DE19752695A1 - Electronic switching element for blocking electronic parts in a chip card - Google Patents

Abstract

An electronic switching element (S) in a chip card or electronic system comprising one or several chips (9) and/or electric components has four inputs (E1, G1, E2, G2) and two outputs (E3, G3) to which an additional component (T), chip part (T) is connected. The switching element (S) contains voltage-controllable switches. The switching element forms a "firewall circuit" for separating parts of chip cards or other types of electronic systems.

Description

Problem

In electronic circuits such as those used in chip cards the problem arises, parts of the circuits are electrical separate from their surroundings in order to protect them from unwanted access to protect. These circuits are intended to access certain memory data such as a number of monetary units but also personal data (Blood group, account numbers ...) can be prevented.

Task

The invention has for its object the security of the use of Increase smart cards and electronic systems. To this end chip parts or system components are removed from electrical access moved or provided. The electrical separation of chip parts is that Basic measure of backing up data and information. The triggers Solution (activation / deactivation) of an electrical separation of the chip part len can be triggered logically or physically. A chip part in an egg his electronic system is in the physika with a logical access The state that allows access. Serves as an illustrative example a fire door that is physically a first room from a second separates as long as a bolt in the door by a temperature difference physi is locked and is open when the temperature difference is reduced. This fire door can be used with a suitable key (key code, PIN Code on an electronic component etc.) cannot be opened. Without physically locked latch (physical condition) could be correct can also be opened in the event of a fire according to the code. Instead of fire door is in Information technology groups the English term "firewall" ver turns, with which the user of a chip part secured by "firewall" (e.g. on a card) sets the association, it is an ir kind of physical, mechanical protection of chip parts. Despite the term used (firewall), informal is often sufficient (Logical) measures (entering code, introduced virus pro gram, random discovery of the PIN number) to the backup overcome. This patent description shows a way the security of electronic systems such as chip cards, chips, personal data nal computers but also of many objects of everyday life to increase on a physical basis.  

Description of the patented solution

The patent description allows the task to be fulfilled.

To clarify the possible switching function of switching element S, reference is made to FIG. 1 and truth table 1 .

To claim 1

The essential features of the invention are contained in claim 1. Electronic circuits are contained in miniaturized form in chip cards but also in devices / parts of everyday life (e.g. personal computers). The claims described can therefore be used in chip cards but also in other devices / systems. Chip cards can have galvanically designed contact connections 10 as well as contact-free connections, designed as contact-free transmission elements 7 such as coils, antennas, capacitor plates, for energy and / or data exchange. However, there may also be additional voltage sources for data backup in the chip card (the electronic system). An electronic switching element S in a chip part contains four inputs E1, G1, E2, G2 and two outputs E3, G3 (see FIGS. 1, 2, 3). Switching element S contains switching elements 51 , 52 , 53 , 54 controlled by an electric field. The chip card (electronic system) has a voltage source US1 with the two poles U1, G1 and a second, electrically and spatially separated voltage source US2 with U2 G2. It can be external voltage sources such as batteries, as well as internal voltages from rectifiers. There can also be voltage sources which are connected via switches or physical sensors (see documents DE 195 30 823, DE 42 05 827, DE 42 05 556). At least one chip part T, which is electrically connected to the output E3, G3 of the switching element 5, should be contained in the chip card or in the electronic system. There is a first voltage source US1 with the two poles U1, G1 connected to the inputs E1, G1 and a second, electrically and spatially separate voltage source US2 with the two poles U2, G2 connected to the inputs E2, G2. With the help of a switching element S, the inputs E1, G1 with the outputs E3, G3 are in the first case when US1 is exclusively applied, or the inputs E2, G2 with the outputs E3, G3 in a second case when US2 is exclusively present Charge transport connected. The case in which US1 and US2 are present simultaneously is of importance. Only one case (an applied voltage) should dominantly close the other case for the charge transport. By means of the switches opened for the charge transport, the component T is connected to the voltage which is maintained or changed by applying or disconnecting the dominant voltage. This voltage dominance clearly regulates how T is electrically connected to other components or blocked. Fig. 1 shows an embodiment of the switching element 1 described. It can be seen that S1 controls the connection between E1 and E3 and S3 that between G1 and G3. S2 controls the connection between E2 and E3 and S4 that between G2 and G3. There is exactly one switching element for each connection path between the two inputs and the output. An element T is alternatively connected to the voltage applied in each case. With two voltages present at the same time, z. B. the voltage at E2, G2. The truth table (Table 1) contains further input / output relations of a switching element S. The switching element 1 can also be designed so that polarized voltage sources at the input and output are possible (e.g. cases No. 3 and 5) in Table 1.

