EP1989621A1

EP1989621A1 - Operating system for a chip card comprising a multi-tasking kernel

Info

Publication number: EP1989621A1
Application number: EP07722887A
Authority: EP
Inventors: Wolfgang Effing; Stephan Spitz; Erich Englbrecht; Robert Hockauf
Original assignee: Giesecke and Devrient GmbH
Current assignee: Giesecke and Devrient GmbH
Priority date: 2006-02-22
Filing date: 2007-02-21
Publication date: 2008-11-12
Also published as: DE102006008248A1; US20090222835A1; WO2007096153A1

Abstract

The invention relates to a method for operating a chip card (C), a microprocessor for inserting into the chip card (C), and a computer program product. The invention also relates to a method for the production and/or maintanance of a chip card (C) which is operated by mans of a previously described method. A central multi-tasking kernel (MTK) is used to control the entire operation of the chip card (C) such that a plurality of applications (A) can be simultaneously activated on the chip card (C). An application (A) can also perform security functions for the chip card (C).

Description

Operating system for a chip card with a multi-tasking kernel

The invention is in the field of smart card technology and more particularly relates to a method and a system for operating mobile data carriers.

Mobile data carriers today find a variety of applications, including as a smart card, such. As the EC card, the application as access control, smart cards in healthcare, in the field of mobile technology as a SIM card (Subscriber Identity Module). The SIM card is a check card-sized identification card for subscribers of a mobile service and is also referred to as a "smart card". In addition, there are a variety of other applications of smart cards, such as in the field of navigation technology, in digital dictation or camera asy stemen etc.

Usually, the mobile data carrier, in particular the chip card, comprises the following hardware resources: A microprocessor or a CPU (Central Processing Unit) for data processing, a plurality of data memories of different types, such as RAM (Random Access Memory), ROM (Read OnIy Memory) and the EEPROM (Electrical Erasable Read On Memory) and interfaces for data exchange between the various components, in particular between the microprocessor and the data storage and optionally to other modules on the smart card, and to other external modules that are provided outside the smart card and should be in data exchange with the chip card. It may be z. For example, readers or more complex back-office systems. Depending on the field of application, it is possible to run one or more applications on the chip card. In this case, if several applications are to be processed on a chip card, the security aspect gains more importance. Because it must be ensured that an unauthorized access to data can be safely prevented. With several applications on a card, the risk increases insofar as the applications must be reliably decoupled and isolated from a data-technical point of view. So z. B. be ensured that no unauthorized access to a particular memory area can be handled via another, foreign application.

Cards on which several applications can be handled thus require more security and are more complex; they require more extensive mechanisms for operating the card.

The operation of the chip card itself and the handling of running programs or applications fall within the scope of the operating system. Thus, the operating system is, so to speak, an interface between the actual application software and the underlying hardware of the chip card. Typically, today's command-driven smart card operating systems are based on the ISO-7816 standard known in the art. In this standard it is intended that all functions or commands of the operating system and the applications are triggered by commands that are received via an external interface. The commands are executed only sequentially, ie one after the other. In other words, there is only one control flow for processes in the respective programs. Current implementations on smart cards thus only consist of processes with a single execution path or with a single thread. Operating systems that have a multi Threading, so multiple execution paths support, are not yet known for smart cards. However, this is a serious disadvantage that significantly limits the flexibility in the use and operation of smart cards.

In order to counteract the disadvantage of low flexibility, it is provided in the prior art smart card operating systems of the newer generation that the program code can be reloaded at arbitrary times. This makes it possible to exchange individual modules or components of the chip card against others even after the card has been issued. Corresponding methods for loading applications via an ISO-7816-compliant interface are, for example, As described in the standard "Global Platform Standard, Global Platform Card Specification V2.1.1".

Operating systems that allow reloading of program code can basically be divided into two categories:

1. Operating systems in which it is intended to load a compiler already translated compiled code into the corresponding files of the smart card. However, this approach poses a major security risk since it is fundamentally possible that reloaded program code can also access foreign memory areas of other applications for microcontrollers that operate without a memory management unit (MMU for short).

2. Operating systems that are based on interpreting the program code to be reloaded on the chip card. The interpreter then checks during program execution which memory areas are addressed and can thus ensure that there are no unauthorized ones ^■ accesses to third-party applications. Among the best-known solutions of this approach are the Javacard specification (Javacard standard, Java Virtual Machine, Javasoft, JCS) and the C interpreter MEL (MEL stands for Multos Executeable Langauge) from Multos. The fundamental drawback of this second approach is that interpreters are basically slow to work and this can lead to poor performance.

