WO2012019703A1

WO2012019703A1 - Portable data storage medium with a web server

Info

Publication number: WO2012019703A1
Application number: PCT/EP2011/003742
Authority: WO
Inventors: Eddy Bernard
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2010-08-11
Filing date: 2011-07-26
Publication date: 2012-02-16
Also published as: DE102010033995A1

Abstract

The invention describes a portable data storage medium (1), in particular a chip card, having a control unit (2) which, for the purpose of interchanging data, is coupled to a data memory (3) via a first communication link (4) and to a processor (5) via a second communication link (6) and can be coupled to an external device via an interface (7) of the data storage medium (1). A web server (8) and at least one application (10) are implemented in the data storage medium (1). The web server (8) is implemented in the control unit (2) in such a manner that http requests of a first type are processed by the control unit (2) and http requests of a second type are forwarded from the control unit (2) to the processor (5) for processing.

Description

T r a g b a r e d a t e n t r a n g e m e n t e m e n t e m e n t - s e r v e r

The invention relates to a portable data carrier, in particular a chip card, with a control unit, which is coupled for exchanging data via a first communication connection with a data memory and via a second communication connection with a processor. The control unit can be further coupled via an interface of the data carrier with an external device. In the disk, a web server and at least one application are implemented. The invention further relates to a method for operating a portable data carrier of the type described above.

Wolfgang Rankl, Wolfgang Ef- fing, 5th Edition, 2008, Carl Hanser Verlag, Chapter 23.3, pages 992 to 994, discloses portable data carriers with HTTP servers implemented thereon, which are also known as Web servers. A Web server is a program that interprets HTTP requests and returns the associated responses to the requesting device by implementing a Web server in a portable data carrier, such as a microSD card It is intended to simplify and standardize the application-level communication with the data carrier, thereby enabling a data carrier, such as static or dynamic web pages, to be exchanged in the same way as computers.

In one possible embodiment variant, the web server can be implemented in the operating system of a so-called smartcard chip provided in the portable data carrier (ie a processor of the data carrier). This is shown by way of example in FIG. 1. Fig. 1 shows a portable data carrier 1, for example a micro SD card. In this are a control unit 2, a data memory 3 and a processor 5 are arranged. The control unit 2 can be coupled via an interface 7, for example an SD interface, with an external device for data exchange. Via a communication link 4, data communication between the control unit 2, for example a flash controller, and the data memory 3, for example a flash memory, can be realized. Via a communication link 6, the control unit 2 can exchange data with the processor 5 embodied, for example, as a smartcard chip. Reference numeral 8 denotes the web server which is operated by the operating system of the processor 5.

In the possible variant shown in FIG. 1 for implementing a web server in a data carrier, the control unit 2 can merely tunnel an http request received via the interface 7 for processing by the web server 8 on the processor 5. The result of the processing of the http request by the processor 5 is tunneled back to the requesting external device by the control unit 2 via the interface 7. Disadvantage of this architecture is that the processor 5 has no communication connection to the data memory 3, so that http requests can not relate to information stored therein. In addition, a processor in the form of a smart card chip has a lower performance than that of e.g. formed as a flash controller control unit 2 is the case.

In an alternative possible embodiment, the web server 8 could be provided in the control unit 2, which in turn may be configured as a flash controller in the example shown in FIG. One problem with this variant is the portability and security of the applications using the web server. These applications are often called "servlets" designated. Typically, the applications (servlets) represent implementations of services of service providers. However, a service provider typically wishes to be able to operate a once developed application (servlet) on different data media from different manufacturers. In the environment of computers, this problem is usually solved by the use of Java, with which the applications are made executable on a virtual machine. In the embodiment shown in FIG. 2, this would require the provision of a virtual machine in the control unit 2. If the service offered by a service provider is critical to security, then the virtual machine in the control unit 2 providing the service must be secured. However, this procedure involves a great deal of effort.

It is therefore an object of the present invention to specify a portable data carrier, in particular a chip card, and a method for operating a portable data carrier with which a web server can be implemented and operated in a simpler manner in a portable data carrier. These objects are achieved by a portable data carrier according to the features of claim 1 and a method according to the features of claim 9. Advantageous embodiments result from the dependent claims. The invention provides a portable data carrier, in particular a chip card, with a control unit which is coupled to a data connection over a first Kommurtikationsverbindung with a data memory and a second communication connection to a processor and coupled via an interface of the data carrier with an external device is. In the disk is a web server and at least one application using the web server implemented. According to the invention, the web server is implemented in the control unit such that http requests of a first type are processed by the control unit and http requests of a second type are forwarded by the control unit to the processor for processing.

