GB2323194A

GB2323194A - Security system

Info

Publication number: GB2323194A
Application number: GB9705444A
Authority: GB
Inventors: Trevor John Pullen
Original assignee: Motorola Ltd
Current assignee: Motorola Solutions UK Ltd
Priority date: 1997-03-15
Filing date: 1997-03-15
Publication date: 1998-09-16
Anticipated expiration: 2017-03-15
Also published as: GB9705444D0; GB2323194B

Abstract

A security system prevents alteration of a code in an apparatus which has a controller (200) comprising a store (203) connected to a first electronic device (204) to provide it with the code. The first electronic device (204) has a first permanent store (207) for permanently recording the code. The first electronic device (204) is arranged so as not to operate if a different code is subsequently provided from the code permanently stored by the first electronic device (204).

Description

A SECURITY SYSTEM AND A METHOD THEREFOR Field of the Invention The present invention relates to a security system for preventing the alteration of a code in an apparatus, for example, an Electronic Serial Number (ESN) in a cellular telephone system or a Private or Public Mobile Radio (PMR) system.

The present invention also relates to a method for preventing the code from being altered.

Backgound of the Inventon A known type of mobile cellular telephone handset comprises a code plug, a controllable chip set including a fractional v synthesiser, a Zero Intermediate Frequency (ZIF) chip, an Audio Signalling and Frequency Integrated Circuit(ASFIC) chip, and a power control Digital to Analogue converter (DAC).

The above elements constitute a set of proprietary integrated circuits around which, the circuitry of the cellular telephone handset is based. The code plug essentially includes an Electronic Erasable Programmable Read Only Memory (EEPROM), containing an Electronic Serial Number (ESN) of the mobile telephone.

Such telephones are usually susceptible to fraud, for example, a mobile telephone handset, if stolen, can be provided with a new ESN, thereby allowing the handset to be resold and therefore circumvent the security system of a cellular infrastructure system. Also, an ESN transmitted by a handset can be intercepted and programmed into a stolen handset, thereby causing call time to be fraudulently billed to the wrong subscriber.

It is therefore an object of the present invention to obviate or mitigate the above problems associated with mobile telephone handsets.

Summarv of the Invention According to the present invention, there is provided a security system for preventing the alteration of a code in an apparatus, the apparatus comprising a store coupled to a first electronic device for providing the code, the first electronic device having a first non-volatile store for recording the code and being arranged so as not to operate if a different code is provided from the code permanently stored by the first electronic device.

Preferably, the first non-volatile store is a data array. The store may be connected to the first non-volatile store by a data bus. Additionally or alternatively, the data bus may comprises a data line and a clock line. More preferably, the operation mode is programmable via the data bus.

Advantageously, the first non-volatile store is initialised. The first non-volatile store may be a Programmable Read Only Memory which can only be programmed once. Preferably, the different code is provided when the first electronic device is programmed.

A data stream may be provided to program the first electronic device and a plurality of bytes is appended to the data stream for providing the code for the first non-volatile store.

The first electronic device may be arranged so as not to operate by entering a reset state. The first non-volatile store may be arranged to prohibit the storage of a code from the store corresponding to a predetermined value.

Preferably, the system is arranged to be disabled. It is thus also possible to provide a system which is fully backwards compatible with existing applications by pennitting the system to be disabled, thereby enabling the above mentioned components to be used in other RF applications, since a standard chip set can be used.

Preferably, the first electronic device is fractional s synthesiser.

The system may comprise a second electronic device having a second nonvolatile store. Preferably, the second electronic device is a ZIF.

The system may comprise a third electronic device having a third non-volatile store. Preferably, the third electronic device is a ASFIC.

The system may comprise a fourth electronic device having a fourth non-volatile store. Preferably, the fourth electronic device is a power control DAC.

The code may be an Electronic Serial Number.

A cellular telephone handset may comprise the security system as hereinbefore described.

A public mobile radio handset may comprise the security system as hereinbefore described.

A private mobile radio handset may comprise the security system as hereinbefore described.

According to the present invention, there is also provided a method of preventing a code from being altered in an apparatus, the apparatus including a store coupled to a first electronic device, the first electronic device having a first non-volatile store for recording the code, the method comprising the steps of initially transferring the code from the store to the first non-volatile store, storing the code in the non-volatile store, subsequently transferring the code from the store to the first non-volatile store, verifying that the code subsequently provided by the store is substantially the same as the code stored in the non-volatile store, and entering an inoperative state if the code subsequently provided does not substantially match the code stored in the first non-volatile store.

Preferably, the method comprises storing the code in the non-volatile store having a data array.

The method may comprise providing a serial bus for transferring the code from the store to the first non-volatile store. The method may comprise initialising the first non-volatile store.