Smart card microcontrollers currently on the market are usually equipped with processors that have no memory protection mechanisms or other monitoring options against unauthorized access. To counter this security risk, the reloaded program code is not executed directly, but only indirectly, eg. B. via a so-called virtual machine, the individual program commands (ie the byte code) in turn interpreted in platform-dependent program code, so that address ranges of individual programs or applications via the virtual machine or the interpreter are separated. The virtual machine defines which accesses are allowed or which data an application has access to. However, a major disadvantage is the fact that basically only interpreter code can be reloaded. Platform-dependent program code, eg. B. Input / output interface drivers can not be loaded after card output.

Another disadvantage is that the security of the memory protection is based on the security of the virtual machine or on the interpreter. It is possible to provide a so-called bytecode verifier which checks the bytecode accordingly. The disadvantage, however, is that the required checks of the verifier for resource and / or performance reasons mainly outside the smart card be performed. However, if the checks of the bytecode verifier are performed outside the smart card, it is vulnerable.

In addition, there is another, not negligible in practice disadvantage of the known solution in the smaller extent of memory protection. The memory protection in previous smart card operating systems based in this approach exclusively on the interpreter or on the virtual machine. A memory protection for more comprehensive, more complex systems that z. B. consist of several virtual machines, are not known. In other words, there are therefore no solutions for smart card operating systems with a memory protection during data exchange between multiple interpreters or multiple virtual machines on a smart card.

The present invention has therefore set itself the task of finding a way with which a significantly improved memory protection for smart card operating systems can be achieved and allows a more flexible use of smart cards. In addition, a multi-tasking operating system for chip cards or a corresponding chip card and a corresponding microprocessor to be provided.

This object is achieved by a method for operating a mobile data carrier, with a mobile data carrier, a microprocessor, a computer program product and with a method for producing and maintaining a mobile data carrier according to the appended independent patent claims.

In particular, the object is achieved by a method for operating a mobile data carrier which is equipped with the following resources: at least one microprocessor,

at least one data store, which usually consists of several different data storage areas, and

- Interfaces for data exchange between microprocessor and data storage and / or other modules that are assigned to the mobile data carrier, wherein on the mobile data carrier different applications can be performed by the mobile data carrier comprises a central control unit, the operation of the mobile data carrier , in particular the execution of the applications, controls and / or monitors in such a way that several applications can be active at the same time by assigning or depriving resources of an application according to a configurable scheduling mechanism and / or by controlling the data exchange.

The mobile data carrier is usually a chip card or a SIM card or other microprocessor cards that are in a terminal such. B. in a mobile device, such as a cell phone, can be used.

The invention can be used in different fields. Thus, the inventive mobile data carrier z. B. in navigation systems, PDAs, digital dictation systems, digital cameras or telephones are used. However, the main embodiment of the invention relates to a smart card, and thus the term smart card is to be understood as the main embodiment for a mobile data carrier.

A smart card typically includes the following hardware resources: a microprocessor for data processing, data storage and interfaces. It However, in alternative embodiments, it is also possible to provide additional resources here, such as. B. a mathematical coprocessor.

The interfaces are usually input / output interfaces. Here too, further interfaces, for example to other external and / or internal modules, which are assigned to the mobile data carrier, can be provided.

The central point of the method according to the invention for operating the chip card is the central control unit, which in the preferred embodiment is designed as a multi-tasking kernel and is part of an existing or new operating system for the chip card. The central multi-tasking kernel controls and / or controls processes on the chip card and provides protected areas for execution.

In contrast to known prior art operating systems in which the commands of the operating system or of the applications of commands which are received via the external interface are triggered and executed sequentially one after the other, according to the invention all commands are executed by the multi -Tasking kernel controlled. The multi-tasking kernel controls the operation of the chip card and the processing of the processes running on it such that several applications can be executed simultaneously on one and the same chip card. This is accomplished by the multi-tasking kernel operating on a scheduling mechanism that is preferably configurable. The scheduling mechanism is allowed - with regard to the entirety of all activatable or activated on the mobile data carrier applications - an optimized version or an optimized operation of the data carrier. The multi-tasking kernel enables a quasi-parallel execution of several software-based applications executable on the chip card. It synchronizes access to shared resources by means of the scheduling mechanism. Furthermore, it provides mechanisms for access protection that protect against unauthorized access to data and that serve to protect against impairment of the process. This is achieved by the multi-tasking kernel assigning appropriate allocations of computation time and resources to the applications according to the configurable scheduling mechanism. The execution or execution of commands is thus triggered according to the invention exclusively by the central multi-tasking kernel.