For example, a chip card functions as a con in a first case clock card in a second as a contact-free card, depending on the origin of the Supply voltage when using S an electronic part or the com plette chip of the card clamped to one or the other voltage. As a precaution, it should be noted that such a circuit does not Part 2.1.2 of DE 39 35 364 would have to be replaced because the information on the Output E3 would be the same in both cases. The chip in the card would have none Information about the operation of the card (the origin of the voltage) is available Also, EP 0 534 559 does not explain which switching element is used for Dominance is handled because of two tensions.

To claim 2

A special case exists (see FIG. 1) when the switching element S in a rest position without connecting a voltage to the inputs keeps a first connection open for the electrical charge transport between E1, G1 and E3, G3 and a second one between E2, G2 and E3, G3 keeps closed or the first connection closed and the second keeps open. With this embodiment of a switching arrangement, it can be determined that no disturbances on T are exceeded via the respectively opened connection.

Regarding claim 3

In switching element S, four switches S1, which can be controlled by voltage, S2, S3, S4 may be present. S1 controls the connection between E1 and E3 and S3 the between G1 and G3. S2 controls the connection between E2 and E3 and S4 between G2 and G3. With this embodiment determines that every connection between input and output on S ge nau has a switch. Switching element S can be used in many ways and other switches with the functions described.

To claim 4

Switching element S contains at least a fifth switch S5 in addition to the four available. S1, S2, S3, S4 block the transport of electrical charge between the input and output of S in the rest position. By blocking, T is electrically isolated from the environment in the rest position. The dominant voltage source controls switch S5 in such a way that switches S1, S2 are blocked for the transport of charge between the non-dominant voltage source at the input and the output of S. An embodiment is described in accordance with FIG. 2. The two components S1, S3 are designed in such a way that when a voltage is applied to them by means of an electrical field from US1 in the poles U1, G1 to E1, G1, electrical charge can be transported in them. S5 is said to have such an electrical pre-embossment in its rest position, that is to say without applying a field, that it is closed (conductive). The control voltage is at an input, which is usually called the gate and is separated from the other inputs with high impedance. S1, S2, S3 and S4 should be locked (non-conductive) in the idle state without field influence and should only be closed (conductive) when the field influences. If a first voltage is applied to a circuit according to FIG. 2, a first electrical connection E1 to E3, G1 to G3 is switched for both poles of this voltage source. The potentials U1, G1 are electrically identical both on the input side and on the output side of switching element S. If an additional voltage U2, G2 is applied to E2, G2, this is additionally applied to the control connections of the switch S5, whereby the control connections are separated from a voltage, whereby S1 and 53 are blocked, while S2, S4 become conductivity. The connection E1 to E3, G1 to G3 was interrupted when US2 was created and the connection E2 to E3, G2 to G3 was switched. Points U2, G2 are now electrically identical both on the input side and on the output side of switching element S. It is understandable for a person skilled in the art that switching element S can be constructed in many ways with different switching positions of switches S1, S3, S2, S4 and S5.

Regarding claim 5

In switching element S, switching parts S2, S4 should not be present or should not be controllable for charge transport, so that there is no connection from E2, G2 to E3, G3. In Fig. 1, the connecting lines from S2 to E3 and from S4 to G3 would no longer exist. When US2 is applied to the control connections S1, S3, these should block the electrical charge transport. Electrical connections between E1, E2 and E3, G1, G2 and G3 are therefore disconnected during the period from US2 to E2. With this switching element S, a chip part T with its connections can be separated from its electrical environment in the simplest way. If the voltage US2 is triggered by a physical event, such as temperature, by a manual switch, the part T is separated as long as the physical condition for US2 continues. Such a switch can be referred to as a "firewall switch". T is no longer in the physical state that is a prerequisite for a logical connection.

To claim 6

Chip part T can be activated or deactivated via address lines G (A1 to An) be fourth. The address lines are covered by one or more scarves telemente S electrically separated or opened. Address lines are used for Addressing components or components in electronic systems men over a bus for data and / or address lines for the Aus choice (electronic activation, deactivation of a component) of com components.