In the case of a portable data carrier according to the invention, it is ensured that access to the data contained in the data memory is possible when processing an HTTP query received from an external device. In addition, the data carrier according to the invention over the known from the prior art arrangement increased performance. In an expedient embodiment, the at least one application is a JavaCard application which, when the data carrier is used, is executed by a virtual machine of the processor and processes the http request of the second type. By providing the virtual machine on the disk's processor, the security and portability of the applications can be easily ensured. Moreover, by providing the virtual machine in the processor instead of the control unit connected to the data memory, it is ensured that the memory requirement for the virtual machine is not "extracted" from the memory of the control unit a response can be answered with static content which can be generated by an access of the control unit to data stored in the data memory. word dynamic content that can be generated by the at least one application. This distinction allows the processing of HTTP requests according to their needs once in the control unit and once in the processor.

According to a further embodiment, the web server is implemented in the control unit such that the http request of the second type is at least partially forwarded by the control unit to the processor for processing. For example, only those parts of the request that are needed to create the dynamic parts of the response are forwarded. This procedure increases the efficiency in the operation of the data carrier according to the invention.

According to another embodiment, a parallel operation of the processor and the control unit is provided in the processing of HTTP requests, whereby the processing speed can be increased over the solutions known from the prior art.

According to a further expedient embodiment, the web server is implemented in the control unit in such a way that all HTTP requests are preprocessed by it. The preprocessing takes place in particular with regard to checks or the processing of a header of the http request (header parsing). The preprocessing also includes determining if the received HTTP request is of the first or second type, depending on the result, either processing the HTTP request by the control unit itself or forwarding it to the processor for processing. According to a further expedient embodiment, the processor is a security element of the data carrier, whereby the applications using the virtual machine of the processor benefit from the associated security functions.

The invention furthermore provides a method for operating a portable data carrier, in particular a chip card, comprising a control unit which is coupled to a data memory for exchanging data via a first communication link and to a processor via a second communications link. The control unit can be further coupled via an interface of the data carrier with an external device. In the control unit there are implemented a web server and in the processor at least one application. In the method according to the invention, http requests directed to the data carrier are checked to see whether they are an http request of a first type or an http request of a second type, http requests of the first type being processed by the control unit and http requests of the second type are forwarded by the control unit to the processor and processed by the latter. In an expedient refinement, the at least one application is a JavaCard application which, when the data carrier is used, is executed by a virtual machine of the processor and processes the HTTP request of the second type. Such applications are referred to as servlet, as explained above.

In order to increase the efficiency in the operation of the data carrier, the HTTP request of the second type is at least partially forwarded by the control unit to the processor for processing. For example, only the forwarded to those parts of the request needed to create the dynamic parts of the response.

In a further embodiment of the method, all the http requests are preprocessed by the web server in the control unit. In preprocessing, e.g. evaluated the header of the http request and made usual checks.

In a further expedient embodiment, the forwarding of the http request to the processor comprises a conversion of the http request. Such a conversion may be necessary, for example, if the http query directed to the data carrier does not take into account the specific characteristics of a data carrier. The invention will be explained in more detail below with reference to an embodiment in the drawing. Show it:

1 shows a first possible implementation variant already described for implementing a web server in a portable data carrier,

2 shows an already described second possible implementation variant for implementing a web server in a portable data carrier, and FIG. 3 shows a data carrier in which a web server is implemented according to the invention. 3 shows a schematic representation of a portable data carrier according to the invention, for example in the form of a micro SD card in which a web server 8 is implemented. A web server (sometimes referred to as http server) is generally provided in a portable data carrier when communication interfaces to the data carrier at the application level are to be standardized and simplified. A web server is a program that interprets http requests and returns the corresponding responses to the device requesting an http request. A web server typically supports the http commands GET, HEAD, POST, PUT, DELETE, TRACE and CONNECT. For cryptographic security of the data transmission, https, ie http with SSL / TLS, can be supported instead of pure http.

The architecture of a web server implemented on a portable data carrier is schematically as follows: Based on a necessary protocol stack is a parser that interprets incoming HTTP requests. The http command, the pertinent parameters and the passing URL (Uniform Resource Locator) are used in the interpretation. If the parser can interpret the received date, the detected http command is processed.

The storage of HTML files depends on the file system supported by the portable media. If the data storage provided on the portable data carrier is sufficiently large, a FAT16 or a FAT32 file system can be provided as the file system. This is often feasible if the data store is a NAND flash memory. The file system mentioned also supports the computer-aided file men. In this case, the HTML files addressed in the http commands can be returned directly in response to the device sending the request. A transformation of file names is not necessary. However, if the volume has an ISO / IEC 7816 file system, the file name requested in a standard PC notation must be translated into a filename of the volume. This can be done for example via a simple translation table.

The data carrier 1 according to the invention, shown schematically in FIG. 3, conventionally comprises a control unit 2, a data memory 3 and a processor 5. The control unit 2 represents, for example, a flash controller for controlling the data memory 3 designed as a flash memory. A communication connection between the control unit 2 and the data memory 3 is identified by the reference numeral 4. The processor 5 is preferably designed as a secure smart card chip (security element). Communication between the control unit 2 and the processor 5 takes place via a communication link 6. The control unit 2 can be connected in operation via an interface 7 to an external device, e.g. a read-write device of a computer, be coupled and via the interface 7 exchange data with the external device.