Preferably, the code from the store is subsequently transferred to the first nonvolatile store when the first electronic device is programmed. the first electronic device may be programmed using a data stream and appending a plurality of bytes to the data stream for providing the code for the first non-volatile store.

An inoperative state may be entered and the system may remain in a reset state.

The operational mode may be programmed via the data stream.

Preferably, the storage of a code from the store corresponding to zero is prohibited.

Preferably, the system is disablable prior to activation.

Preferably, a fractional s synthesiser having the store is provided.

A second electronic device having a second non-volatile store may be provided.

Preferably, the second electronic device is a ZIF.

A third electronic device having a third non-volatile store may be provided.

Preferably, the third electronic device is a ASFIC.

A fourth electronic device having a fourth non-volatile store may be provided.

Preferably, the fourth electronic device is a power control DAC.

The code may be an Electronic Serial Number.

It is thus possible to provide a system which makes the illegal modification of an ESN in a mobile telephone handset technically difficult as well as costly.

Bnef Description of the Drawings The invention will now be described in more detail, by way of example, with reference to the accompanying drawings, in which: FIG. 1 is a schematic representation of a radio communication system having a mobile subscriber unit, FIG. 2 is a schematic diagram of a chip set in which the present invention may be embodied for use in the mobile subscriber unit of FIG. 1, FIG. 3 is a schematic diagram of an ESN that may be used with the embodiment of FIG. 1, FIG. 4 is a flow diagram constituting an embodiment of FIG. 1, and FIG. 5 is a flow diagram relating to the embodiment of FIG. 4.

Description of a Preferred Embodiment Referring to FIG. 1, a mobile communications system in a geographic area 100 comprises a base station 102 and a plurality of mobile subscriber units, or handsets, 104.

Each handset 104 comprises an antenna 106 connected to a duplexer 108 having a first terminal and a second terminal, the first termal being connected to a transmitter 110 and the second terminal being connected to a receiver 112. The transmitter 110 and the receiver 112 are both connected to a controller 200, which is connected to a user interface 114. The above configuration is not intended to be limiting and any other configuration known in the art can be used.

A protection system for the controller 200 of the handset 104, as shown in FIG.

2, comprises an EEPROM 202, a ZIF chip 204, an ASFIC chip 206, a power control Digital-to-Analogue Converter (DAC) 208 and a fractional s synthesiser 210 (hereinafter referred to as 'the IC devices'). An address bus 212 and a data bus 214 interconnect EEPROM 202 and a microprocessor 216. A serial data line 217 and the data clock line 218, collectively known as a serial data bus, interconnect the microprocessor 216, the ZIF chip 204, the ASFIC chip 206, the DAC 208 and the fractional S synthesiser 210. The EEPROM 202 has a store 203 for storing a code, such as an ESN (not shown).

Each of the IC devices 204, 206,208, 210 have a control logic unit 220 and a Programmable Read Only Memory (PROM) 205 within, for example, a PROM which by nature can only be programmed once, i.e. is non-rewritable, such as a fuse cell array PROM. Each PROM 205 can be integrally formed within each of the IC devices 204, 206, 208, 210 according to any technique known in the art.

The PROM 205 cannot be externally read and has a corresponding non-volatile, i.e. permanent, store 207 which comprises a data array 300 (FIG. 3) of twenty bytes 302,..., 340 which is retained even when power to the handset 104 is removed. The contents of each data array 300 is initially set to a value corresponding to a predetermined value, such as zero, during manufacture and signifies that the protection system is not enabled at present. The control logic unit 220 interprets an incoming data stream containing the ESN from the serial data line 217 and compares the ESN to the contents ofthe data array 300 to determine whether or not to enable the protection system. Once the code (other than one corresponding to the predetermined value) has been recorded, the protection system is enabled. Although, in this example, zero has been chosen to signify that the protection system is not enabled, other values can be used.

Additionally, although the data array 300 used in the above example is twenty bytes in length, the data array 300 can be of a different length compatible with a telephone system being used.

General operation of the handset 204 is known in the art and is not considered relevant to the invention; the general operation of the handset 204 will not therefore be described. However, operation according to Process 400 and Process 500, the processes relevant to the invention, are as follows.

Upon start-up (FIG. 4) and on any occasion that any of the microprocessor 216 or the IC devices 204, 206, 208 ,210 are accessed, for example, to program or reprogram, the microprocessor 216 interrogates (step 402) the EEPROM 202 for the ESN (via the address and data buses 212, 214) and sends (step 404) the ESN to each of the IC devices 204, 206, 208, 210 on the serial data line 217 and clocked into each of the IC devices 204, 206, 208, 210 using the data clock line 218.