The multi-tasking kernel thus offers the possibility of executing various user programs or various applications virtually simultaneously, in particular with the option of allocating resources (such as, for example, certain memory areas in RAM or in non-volatile memory, interfaces or input / Output channels, cryptological modules, etc.) exclusively to an application and to withdraw them if necessary. This allows an application in conjunction with a smart card terminal z. For example, a "classic" smart card legacy task may be performed (eg, credit / debit commands) while another application is running in the background. Through the use of the multi-tasking kernel, a one-sided or mutual influence on active applications is reliably prevented, which advantageously increases the security of the overall system.

Each service or application has a protected address space. It is also possible for several applications to be combined with respect to memory management, so that they are integrated in a common address space. Advantageously, inventive According to a secure data exchange between all participating modules of the smart card will be enabled. In particular, the data exchange between the individual, different applications is completely secured by the multi-tasking kernel, as well as the data exchange with other modules that may be connected to corresponding interfaces to the smart card, which significantly increases the overall security of the overall system.

According to the invention, the functionality of the respective applications or services is not limited. Services that reside in a protected address space can even emulate the full functionality of a previously common smart card operating system (eg debit card, access control, SIM card, health card, etc.) in an environment that is protected from other services , The protection mechanism according to the invention can completely encapsulate the applications, so that a plurality of virtual smart cards can reliably coexist on a hardware platform.

In other words, it is possible by means of the multi-tasking kernel according to the invention to offer several "virtual" chip cards in strictly separate areas on a hardware platform, in particular on one and the same chip card. The individual applications, each of which realizes "virtual chip cards", are no longer grouped around the command interface, as in the case of classic state-of-the-art operating systems, but are controlled as services via the functions of the central multi-tasking kernel ,

Another central aspect of the present invention is seen in memory protection. According to the invention, memory protection for platform-dependent program code is implemented in the multi-tasking kernel. With that you can the above-mentioned disadvantages of the interpreter-based memory protection are overcome by the operating systems known from the prior art.

In an advantageous development of the invention, the multi-tasking kernel accesses a mechanism for supporting the separation of the address spaces, in particular a memory management unit (MMU for short) and / or a memory protection unit (MPU for short) ). An advantage of this mechanism is that a significantly improved security situation can be achieved compared to a purely software-based interpreter or a virtual machine of the prior art.

By using the multi-tasking kernel at a central location, ie at the hierarchically highest priority level, several simultaneous active applications can be executed on a chip card. This opens up the possibility that individual applications can access non-conflicting resources in parallel and thus simultaneously, and e.g. Exchange data via possibly different input / outpunt interfaces with external or internal systems. Cumulatively or alternatively, data in the background can also be processed, in particular prepared, by an application, without this being triggered explicitly via external communication.

The multi-tasking kernel provides that priorities can be assigned, in particular with regard to individual applications or application groups, and that a calculation time control takes place. By monitoring priorities and computation time, the multi-tasking kernel can ensure that the computational time or execution time available to an application is limited and that the multi-tasking kernel - li ¬

and given restrictions are not manipulated. A limitation of the computing time is achieved by controlling the consumption of the computing time by the multi-tasking kernel and assigning the computing time in the form of time quanta decidedly to the applications. Tamper protection is achieved by running only the multi-tasking kernel in a more privileged mode of operation, while all applications operate in a hierarchically lower-level user mode.

In addition to the synchronization of active processes, the multi-tasking kernel has more tasks. Thus, according to the invention, it also serves to manage the resources of the chip card (such as memories and interfaces). The resources can be requested by the application at the first loading or dynamically at runtime at the multi-tasking kernel. The multi-tasking kernel decides alone and in the first instance, whether the resources are assigned exclusively to an application or not. In the next instance, the application can pass on further sub-applications rights that are smaller or equal to the rights granted to it by the multi-tasking kernel. Thus, subcontracting or subcontracting of rights to subordinate subapplications is envisaged.

Furthermore, the multi-tasking kernel serves to provide mechanisms for secure data exchange between the individual applications. The data exchange between the applications controlled and / or monitored by the multi-tasking kernel is fundamentally based on the principle that the data exchange takes place exclusively under the control of the multi-tasking kernel. There are basically two alternatives for this: 1.- The participating applications are exchanging data or can exchange corresponding messages via special multi-tasking kernel function calls.

2. The participating applications can exchange data via predefined memory areas that contain several - in this case the active -

Applications are available together.

