DE3745144C2 - Integrated circuit card with functional test system - Google Patents

Abstract

The card (1), similar to a credit card, contains a microprocessor (2), a read-only program memory (3) and a read/write program programmable memory (4). These units are linked by an internal data bus (2A) that is not directly acces accessible from outside the card. The card is normally linked to a terminal, providing access to some service for the user. An expanded programmable memory area (4A) is provided which may be programmed by means of an external device (5), and an expanded ROM (3A) that includes additional instruction codes which are accepted by the external device (5A). The expanded ROM (3A), moreover, includes a control code enabling the system to be switched between an expanded program loading mode and a program execution mode.

Description

The invention relates to an IC card system with an external Device and an IC card according to the preamble of Claim.

IC card systems are an example as known from DE-Z "Electronics", No. 20, 1986, pages 62 to 68. So-called chip-carrying cards are described ben, an arrangement is specified in which over a internal bus a CPU, a ROM as memory for the application tion program, a KAM as a memory for interim results and an electrically programmable memory with each other  are connected. The electrically programmable memory serves for storing various parameters and for that Record the operations performed on the IC card. Of the according to the objective there, is express there provided that the operation of external programs would be impossible should, whereby this applies in particular to programs that a Try accessing an in-card memory.

In the publication Patents Abstracts of Japan, P-516, November 15, 1986, Ed. 10, No. 338, JP 61-139880 A, is a Storage system for registering incorrect entries at Described using an IC card. The objective there accordingly, it is about misusing IC cards too prevent if someone uses a third party card and tried the corresponding password by trying several times find out. For this purpose the IC card described there a circuit that counts when wrong passwords can be entered. If the fifth incorrect entry in succession A password is made into a specific one Memory area written only zeros, so that the IC card becomes permanently invalid. At that one The arrangement described are the structure and use of the IC card not specified, but is out of context removable that the existing microprocessor via a Interface is connected externally and that over the Interface then direct access to the data bus is possible.

From the publication in Patents Abstracts of Japan, P-514, November 11, 1986, Rd. 10, No. 330, JP 61-134871 A, is a Transaction system for IC cards known, it is a Algorithm for saving procedures in one place Memory on the IC card goes. The CPU determines certain Procedures written in a memory, but before it is checked whether the procedure to be saved is already in the Memory is available. The storage is only then performed if the procedure is not yet in memory  is included. In addition, every stored procedure is marked with a Provide index address.

In DE-Z "Electronics", No. 19, 1986, pages 99 to 101, are IC cards generally described using different memories types specified are used in this context can be.

DE-OS 27 38 113 describes a device for through guidance of machining operations with one in the device inputable indices. This indicator can, for example be an IC card. This IC card is intended to the misuse of devices for carrying out Editing operations such as B. To provide banking services conclude. The basic idea of the cited document exists in it, the data in the IC card on increasing data in the memory to be entered, which are loaded only once and cannot be changed, and whose content cannot be determined from the outside. To one The machining process must then be triggered in the IC card additional memory is provided to the input from the outside Data with the internally stored data that can only be read internally are able to compare.

The generic US Patent 4,575,621 describes a portable electronic transmission device with an associated System used to solve the problem of restricted Reliability due to lack of contact security mechanical contacts, with a self-sufficient power supply Is provided. The internal data transmission takes place via Light emitting diodes and associated photo transistors. Concrete the system according to US-PS 4,575,621 comprises an external device and an IC card, which in turn has a microprocessor as well has a fixed and a freely programmable memory. The microprocessor is connected to the assigned data bus Save connected. The data bus itself is from the outside inaccessible. An extended programmable memory  rich serves to include an additional program by the external facility can be taken over.

U.S. Patent 4,534,012 gives small portable information device and an associated external station. This portable information devices relate to e.g. B. portable Calculators, credit card format calculators or calculators that are integrated in wristwatches.

Japanese publications JP 61-134869 (A) and JP 61-134870 (A) describe a card transmission system in which the associated IC card a ROM for recording programs steps. The change in the stored in ROM Program takes place automatically via the ATM terminal and its Access to the ROM. To avoid double storage, is also specified, detection means, based on the current program stored in the ROM must be provided. A The program is only taken over from the terminal if that offered program for the read-only memory is new. Thereby the storage space is used efficiently.

EP 0 159 651 A2 discloses an IC card and a transfer card system known using an IC card. In the An IC card is proposed in the publication, which is about first and second storage means, the storage means a higher storage capacity compared to a magnet Show card. This should make it possible to put in the IC card Record user programs so that an easier Use of a terminal, e.g. B. a bank terminal becomes.

DE-OS 29 16 658 describes a self-programmable Microprocessor. It contains u. a. a permanent program memory in which only a part of the programs is stored. The other parts of the program can be entered using a keyboard User entered yourself.  

From SRINI V.P., Fault Diagnosis of Microprocessor Systems, in: COMPUTER, January 1977, pages 60-65 are procedures for Error detection of microprocessor systems using special diagnostic programs, which are in the microprocessor stored permanently and / or in a volatile Memory can be loaded, known. The Diagnostic programs are used both to identify chip errors as well as the review of the sequential control system that Processor should be made itself.