Upon start-up (FIG. 5), the respective control logic unit 220 of each of the IC devices 204, 206, 208, 210 await receipt of the ESN (step 502) via the serial data bus 217, 218. Upon receipt of the ESN, each of the IC devices 204,206,208,210 verifies whether or not the ESN has already been recorded (step 504) in the corresponding permanent store 207 of each of the IC devices 204, 206,208, 210.

If the ESN has not been recorded in the corresponding permanent store 207 of each of the IC devices 204, 206, 208, 210, as would be the case upon start-up of the handset 104 for the first time, each of the IC devices 204, 206, 208, 210 verifies whether the code sent corresponds to zero (step 506). If the code corresponds to zero, recordal of the ESN is refused (step 508) by each of the IC devices 204, 206, 208, 210 and each of the IC devices 204, 206, 208, 210 continues to operate without the protection system enabled (step 512). If the ESN sent does not correspond to zero, the ESN is recorded in the corresponding permanent store 207 of each of the IC devices 204, 206, 208, 210 (step 510) and each of the IC devices 204, 206, 208, 210 continues to function as normal. The ESN can be programmed into the EEPROM 202 during a test/tune procedure known in the art and subsequently transferred to the permanent store 207 of each of the IC devices 204, 206, 208, 210. Alternatively, if it is desirable to program the ESN at a later stage, the EEPROM 202 can be programmed with a code which will not be accepted by the corresponding permanent store 207 of each of the IC devices 204, 206, 208, 210, for example, a code corresponding to zero as described above. By this mechanism, each of the IC devices 204, 206, 208, 210 can then continue to functioning as normal (step 512) until the EEPROM 202 of the controller 200 in the handset 104 is programmed with a non-zero or enabling ESN.

In the case where the ESN has already been recorded, each of the IC devices 204, 206, 208, 210 verifies whether or not the ESN sent from the EEPROM 202 by the microprocessor 216 is the same as the ESN stored in the corresponding permanent store 207 of each of the IC devices 204,206,208, 210 (step 514). If the ESN, as compared by the respective control logic unit 220 of each of the IC devices 204, 206, 208, 210, in the corresponding permanent store of each of the IC devices 204,206,208,210 is the same as the ESN sent by the EEPROM 202, then each of the IC devices 204, 206, 208, 210 continues to function normally (step 512) until each of the IC devices or one of the IC devices 204, 206, 208, 210 are next programmed.

If the ESN in the corresponding permanent store 207 of each of the IC devices 204, 206, 208, 210 is not the same as the ESN sent by the EEPROM 202, each of the IC devices 204, 206, 208, 210 enters a reset cycle (step 516) and then awaits the correct ESN (step 502) when each of the IC devices or one of the IC devices 204, 206, 208, 210 is next programmed.

If an attempt is made, after the ESN has been recorded, to record the code corresponding to zero, i.e. an unauthorised person tries to deactivate the protection system subsequent to activation, each of the IC devices 204, 206, 208, 210 refuses to record the code and continues to await a valid ESN (step 502) before continuing to operate once again. Thus, once the protection system is activated, the protection system cannot be deactivated.

Additionally, the mode of operation of the protection system can be disabled during manufacture so that the option of the above described security system can be determined by the manufacturer, for example, by programming a code corresponding to zero, thereby not enabling the protection system.

The operation mode of the each of the IC devices 204, 206, 208, 210 is programmed using a data stream on the serial data line 217 using the data clock line 218 to clock the data stream into each of the IC devices 204, 206, 208, 210. The ESN is sent to each of the IC devices 204, 206, 208, 210 by appending a plurality of bits corresponding to the ESN to the data stream.

It is conceivable that, instead of incorporating the protection system into each of the IC devices 204,206,208,210, the protection system can be incorporated into one or more of the IC devices 204, 206, 208, 210.

Although the above example has been described in the context of a mobile cellular telephone handset, it should be understood that it is not intended that the present invention be limited to such a handset and that the invention can be applied to other forms of handset, for example a public or private mobile radio handset, as well as other systems requiring the prevention of the modification of a code. Additionally, the present invention can be applied to a field of personal computer, or the like, where a computer comprises at least one integrated circuit memory and it is desirable to discourage the unauthorised removal of the at least one integrated circuit memory.

Claims

1. A security system for preventing alteration of a code in an apparatus, the apparatus comprising a store coupled to a first electronic device for providing the code, the first electronic device having a first non-volatile store for recording the code and being arranged so as not to operate if a different code is provided from the code permanently stored by the first electronic device.

2. A system as claimed in Claim 1, wherein the first non-volatile store is a data array.

3. A system as claimed in any one of the preceding claims, wherein the store is connected to the first non-volatile store by a data bus.