Basically, it is envisaged that each application itself decides whether and which data it makes available to other applications. With the solution according to the invention, therefore, the advantage is achieved that different applications can be integrated on a chip card, but they are securely sealed off from each other.

A significant advantage of the solution according to the invention is further to be seen in the fact that the fundamental advantage of flexibility, which can be achieved inter alia in the prior art by the approach of reloadable program code, can be maintained even with the inventive solution and even significantly improved , In principle, it is also possible to exchange components, in particular system components, in the chip card operating system or to add new components even after the card has been issued, such as eg. As updates, or components that serve the bug-fixing (debugging) or the like.

In the preferred embodiment of the invention, it is provided that basically hardware-related system components - as mentioned above - in the smart card operating system, which are not implemented via an interpreter-based programming language, such. As crypto routines, drivers for input / output interfaces, etc., can be exchanged for card output. This exchange takes place without unwanted and / or damaging influences on other components, because the memory protection of the multi-tasking kernel prevents any influence on other components or operating system components by the exchanged service. In an advantageous development of the invention, however, it is possible to apply this approach not only to operating system components, but also to other components of the smart card system, which can thus also be exchanged for card output, if the respective application allows it without causing further errors. Thus, the system based on the mobile data carrier can be used very flexibly and is easily changeable.

Another advantage of the solution according to the invention is the fact that the possibilities of data transfer in relation to the mobile data carriers can be extended. By controlling the multi-tasking kernel, it becomes possible to trigger necessary communication processes in an optimized manner so that parallel or simultaneous communication with internal or external modules takes place via a number of identical or different types of hardware interfaces. In other words, a chip card system based on the multi-tasking kernel according to the invention can use the quasi-parallel execution of program code to simultaneously transfer data via different input / output interfaces, eg. B. via a contactless interface according to the standard ISO14443 or the NFC standard (Near Field Communication) and in parallel to replace it via a contact interface according to the ISO7816 standard. Overall, the hardware resources of the mobile data carrier can be utilized much better, which leads to an increased processing speed of the data carrier overall. In general, two operating modes for the operation of the mobile data carrier are provided: A privileged mode in which runs the central multi-tasking kernel, the rights are granted more than a second mode in which basically all applications and / or processes or applications work. Depending on the application of the mobile data carrier, however, it is also possible to provide further privilege levels here. However, it is necessary that the central multi-tasking kernel is in each case the most privileged in order to enable central control of the entire operation of the data carrier.

In principle, the multi-tasking kernel according to the invention is based on a scheduling mechanism which is geared towards achieving an optimized execution or execution of all processes with regard to the entirety of all processes running on the data carrier (comprising operating system processes and application processes).

In a preferred development of the invention, it is provided that the scheduling mechanism accesses an optimization algorithm which optimizes the operation of the data carrier with regard to one or more of the following optimization criteria: optimization with regard to time, in particular with respect to a processing speed Dwell time of processes in the main memory and / or a response time of the processes; an optimization in terms of system resources, in particular hardware resources; an optimization in terms of space requirements and an optimization in terms of the necessary data transfer. In ^* alternative embodiments further optimization criteria are configurable. This has the advantage that the solution according to the invention is very flexible with regard to the basic processing of the process. The operating system of the chip card is thus not limited to a specific optimization criterion. Usually, the configurable mechanism is set based on predefined input parameters. The input parameters can be read in via corresponding interfaces. Alternatively, it is possible that for certain applications, a preferred treatment of the respective application takes place. Then, the multi-tasking kernel can exclusively allocate all or selected resources to a particular application. However, the formation of this feature according to the invention is not necessary and only optional.

In alternative embodiments, it is also possible to provide other algorithms for scheduling the processes for operating the data carrier. So it is z. For example, it is possible to design the scheduling method throughput-based and / or utilization-based.

In order for the task of the scheduling process to be implemented, it is necessary for the multi-tasking kernel to automatically record and control the execution time for each process. Furthermore, a limitation is imposed on the execution time of each process (this is done according to the mechanism: "how long may which process last?"). Thereupon, it is possible for the scheduling mechanism to automatically limit the execution time for a given application by controlling the consumption of the computation time and by monitoring compliance with the constraints. Optionally, a nested or cross-processed processing of processes can be driven, so that the total execution time of all necessary processes on the disk can be optimized. According to the optimized scheduling method, computer time is then allocated to the respective process or to the respective application.

In the context of scheduling, it is possible for individual applications and / or individual processes to be assigned priorities which are taken into account in the scheduling. In addition, it is possible for a process to pass its priority on to subordinate subprocesses.