The web server 8 is implemented according to the invention in the control unit 2. The Web server 8 takes on the one hand, the preprocessing of a directed to the disk 1 http request. The preprocessing includes usual checks (checks) as well as the header parsing header check, etc. In addition, the web server checks to see if the http request is of a first or second type. An http request is of the first type if it can be answered by a static content response. An http request is of the second type if its Response includes dynamic content, which must be generated by an application running on the disk. http requests of the first type are processed by the control unit itself in that the control unit accesses data stored in the data memory 3, http requests of the second type are processed by an application 10 running on the processor 5. This application, a so-called servlet, is preferably a JavaCard application which, when the data carrier is used, is executed by a virtual machine 9 of the processor 5 and processes the HTTP request of the second type.

If controller 2 determines that the http request is a second type request, it forwards it to application 10 of the processor for further processing. As part of the redirection may be made a format conversion. The processing is carried out - as explained - by running on the processor 5 application 10. It may be sufficient under certain circumstances, only a part of the HTTP request of the second type to forward the processor. In particular, only those parts of the request that are needed to create the dynamic parts of the response need to be forwarded.

The application can generate 10 answers with dynamic content. The answer is sent back to the control unit 2, which then optimally processes it further and transmits it to the device sending the http request.

The proposed implementation of the web server in the arithmetic unit uses a Java Virtual Machine of the processor. Through this implementation The virtual machine does not have to be provided in the arithmetic unit, the flash controller of the data memory. This reduces the cost and complexity of the architecture.

In addition, the JavaCard applications provided in the processor benefit from all the advantages of the JavaCard platform. A once developed JavaCard application can be ported to any other Java Card platform. In the event that the processor is a security element, the application can use the security functions of the processor.

The fact that the web server is implemented in the control unit of the data memory, this can use the data therein and access them.

The data carrier according to the invention has a "two-controller architecture", which is formed by the arithmetic unit and the processor of the data carrier, wherein the processing of an http request and the preparation of an http response by the control unit in parallel with the processing of information by the application of the smart card chip take place, resulting in a high performance.

Claims

P a n t a n s p r e c h e

Portable data carrier (1), in particular chip card, having a control unit (2) which is coupled to a data memory (3) for exchanging data via a first communication connection (4) and to a processor (5) via a second communication connection (6) and via an interface (7) of the data carrier (1) with an external device can be coupled, wherein in the data carrier (1) a web server (8) and at least one application (10) are implemented, characterized in that

the web server (8) is implemented in the control unit (2) such that http requests of a first type are processed by the control unit (2) and http requests of a second type are sent from the control unit (2) to the processor (5 ) are at least partially forwarded for processing.

A data carrier according to claim 1, characterized in that the at least one application (10) is executed when using the data carrier (1) by a virtual machine of the processor (5) and processes the http request of the second type.

A data carrier according to claim 2, characterized in that the application is a JavaCard application.

A data carrier according to any one of claims 1 to 3, characterized in that http requests of the first type are requests which can be answered, at least in part, by a response with static content obtained by accessing the control unit (2) in the data memory (3 ) stored data can be generated. Data carrier according to one of the preceding claims, characterized in that HTTP requests of the second type are requests whose response comprises dynamic content which can be generated by the at least one application (10).

Data carrier according to one of the preceding claims, characterized in that the web server (8) is implemented in the control unit (2) such that the http request of the second type from the control unit (2) at least partially to the processor (5). forwarded for processing.

Data carrier according to one of the preceding claims, characterized in that a parallel operation of the processor (7) and the control unit (2) are provided.

Data carrier according to one of the preceding claims, characterized in that the web server (8) is implemented in the control unit (2) such that all HTTP requests are preprocessed by it.

Data carrier according to one of the preceding claims, characterized in that the processor (5) is a security element.

Method for operating a portable data carrier, in particular a chip card, comprising a control unit (2) for exchanging data via a first communication connection (4) with a data memory (3) and via a second communication connection (6) with a processor (5 ) and via an interface (7) of the data carrier (1) with an external device kop- pelbar, wherein in the control unit (2) a web server (8) and in the processor (5) at least one application (10) implemented, directed to the disk (1) http requests are checked to see if they an http request of a first type or a http request of a second type, wherein http requests of the first type are processed by the control unit (2) and http requests of the second type are sent from the control unit (2) to the processor (5 ) are at least partially forwarded and processed by this.

A method according to claim 10, characterized in that the at least one application (10) when using the data carrier (1) by a virtual machine of the processor (5) is executed and the HTTP request of the second type processed.

A method according to claim 11, characterized in that the at least one application is a JavaCard application.

A method according to claim 10 to 12, characterized in that the HTTP request of the second type is at least partially forwarded by the control unit (2) to the processor (5) for processing.

Method according to one of Claims 10 to 13, characterized in that all the HTTP requests are preprocessed by the web server (8) in the control unit (2).

15. The method according to any one of claims 10 to 14, characterized in that the forwarding of the http request to the processor (5) comprises a conversion of the http request.