4. A system as claimed in any one of the preceding claims, wherein the data bus comprises a data line and a clock line.

5. A system as claimed in any one of the preceding claims, wherein the first non-volatile store is initialised.

6. A system as claimed in any one of the preceding claims, wherein the different code is provided when the first electronic device is programmed.

7. A system as claimed in Claim 6, wherein a data stream is provided to program the first electronic device and a plurality of bytes is appended to the data stream for providing the code for the first non-volatile store.

8. A system as claimed in any one of the preceding claims, wherein the first electronic device is arranged so as not to operate by entering a reset state.

9. A system as claimed in any one of the preceding claims when dependent on Claim 3, comprising an operation mode and a non-operational mode programmable via the data bus.

10. A system as claimed in any one of the preceding claims, wherein the first non-volatile store is arranged to prohibit the storage of a code from the store corresponding to a predetermined value.

11. A system as claimed in any one of the preceding claims, wherein the first non-volatile store is a Programmable Read Only Memory which can only be programmed once.

12. A system as claimed in any one of the preceding claims, wherein the system is arranged to be disabled.

13. A system as claimed in any one of the preceding claims, wherein the first electronic device is fractional v synthesiser.

14. A system as claimed in any one of the preceding claims, comprising a second electronic device having a second non-volatile store.

15. A system as claimed in Claim 14, wherein the second electronic device is a ZIF.

16. A system as claimed in any one of the preceding claims, comprising a third electronic device having a third non-volatile store.

17. A system as claimed in Claim 16, wherein the third electronic device is a ASFIC.

18. A system as claimed in any one of the preceding claims, comprising a fourth electronic device having a fourth non-volatile store.

19. A system as claimed in Claim 18, wherein the fourth electronic device is a power control DAC.

20. A system as claimed in any one of the preceding claims, wherein the code is an Electronic Serial Number.

21. A cellular telephone handset comprising the security system as claimed in any one of the preceding claims.

22. A public mobile radio handset comprising the security system as claimed in any one of Claims 1 to 19.

23. A private mobile radio handset comprising the security system as claimed in any one ofClaims 1 to 20.

24. A security system for a set of electronic devices as hereinbefore described with reference to FIGs. 1 to 3.

25. A method of preventing a code from being altered in an apparatus, the apparatus including a store coupled to a first electronic device, the first electronic device having a first non-volatile store for recording the code, the method comprising the steps of initially transferring the code from the store to the first non-volatile store, storing the code in the first non-volatile store, subsequently transferring the code from the store to the first non-volatile store, verifying that the code subsequently provided by the store is substantially the same as the code stored in the first non-volatile store, and entering an inoperative state if the code subsequently provided does not substantially match the code stored in the first non-volatile store.

26. A method as claimed in Claim 25, comprising storing the code in the nonvolatile store having a data array.

27. A method as claimed in Claim 25 or Claim 26, comprising providing a serial bus for transferring the code from the store to the first non-volatile store.

28. A method as claimed in any one of Claims 25 to 27, comprising initialising the first non-volatile store.

29. A method as claimed in any one of Claims 25 to 28, comprising subsequently transferring the code from the store to the first non-volatile store when the first electronic device is programmed.

30. A method as claimed in Claim 29, comprising programming the first electronic device using a data stream and appending a plurality of bytes to the data stream for providing the code for the first non-volatile store.

31. A method as claimed in any one of Claims 25 to 30, comprising entering an inoperative state by entering and remaining in a reset state.

32. A method as claimed in any one of Claims 30, comprising programming an operational mode or non- operational mode of the system using the data stream.

33. A method as claimed in any one of Claims 25 to 32, comprising prohibiting the storage of a code from the store corresponding to zero.

34. A method as claimed in any one of Claims 25 to 33, comprising disabling the system prior to activation.

35. A method as claimed in any one of Claims 25 to 34, comprising providing a fractional s synthesiser having the store.

36. A method as claimed in any one of Claims 25 to 35, comprising providing a second electronic device having a second non-volatile store.

37. A system as claimed in Claim 36, wherein the second electronic device is aZIF.

38. A method as claimed in any one of Claims 25 to 37, comprising providing a third electronic device having a third non-volatile store.

39. A system as claimed in Claim 38, wherein the third electronic device is a ASFIC.

40. A method as claimed in any one of Claims 25 to 39, comprising providing a fourth electronic device having a fourth non-volatile store.

41. A system as claimed in Claim 40, wherein the fourth electronic device is a power control DAC.

42. A system as claimed in any one of Claims 25 to 39, wherein the code is an Electronic Serial Number.

43. A method of preventing a code from being changed for a system substantially as hereinbefore described with reference to FIGs. 4 and 5.