In this context, reference should be made to another essential aspect of the inventive solution with regard to an improved safety approach. As already mentioned, smart cards can also be used in terminals such. B. are used in mobile phones and are formed in this case as a SIM card. In this application, usually other interfaces, such. B. USB or MMC interfaces to the SIM contacts in the mobile phone provided, can be addressed via the other security devices, eg. As smart cards are used in mobile phones or other mobile devices, so it is often the case that security modules or security components that should perform security checks are designed distributed in the system. This distribution of safety-critical functions to different systems and components in the chip card-related components or devices leads to several disadvantages. On the one hand, the production costs increase, since several hardware elements have to be used, and on the other hand, the overall susceptibility of the system to errors is significantly increased, since the multiplicity of modules increases vulnerability to security gaps. In addition, it is necessary through the previous distributed realization of safety-related functions to transfer data to an increased extent. this leads to again to a security gap, since basically every data transfer carries a security risk in itself. However, with the multi-tasking operating system according to the invention, it is possible that the smart card which is operated with this system can take over more functions, among other things in addition to the classic standardized functions (in the above example in addition to the pure SIM functionality) additional safety functions. On the other hand, this approach makes it possible to integrate all security functions centrally at one point in the system.

In a preferred embodiment of the invention, it is therefore provided to provide a security module, the so-called trust management module (abbreviated hereafter as TMM). This module is also controlled by the multi-tasking kernel. The TMM module can perform various safety-critical tasks in a protected environment, such as: B. in addition to the pure SIM functionality, a DRM authentication (DRM stands for Digital Rights Management and concerns a control system for checking a transmission of protected or protected content). In addition, other authorization mechanisms can be supported.

The TMM module can be designed both physically and as a hardware component. However, it is also possible to provide the module or individual functionalities of the module as software or as a computer program product, which can be used on a specific security processor z. For example, on a secure ARM core.

At this point, it should be explicitly stated that all modules that can be addressed by the central multi-tasking kernel can be used both in hardware as well as in software, which increases the overall flexibility of the system.

An important advantage in connection with the security aspects of the TMM module is that security functions can be reloaded flexibly. In addition, it is possible to significantly increase the functionality that supports the TMM module according to the invention, in contrast to the prior art. In this way, the TMM module operated by the multi-tasking kernel according to the invention can offer significantly more functions than e.g. of javacard applets. These include platform-dependent security protocol drivers, such as IFSec or SSL / TLS, or digital rights management authorization systems related to multimedia content.

A significant, advantageous aspect of the TMM module according to the invention is further to be seen in the fact that it can also actively perform security checks itself. This is not the case with previous TPM modules (Trusted Platform Module, TPM for short, is a security standard developed by the Trusted Computing Group, the modules of which are basically implemented as system-on-chip). In contrast to the known TPM modules of the prior art, the TMM module according to the invention is not operated as a pure slave, which only responds to requests from another entity, but the TMM module can also control actions independently. However, this self-contained control feature is not mandatory and only optional.

Overall, an improved memory protection can be achieved by the inventive operation of the chip card with a TMM module. Due to the multi-tasking-capable operating system, different security mission-critical tasks in a security system, in particular in a specific chip card processor, housed and thus realized.

There are different embodiments in which the TMM module can be implemented on the mobile data carrier. Thus, it is possible to implement the TMM module pluggable or hardwired, or it may already be integrated on the semiconductor. In addition, it is possible to use the module via different protocols, such. Via the ISO7816 T = O or T = I, via a USB or via an MMC interface or generally via the processor bus. In addition, it is optionally possible to provide a TCP-IP / Stack on the Layer 2 protocol.

Further solutions of the above-mentioned object are in an operating system or in operating system components, in a mobile data carrier, in a microprocessor for insertion into the mobile data carrier, in a computer program product and in a method for producing or servicing the mobile data carrier according to the enclosed main claims , In principle, it should be pointed out in this connection that the description of the invention is based on a description of the method according to the invention. Advantageous embodiment, advantages and further developments, which are described in connection with the method, apply correspondingly to the other solutions of the invention, in particular by the mobile data carrier, the microprocessor and the computer program product. Accordingly, the abovementioned solutions can also be developed further by means of the features of the subclaims for the method according to the invention. The above-described embodiments of the method according to the invention can also be embodied as a computer program product with a computer-readable medium and with a computer program and associated program code means, the computer being prompted after loading of the computer program for carrying out the inventive method described above.

An alternative task solution provides a storage medium that is intended for storing the computer-implemented method described above and is readable by a computer.