To claim 7

Chip part T can consist of a combination of memory parts M1, M2. M1, M2 also have different memory characteristics. Dynamic memories require a constantly recurring refresh signal to store their information, while EEPROM's do not need one. Even unchangeable read-only memories can be characterized with M1, M2. The individual memory cells in M1, M2 are to be activated or deactivated via address lines A1 to An (see FIG. 3). The individual cells of memories are encoded by the assignment of these address lines with voltage, the group of address lines GL from A1 to An to memory M1 and group GH from A1 to An to memory M2 to activate or deactivate. Switching elements S of the type described above can electrically isolate and / or connect one or the other group GH, GL of the address lines, provided that the corresponding voltages (physical conditions) are present at their inputs. In this way, the memory parts M1, M2 in chip cards, depending on external conditions, can be addressed differently or separated from their electrical environment. Thus, a chip card can activate or deactivate certain memory parts and / or memory areas differently with simultaneous contact operation and contact-free operation. Since programs (cards using the JAVA programming language in chip cards and electronic systems) will be loaded more and more in the future, the patented description prevents misuse by undetected intervention in the card. With a switching element S it is possible that programs are loaded into memory only when a physical condition is met, the card is in a device and z. B. a sensor or an additional input generates a first voltage that must be applied to the switching element S so that the connection to the memory part can be made. It can also be provided with a voltage on the card existing contact element.

Regarding claim 8

As described above, the voltages can be US1 or US2 Coils or can be fed into the card via contacts, but it is also possible to use additional sensors on the card, which Activate voltage sources. Can also be operated by hand Switches or any other generation of a signal can be used wherein the signal or a voltage source controlled by the signal as egg ne of the two voltages US1, US2 can be used (see DE 39 35 364). Depending on the circuit structure of the switching element S in the chip one The voltage generated by the card can fill the functions as it does are given in Table 1. One accessible by a card user Switching element is described in DE 42 05 556. This switching element can be used to highlight the separation of the connecting lines  to call or to abolish an existing separation. Such a deliberate action by a user is required, which the entered Built-in fuse activated or deactivated. One from a card user too Common sensor element is described in EP 562 292. It can physical, chemical, biological information according to local requirements tions are used. This sensor element can be used to Separation of the connecting lines or an existing one Break up separation (to bridge). A signal can also be used be, which by the stereo effect (according to DE 43 27 334) the proximity the map to a terminal. Should a card contain parts that each according to operating mode via coils for remote transmission or coils for Nahü Transmission receives your data, he can signal according to DE 43 27 334 testifies which US1, US2 are activated.

Regarding claim 9

An input connection can be saved if the separate reference potentials G2, G1 are connected to one another. In this case there is no complete separation for part 9 , since the reference potential G1, G2 is electrically identical. In many cases, this separation is sufficient unless the protected chip can be accessed via these unseparated lines. If a coil is in any spatial position in an alternating electromagnetic field, more or less energy is taken from the alternating field depending on the position of the coil relative to the field vectors, but the polarity of the DC voltage (the direction of the current flow) remains rectified after a rectifier. A coil used in this way can make two separate reference inputs for G1 or G2 superfluous.

Regarding claim 10

The first and / or the second voltage source can also be differentiated load for an electrical power output stand. It is required that the least are available de Source load is sufficient to control the voltage-controlled switches to close and / or open. With this requirement it is guaranteed that even signal sources with the lowest electrical power output for the control of the switches S1 ,. . . Sn is sufficient. Will be a bigger lei needed to supply T, this can be controlled via  Switch from another voltage source, which is used as a power source Is available to be won.

Description of the figures To Fig. 1

Fig. 1 shows the parts of a switching element S. The switching element contains the four switches S1, S3 and S2, S4 controlled by an electric field. E1, G1 are connected to E3, G3. The switches can be in the form of FET transistors (MOSFET) and in the rest position without US1 at E1, G1 (without field connection) can be blocking or conducting for electrical charge transport. S1, S3 are supposed to be conductive in the rest position and are blocked by the connection to input E2 when a voltage US2 is applied, whereby E1, G1 are separated from E3, G3. Simultaneously with the application of US2 to E2, G2, the blocking S2, S4 in the rest position become conductive and connect the outputs E3, G3 with E2, G2. T is therefore in one case connected to the two poles of US1 and in the other to that of US2.

