular, another small non-volatile memory can also be present instead), an exclusive working memory SP RAM of the Secure Processor SP, a crypto unit CRYPTO, a memory management Mem Mgr and an interface unit I/O Unit. As mentioned, a small, rewritable, non-volatile memory NVM can also be included on the chip area of the Secure Processor SP, as indicated by dashed lines. The memory management Mem Mgr, the crypto unit CRYPTO and the interface unit I / O Unit are set up in cooperation with each other to set up and operate the communication channel CH between the Secure Processor SP and the Baseband Core Processor BB, in the case of a Secure Channel S-CH also by means Authentication and Encryption. An integrated subscriber identity module iUICC is set up in the Secure Processor SP. The read-only memory SP ROM and the SPinternal main memory SP RAM are specifically provided for the Secure Processor SP, optionally specifically for integrated subscriber identity modules iUICC on the Secure Processor SP. The chipset also has a general main memory RAM, shown here as external main memory ext RAM, which is outside of the Secure Processor SP and is available to the other processor cores as main memory.

2 shows a section of the system 1 13, illustrating calculating an updated reference checksum after SIM data has changed according to an embodiment of the invention. While the SP core (ie the CPU) of the Secure Processor SP is executing a subscription profile in the SP internal working memory SP RAM, SIM data SIM-DAT is used and modified SIM data SIM-DAT* is generated. At the latest before the SP Core or the operating system running on it is shut down, a reference checksum is generated, for example by an operating system command, symbolically referred to here as "DO <CHECKSUM>", and the reference checksum is stored in the MRAM memory MRAM. The next time the operating system of the SP Processor is started up, a new checksum is generated and compared with the reference checksum generated and stored as described above.

Cited prior art

[1] ETSI TS 122 016, Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); LTE; International Mobile Equipment Identities (IMEI); 3GPP TS 22.016 version 10.0.0 Release 10.

Claims (10)

Method for implementing an anti-rollback mechanism in an integrated subscriber identity module (iUICC); the integrated subscriber identity module (iUICC) comprising: - a secure processor (SP) integrated in a chipset for a mobile radio-capable terminal; the Secure Processor (SP) comprising an SP Core (CPU), an exclusive main memory (SP RAM) of the Secure Processor (SP), which can only be used by the SP Core, a memory management (Mem Mgr) of the Secure Processor (SP), which can only be used by the SP Core; - an external non-volatile memory (ext NVM) integrated in the chipset and thereby outside the Secure Processor (SP), in which encrypted SIM data are stored, which are exclusively decrypted by the Secure Processor (SP) and stored within the Secure Processor execution can be brought; wherein the subscriber identity module (iUICC) is set up to receive data and to store it as SIM data or as additional SIM data in the external non-volatile memory (ext NVM); wherein the SIM data comprises at least one operating system or multiple operating systems of the integrated subscriber identity module (iUICC); characterized in that - the secure processor (SP) further comprises a magnetoresistive random access memory, MRAM, (MRAM), which can be used exclusively by the SP core; - An anti-roll-back mechanism is set up in the memory management (Mem Mgr), by means of which it is verified on the occasion of each start of the operating system or whether the operating system meets the requirements of the anti-roll-back mechanism; and - the operating system is only executed on the Secure Processor (SP) under the condition that the operating system meets the requirements of the anti-roll-back mechanism. procedure after claim 1 , wherein the anti-roll-back mechanism comprises: - on the occasion of an operating system start, in order to cause the operating system to be brought to execution, forming a checksum over the entire SIM data or over a defined subset of the SIM data, according to checksum formation rules; - comparing the checksum with at least one reference checksum stored in the MRAM memory; wherein the operating system satisfies the requirements of the anti-rollback mechanism if the checksum is equal to the reference checksum stored in MRAM memory. procedure after claim 2 , wherein on the occasion of a shutdown of the operating system in order to cause the operating system to be terminated, the reference checksum in the MRAM memory is replaced or supplemented by a new reference checksum, and on the occasion of a subsequent restart of the operating system the new Reference checksum is used as a checksum for the anti-roll back mechanism. procedure after claim 2 or 3 , wherein the SIM data comprises dynamic SIM data, and wherein in the checksum and in the reference checksum and in the case of claim 3 the new reference checksum incoming dynamic SIM data; the dynamic SIM data in particular being characterized in that they are changed or are changeable during the execution of the operating system, or can change or can be changed. Procedure according to one of claims 2 until 4 , wherein during the execution of the operating system continuously updated reference checksums are formed and stored in the MRAM memory, and the new reference checksum after claim 3 is formed on the basis of an updated reference checksum last stored in the MRAM memory when the operating system was shut down. procedure after claim 5 , wherein the continuously changing updated reference checksums stored in the MRAM memory are calculated: - (1) either in the same way as the checksum and the new reference checksum; the last updated reference checksum stored in the MRAM memory as the new reference checksum claim 3 is used; - (2) or by: --- in the external non-volatile memory (ext NVM) continuous change information about changes occurring during the execution of the operating system to those dynamic SIM data that are included in the checksum and the reference checksum and , is stored; --- the continuously changed updated reference checksums are calculated using the respective change information; and --- the new reference checksum claim 3 is calculated using the last updated reference checksum stored in MRAM memory. Procedure according to one of claims 2 until 6 , wherein an initial reference checksum is formed with operating system code before the operating system code is brought to execution for the first time, and is provided as a reference checksum for the anti-rollback mechanism in MRAM memory, the initial reference checksum: - either: is formed outside of the integrated subscriber identity module (iUICC), the reference checksum being stored in the MRAM memory when the operating system is implemented in the integrated subscriber identity module (iUICC); - or: is formed within the integrated subscriber identity module (iUICC), after the operating system has been implemented in the integrated subscriber identity module (iUICC), and on the occasion of an initial boot process of the operating system, which takes place before the operating system is brought to execution for the first time. Procedure according to one of Claims 1 until 7 and claim 4 , wherein the dynamic SIM data includes one or more of the following data elements: - a count of a PIN misoperation counter; - a count of a counter; - data generated by the operating system during the execution of the operating system; - data generated during the execution of the operating system by an applet stored in the external non-volatile memory (ext NVM) and executable exclusively in the Secure Processor (SP); - data generated during the execution of the operating system by a subscription profile stored in the external non-volatile memory (ext NVM) that can only be executed in the Secure Processor (SP); - update data used to update SIM data while the operating system is running; - Applet update data used to update an applet stored in the external non-volatile memory (ext NVM) and executable exclusively in the Secure Processor (SP) while the operating system is running; - Profile update data, with which an im exter A subscription profile stored in a non-volatile memory (ext NVM) that can only be executed in the Secure Processor (SP) is updated. Procedure according to one of Claims 1 until 8th , wherein the SIM data further comprise one or more subscription profiles of the integrated subscriber identity module (iUICC), wherein the subscription profile or multiple subscription profiles are formed by a combination of code and/or data, and wherein in the checksum and the reference checksum include code and/or data of the subscription profile or of the plurality of subscription profiles, or parts of the code and/or data of the respective subscription profile. Procedure according to one of Claims 1 until 9 , wherein the operating system comprises operating system code and/or operating system data, and wherein in the checksum, and/or in the reference checksum, and/or in the case of claim 3 into the new reference checksum, and/or in the case of claim 5 into the updated reference checksums, and/or in the case of claim 6 at least the operating system code and/or the operating system data or one or more defined parts of the operating system code and/or the operating system data go into the initial reference checksum.

Images