A further solution of the problem can be seen in that the method described above is designed as an operating system or operating system component for a mobile data carrier which is operated in accordance with at least one feature of the method.

Additional, advantageous embodiments emerge from the subclaims.

In the following detailed description of the figures, non-limiting exemplary embodiments with their features and further advantages will be discussed with reference to the drawing. In this show:

FIG. 1 shows a schematic, overview-like representation of a multi-tasking kernel according to the invention, which controls the operation of the mobile data carrier according to an embodiment of the invention,

FIG. 2 shows an overview of an activation of applications by the multi-tasking kernel according to the invention according to a preferred embodiment and

FIG. 3 shows an overview of a possible structuring of components of a data carrier according to the invention.

In the preferred embodiment and in the following, a mobile data carrier is designed as a chip card C. The applications of the chip card C are, however, in principle not limited and can be in the field of payments, finance, access control. Furthermore, it is possible that the chip card C for use in other devices, eg. B. mobile devices such as telephones, is used and it is in particular an inventively extended SIM card.

In principle, the chip card C itself and the applications A running on it are controlled by an operating system. In previous smart card operating systems, the program modules of the operating system were usually stored in a ROM memory module (read-only memory ROM). To counteract the disadvantages of storing operating system components exclusively in the ROM memory, it may be provided to solve individual operating system components in other memory areas, such as by a workspace in EEPROM. The main tasks of a chip card operating system include the exchange of data with the chip card, the flow control of the commands to be executed, the file management and the management and execution of security functions and algorithms, such as cryptographic keys, etc. In addition, it is possible in a range of is arranged hierarchically above the application commands to provide an interpreter or a check program for executable files. The interpreter serves to execute or interpret the programs contained in these files. With this kind of operating systems it is possible to program code also to reload at a later date, especially after card issue.

As shown by way of example in FIG. 3, the chip card C comprises an embedded microcontroller which triggers, controls and monitors all activities of the chip card C. The most important, typical components of a chip card microcontroller are the microprocessor MP, all interfaces SS of the chip card C, in particular the address and data bus and the data storage DS, which include all different types of memory, such as RAM, ROM and EEPROM. The interfaces SS of the chip card C include all input

/ Output interfaces for the smart card C and thus relate to the entire data transfer, which arises in relation to the smart card C.

According to the invention, in addition to these components, a central control device MTK is provided, which in particular is provided by the multi-component

Tasking kernel is formed. FIG. 3 shows the multi-tasking kernel MTK as a separate component on the chip card C. This should clarify that the multi-tasking kernel MTK - in contrast to the known chip card operating systems - is provided as an additional component. As a rule, however, it will not be provided as a separate, independent component, but rather integrated in other areas of the chip card as a separate module. In particular, it will be provided as a modular, separate operating system component in addition to the previous operating system of the chip card C.

Depending on the application of the chip card C this includes several applications or services A, which should run on the chip card. In the context of this invention, the terms "application" A and "service" A are to be understood as synonymous. An application A comprises a plurality of commands or processes which must or can be executed at different times. An application usually comprises several applications A. However, it is also possible in principle that a very simple application consists only of a single application A.

The central multi-tasking kernel MTK creates the possibility of offering several "virtual" chip cards on the same hardware platform of a chip card C, as it were. The individual virtual smart cards are strictly separated, since all applications and commands are controlled by the central multi-tasking kernel MTK. A one-sided or mutual influence of active applications or applications is thus reliably prevented by the multi-tasking kernel MTK.

The multi-tasking kernel MTK assigns applications A the appropriate contingents of computing time and resources according to a configurable scheduling method. As shown by way of example in FIG. 1, all applications A or chip card services A are in data exchange with the multi-tasking kernel MTK and are controlled and executed by them. In Fig. 1 it is indicated that the scheduling of the multi-tasking kernel MTK is time-based. This is to be clarified by the time-slice-like representation in FIG. 1. The multi-tasking kernel MTK monitors and controls the execution of the individual applications at runtime. By means of the configurable scheduling mechanism, in each case an application is automatically provided with a quota of computing time and resources which can be utilized by the respective application A. The Execution time of each application A is thus automatically limited to a configurable level.

In the preferred embodiment of the invention, the multi-tasking kernel MTK must perform an analysis of the existing system state with applications A to be triggered accordingly and must then control the entire execution or operation of the chip card C, so that with regard to the totality of all commands to be executed an optimized execution takes place. The optimization criteria are configurable: z. As an optimization in terms of time, system resources, storage space, power consumption, etc.