To Fig. 2

Fig. 2 shows the parts of a switching element S. The switching element contains the five by electric field-controlled switches S1, S3 and S2, S4 and S5. The switches can be present as FET transistors (MOSFET) and in the rest position without US1, US2 at E1, E2 (without field connection) for electrical charge transport blocking or conductive. S1, S3, S2 and S4 should be open in the rest position and are only closed by applying a voltage US1, US2 to the input E1, E2. Simultaneously with the application of US2 to E2, G2, the S5 which is conductive in the rest position is opened and separates the input E1 from the switches S1, S3, which can therefore no longer be closed as long as US2 is present. T is therefore only applied to the two poles of US1 or to that of US2.

To Fig. 3

Fig. 3 shows a card 1 , which is shown in two modes of operation in the upper and lower part. Both parts contain contact connections 10 , contact-free connections 7 and a chip 9. The contact-free connections can consist of a coil or of several coils 7 for inductive coupling, but elements for capacitive, optical, acoustic or other physically evaluable transmission methods can also be provided . In the case of capacitive transmission, the elements 7 consist, for example, of capacitor plates. Combinations between different transmission elements are not excluded. The drawing parts 2 , 8 represent the coupling of energy and data between the parts 10 , 7 and the chip 9. It is 2 , 8 are electrical connecting lines that are physically active when energy and / or data (signals , Information) are transmitted by them. Direct voltages and changing digital voltages for data and clock signals are present on the contact lines, for example, as described in the ISO 7816 standard. Analog voltages are present on the contact-free lines, as described in the ISO 10536 or ISO 14443 standard. Chip 9 contains a microcontroller μC 3 in a known and widely used manner in chip cards, further a memory, which is composed of the primary memory M1 and the secondary memory M2. For physical reasons, memories require space for the task of storing data, which means that the division into M1, M2 provides two spatially separate memory parts. The parts M1, M2 can be spatially separated in a wide variety of ways, for example how black and white chess fields are spatially separated on a chessboard. The connecting lines between microcontroller 3 and memory 4 , 5 are identified by G and have the numbering A1. . .An in the upper part of the drawing. In the lower part are the A1. . . On divided into the groups GH (top) and GL (bottom). The group GL is separated by the switching element S.

In the upper part of Fig. 3, the connecting lines 8 are marked as physically inactive, ie there is no energy and no data is transmitted over these lines. Tensions cannot be tapped from these lines in the known manner. The lines 2 are marked as physically active, ie voltages can be tapped. A circuit which represents the tapping and the evaluation of the applied voltages is described in DE 39 35 364. If, as indicated in the drawing, only voltage is supplied via lines 2 , both primary memory M1 and secondary memory M2 are accessible, ie the individual memory cells of memory parts M1, M2 can be read and / or changed. With its contact function, the card with its security features is identical to cards on the market, the entire memory is accessible and is protected by logical measures. If part 7 is activated at the beginning of a time span Δt, voltage US1 is applied to 8 , as shown in the lower part of FIG. 3. When US1 to 8 occurs , the line group GH is electrically and / or mechanically separated as part of the lines G by switching element S, and only the primary memory M1 can be addressed / connected via the line parts GL. Access to the secondary memory M2 is thus interrupted during the time Δt when the coils are activated.

To table 1

There are the individual inputs with E1, G1, E2, G2 on the input side and E3, G3 assigned to the output side. With / symbolizes that there is no voltage. According to the descriptions of the Claims the individual cases clearly shown for the expert. For example, in case # 6, there is one on both input ports and second tension. The U2 pole will appear at output E3 and the reference potential G2 at G3. It is the second tension dominie rend. The circuit case in which the switches are specified is indicated with E3 inverted exactly the opposite poles from the inputs to the outputs switch through.

Differentiation from other writings

A card is known from EP 0 534 559 in which the functional doors voltage of a chip is described in two modes. Whereby according to claim 1 the first mode is reading a memory from a greater distance possible and in a second mode reading in a standard manner.

From DE 195 31 372 a card is known which, according to claim 1, switches an undivided memory as a function of a switching means 9 . The switching means ( 9 ) should only be controlled by the microprocessor and control by the coil should not be possible (column 3, lines 3-9).