Before executing a respective application A, the multi-tasking kernel MTK records how much computation time is required for execution and how much and / or what resources are required. If now several applications A are to be executed, the multi-tasking kernel MTK can trigger an optimized execution of individual processes, which are assigned to the respective applications A, based on the analysis of the computing time and the required resources of all applications. Has z. For example, a first application A _{1 has} the task of forwarding data via a contactless interface to an external module and has, for example, B. a second application A ₂ task to receive data from another external module via a contact-type interface, the multi-tasking kernel MTK can cause a quasi-parallel, that is, simultaneous activation of the two applications A ₁ and A2, da the two applications access different resources (in this case different interfaces SS). This makes it possible to parallelize the processing path of instructions that is sequential in prior art systems of the prior art and to make them more common be shared, so that the overall performance can be increased.

By operating the chip card C with the multi-tasking kernel MTK according to the invention, it is possible to realize several concurrent threads, if no concurrent or conflicting accesses to the same resources are necessary. It can be provided that the multi-tasking kernel MTK accesses time-based scheduling if it detects concurrent access from different applications to the same resources at the same time. The time-based scheduling then provides that the entirety of the processes to be executed in the two applications Ai and A2 is controlled in such a way that overall (ie with regard to the entirety of the two applications Ai and A2) an optimized, in particular time-optimized, version is made possible , This is z. B. possible to prepare data of an application Ai in the background, while another application A2 z. B. communicates with an external system via interfaces SS.

FIG. 2 schematically shows how the multi-tasking kernel MTK activates different applications Ai, A2, A3 in an optimized manner.

The applications Ai and A2 shown in FIG. 2 are each caused by external systems. This can be z. For example, an account sales request may be in the context of a financial application. The central idea of the present invention is that the individual requests and commands to be executed are no longer executed directly, but are all controlled via the central multi-tasking kernel MTK. Due to the scheduling algorithm, the multi-tasking kernel MTK activates individual processes of the applications Ai, A2 and A3,..., Ai in such a way that an optimized execution the entirety of all applications Ai is made possible. This is illustrated in FIG. 2 in that the applications activated by the multi-tasking kernel MTK are identified by a thick vertical line while the respective processes or commands of an application A, which are currently not active, or by the multi -Tasking Kernel MTK have not been activated, only marked with a thin vertical line. Thus, it can be seen that the multi-tasking kernel MTK first activates the application A ₁ on request of the external system IB, and then an instruction cycle of the application A2, which has been caused by the external system IA. Following this, the application A ₁ is returned again to then start the application A3 and then terminate the application A2. Following the termination of the application A2, the remaining commands of the application A3 are executed. Overall, such a time-optimized scheduling of the entirety of the applications Ai is possible.

A central aspect of the present invention is improved security measures, in particular improved memory protection. In this case, it is provided that in at least one application A all security-relevant commands or processes that are necessary in the context of the operation of the chip card C are summarized and integrated. This application A or this module is called TMM module (Trust Management Module). In this module, all safety-relevant functions and commands are summarized. It is possible to reload additional security functions flexibly via specific protocols.

According to the invention, the content of the TMM module can be flexibly configured. This makes it possible, depending on the application, to activate and / or deactivate different security mechanisms in order to optimize Ie safety cover of the chip card C for each application to achieve. The TMM module according to the invention is designed so that it can actively perform safety checks and thus not - as in the prior art - is operated as a purely dependent process.

Another, significant advantage of the solution according to the invention is the fact that the safety-related processes that are integrated in the TMM module, optimized in the process or in the entire operation of the smart card C can be bordered. This has the background that certain safety checks make sense only at a certain point in the system flow. So z. For example, an authentication measure only makes sense before the start of a transaction, while further security measures can also be carried out at a later time. The optimal, in particular time-optimized, control of all processes on the chip card C is controlled and monitored by the multi-tasking kernel MTK.

For the solution according to the invention, it is also possible that specific security mechanisms, which can be used, for example, only in a specific application, can be used by the flexibly configurable TMM module when operating the chip card C. In contrast to the methods of the prior art, no adaptation to safety measures for a particular type of application has hitherto been possible. This disadvantage is completely eliminated with the solution according to the invention.

The solution according to the invention is advantageously independent of the respective platform of the chip card C and, in particular, independently of this, whether a virtual machine is used or not, or whether the virtual machine is realized off-card or on-card.

At this point it should be pointed out again that the above, detailed description of the figures in connection with the solution according to the invention has been described by the method. Advantageous developments, alternatives, advantages and features which have been described in connection with the method are also to be read on the other solutions of the problem and thus in particular on the mobile data carrier, the microprocessor, the computer program product and on the method for producing and / or or to service the mobile disk. The above-mentioned modules, components and units of the described method can already be integrated in a salable unit, but they can also be subsequently integrated as independent, separate product without the need for further measures on existing products.

The embodiments described in this detailed description of the figures are merely intended to illustrate examples and can be modified by the person skilled in the art in a variety of ways without departing from the scope of the invention. It is particularly obvious to a person skilled in the art that the invention can also be realized as a heterogeneous system and partially or completely distributed in software and / or hardware and on a plurality of physical products, in particular computer program products.

Claims

Patent claims

1. A method for operating a mobile data carrier (C), which is equipped with the following resources: a microprocessor (MP), a data memory (DS), interfaces (SS) for a data exchange between microprocessor (MP) and data memory (DS) and / or other modules that are associated with the mobile data carrier (C), wherein on the mobile data carrier (C) different applications (A) can be performed simultaneously by the mobile data carrier (C) by means of a central control unit (MTK) is operated which controls and / or monitors the operation of the mobile data carrier (C) in such a way that resources are allocated to each application (A) according to a scheduling mechanism and / or the data exchange is controlled.

2. The method according to claim 1, characterized in that in the control unit (MTK) a hardware-supported protection mechanism for the data memory (DS) is formed.

3. The method according to claim 1 or 2, characterized in that the scheduling mechanism is configurable.

4. The method according to at least one of the preceding claims, characterized in that the operation of the mobile data carrier (C) by means of the control unit (MTK) is controlled such that the data exchange between different applications and / or between different applications (A), is controlled and / or executed exclusively via the control unit (MTK).

5. The method according to at least one of the preceding claims, characterized in that the operation of the mobile data carrier (C) mit- Control unit (MTK) is controlled so that a parallel or simultaneous communication with external modules over several identical or different hardware interfaces (SS) takes place.

6. The method according to at least one of the preceding claims, characterized in that the mobile data carrier (C) has a plurality of operating modes and the operating mode with which the control unit is operated at least as many rights are granted as the other operating modes.

7. The method according to at least one of the preceding claims, characterized in that the scheduling mechanism automatically each time an execution time for an application (A) limited by a consumption of computing time controlled and computing time is assigned to the respective applications (A).

8. The method according to at least one of the preceding claims, characterized in that the configurable mechanism takes into account rights, each of which an application (A) can be assigned, and which can be passed to subordinate sub-applications.

9. The method according to at least one of the preceding claims, characterized in that each application (A) each individually and / or together with other applications has a protected address space of the data memory (DS).

10. The method according to at least one of the preceding claims, characterized in that the central control device (MTK) additionally controls all safety-related functions and / or über- wakes up, possibly distributed on different components of the mobile data carrier (C).

11. Mobile data carrier (C) on which different applications (A) can be executed, comprising the following resources:

Microprocessor (MP),

Data storage (DS),

Interfaces (SS) for a data exchange between microprocessor (MP) and data memory (DS) and / or other modules associated with the mobile data carrier (C), characterized in that the mobile data carrier (C) has a central control unit (MTK) with a Scheduler comprises, wherein the control unit (MTK) controls the operation of the mobile data carrier (C), in particular the execution of the applications (A), such and / or monitored that simultaneously several applications (A) can be active by the scheduler after a configurable mechanism each allocates resources to an application and / or controls the exchange of data.

12. Microprocessor (MP) for insertion into a mobile data carrier (C) on which different applications (A) can be executed, wherein the microprocessor (MP) comprises the following resources:

Data storage (DS),

Interfaces (SS) for a data exchange between microprocessor and data memory and / or further modules, wherein the microprocessor (MP) is assigned a central control unit (MTK) with a scheduler, and wherein the control unit (MTK) controls the operation of the mobile data carrier (C) , in particular the execution of the applications (A), controls and / or monitors such that several applications (A) can be active at the same time, by the scheduler having a configurable message each application (A) assigns resources and / or controls the exchange of data.

Computer program product, which can be loaded directly into a data memory (DS) of a programmable mobile data carrier (C) or into a control device assigned to the mobile data carrier (C), with program code means for carrying out all or selected steps of a method according to one of the preceding method claims, when the computer program product is executed in the mobile data carrier (C) or in the control device.

14. Computer program product according to claim 12, characterized in that the computer program product is designed as an operating system or operating system component.

15. A method for producing and / or maintaining a mobile data carrier (C), which is operated by a method according to the features of the preceding method claims, wherein components, in particular software-based operating system components, even after the output of the mobile data carrier (C) by others Components can be replaced.