Both descriptions lack the specification of two required voltages source with two poles U1, G2 and U2, G2 each. The switches are missing S1, S3, S2, S4, a switching element S with the specified is missing Inputs / outputs, T is missing, which in the specified way with both its reference potential, as well as its supply potential at An conclusions E3, G3 is placed, the voltage at E3, G3 automatically according to the description that appears at the input of a switching element S  lies. Features like spatially separated parts of a memory are missing Connection lines to the memory are missing, which are in a subset are divisible, the information such as the subset of the connection line is missing can be physically separated or electrically blocked, and there is no indication of an Er causing the blocking by voltage event that occurs in the energetic activation of the contactless Transmission elements in the present patent specification give is.

Table 1

Truth table for a switching element S

Claims (10)

1. Electronic switching element S in a chip card or an electronic system consisting of one or more chip (s) 9 and / or electrical components, switching element S constructed with four inputs E1, G1, E2, G2 and two outputs E3, G3 which the component T is connected to, switching element S containing voltage-controlled switches, characterized in that

• 1. a first voltage source US1 with the two poles U1, G1 can be connected to the inputs E1, G1 and a second, electrically and spatially separated voltage source US2 with the two poles U2, G2 to the inputs E2, G2,
• 2. With the help of a switching element S when US1 is exclusively applied, inputs E1, G1 with outputs E3, G3 in a first case, or when US2 is exclusively applied in a second case, inputs E2, G2 with outputs E3, G3 for the electrical charge transport are connected,
• 3. whereby if US1 and US2 are present at the same time, only one case dominantly closes the other case for charge transport,
• 4. with which the voltage applied to T is maintained or changed solely by applying or disconnecting the dominant voltage.

2. According to the preceding claim, characterized in that

• 1. the switching element S in a rest position without connecting a voltage at the inputs keeps a first connection for the electrical charge transport between E1, G1 and E3, G3 open and keeps a second between E2, G2 and E3, G3 closed or the first Connection closed and the second holds open.

3. According to the preceding claim, characterized in that

• 1. There are four switches S1, S2, S3, S4 that can be controlled by voltage in switching element S
• 2. where S1 controls the connection between E1 and E3 and S3 controls the between G1 and G3,
• 3. where S2 controls the connection between E2 and E3 and 54 between G2 and G3.

4. According to the preceding claims, characterized in that

• 1. switching element S contains at least a fifth switch S5 in addition to the four available,
• 2. where S1, S2, S3, S4 block the transport of electrical charge in the rest position,
• 3. with which T is electrically separated from the environment in the rest position,
• 4. the dominant voltage source controlling switch S5,
• 5. S5 blocks the switches S1, S2 for charge transport for the non-dominating voltage source.

5. According to the preceding claims, characterized in that

• 1. the switches S2, S4 are not present in the switching element S, the switches S1, S3, S5 are present,
• 2. with which there is no connection for the transport of electrical charge between the connections E2, G2 and E3, G3,
• 3. where, when the dominant voltage is applied, the switches S1, S3 block by means of the switch S5 for the electrical charge transport from E1 to E3 and G1 to G3,
• 4. with which all electrical connections between a part T and its environment are interrupted when the dominant voltage is present.

6. According to the preceding claims, characterized in that

• 1. the chip part T is activated or deactivated via address lines G (A1 to An),
• 2. The address lines can be electrically separated or opened by one or more switching elements S.

7. According to the preceding claims, characterized in that

• 1. the chip part T consists of a combination of memory parts M1, M2,
• 2. the individual memory cells in M1, M2 being activated or deactivated via address lines G (A1 to An),
• 3. the group of address lines GL from A1 to An to memory M1 and the group GH from A1 to An to memory M2 can be activated or deactivated separately,
• 4. one or / and the other group GH, GL of the address lines can be electrically separated or opened by one or more switching elements S.

8. According to the preceding claims, characterized in that

• 1. the first or the second voltage is generated in a chip card by a sensor, a manually operated switch, the stereo effect or another effect that triggers a voltage.

9. According to the preceding claims, characterized in that

• 1. the separate reference points G1, G2 are connected to one another.

10. According to the preceding claims, characterized in that

• 1. the first and / or the second voltage source with different power loads are available for an electrical power output,
• 2. where the lowest available source load is sufficient to close and / or open the voltage-controllable switches.