IC cards using a microprocessor, a fixed program memory and a programmable memory built in and over A data bus are always connected used on a larger scale and apparently represent a welcome is an alternative to cards with magnetic stripes.

The invention is therefore based on the object of such IC cards to open up a wider area of application and the  Possible uses of such IC cards to improve without that the security and reliability of that on the IC card stored information, data and functions underneath To suffer.

According to the invention, the IC card is used in an IC card system of the type mentioned for use in ver different IC card user systems with different Operating programs and to check the functionality the IC card and is characterized by an extended programmable memory area for recording a additional operating program from the external facility; an extended programming memory area, the command codes for the microprocessor to accept and load the additional operating program in the programmable memory area contains, a facility in the extended program memory area to switch a first operating mode of the microprocessor to Accept and load the additional program, and one second operating mode for executing the additional program, the additional program being a test program to be deleted after the program has been worked out, that can be loaded into the extended programmable memory area is, and that to check the functionality of the Card components will continue to run Test results from the test program of the external institution to determine the fault location and type of fault Card components are fed.

With the IC card system the desired goal is satisfied achieved. An adjustment to the various IC card user systems with different Operating programs are carried out as a corresponding Additional operating program from the IC card if required can be loaded and processed by yourself, with your own card-internal data bus is used, which is not accessible by outside exists. This creates a high level of security guaranteed. Suitable test programs can also be loaded to both the functionality and the  To be able to check the integrity of the data on the IC card itself, being displayed via the emission of an error signal can if an IC card does not work normally or in the stored cards themselves can be determined.

The card system is described below based on the description of Embodiments and with reference to the accompanying Drawings explained in more detail. The drawings show in

1 is a functional block diagram of an IC card for use in the IC card system;

Fig. 2 is a flowchart for explaining the operation in the IC card in the IC card system; and in

Fig. 3 is a flow chart for explaining the operation of the IC card, which is executed with a test program, which is stored in an extended programmable memory area of the IC card.

In Fig. 1, an IC card 1 is shown schematically. The IC card represents an information carrier in the form of a thin rectangular card in wallet format (similar to a credit card), but which has an on-board or built-in microprocessor 2 , a fixed program memory, typically in the form of a fixed memory 3 or ROM, and a volatile or Read-write memory, which is conventionally referred to as programmable memory 4 . The microprocessor 2, and its associated built-in memory 3 and 4 are connected to a data bus 2 A, the abge in the manner described above within the IC card 1 divides and therefore from the outer side of the IC card 1 here is not directly accessible. Usually the IC card with an external device such. B. a reader / writer or terminal so that the card and terminal combination allows the user to perform any transaction or access any service available from the card system. Of course, the program memory 3 contains one or more fixed programs which are executed as normal functions during normal operation of the IC card 1 .

In the embodiment of FIG. 1, however, the IC card 1 is connected to an external device 5 , which also represents a memory for additional programs, such as. B. an additional memory of programs, which is designated by the dashed rectangle 5 A. As is apparent from the description below, the programs contained in the memory 5 A are designed and suitable in such a way that they can be transferred to the IC card via the microprocessor 2 in order to be executed in the IC card 1 .

For practical use of the IC card system, the fixed program memory or ROM 3 has an extended program memory area 3 A, which contains additional command codes which control the microprocessor 2 in order to accept a code in the form of additional programs from the external device 5 A and to read the accepted code in the programmable memory 4 . For this purpose, the programmable memory 4 has an expanded programmable memory area 4 A in order to record an additional operating program from the external device 5 by the microprocessor 2 under the control of the ROM 3 .

The extended program memory area 3 A also contains a code or a device, which are assigned to the microprocessor 2 and its associated memories, so that the device ensures that the system switches between two operating modes, namely a first mode for accepting and loading the program in the extended programmable memory area 4 A, and a second operating mode for executing the program that has been loaded into the extended programmable memory area 4 A.

While Fig. 1 shows the extended programmable memory area 3 A and the extended programmable memory area A as 4 separated from the main program memory 3, and the programmable memory 4 is is selected this illustration primarily as a means to better understand the invention. The expanded memory areas will typically be physically formed on the same integrated circuit chip as their associated memories, and the separation or segregation will typically be accomplished by segregating a block of locations or addresses within the memory for the associated functions.

The operation of the IC card 1 with the structure described above will be described below with reference to FIG. 2.

First, in step 10, an electrical command signal, typically a signal indicating the readiness for charging of the external device 5 for an additional program, is sent from the external device 5 to the microprocessor 2 . Then, at step 11, the means mentioned above or the code of the 3 A is stored in the extended fixed program memory, the mode of the microprocessor between the execution mode and the charging mode toggles, and on the basis of the command signal from the external device 5 is delivered.

If the microprocessor 2 is switched to the loading mode, the operation proceeds to step 12 , where the microprocessor 2 calls the load / write program and starts executing, which is stored in the extended program memory area 3 A, so that a write address in the extended programmable memory area 4 A is set. Thereafter, the program code of the external device 5 is loaded into a buffer at step 13, which is associated with the microprocessor 2 and is typically a part of the micro processor 2.

In step 14 , the loaded program code is written into that address position in the extended programmable memory area 4 A that was set in step 12 . At step 15 , the microprocessor 2 determines whether there is still any data to read, ie, additional program codes, and if there is no more data, the program flow proceeds to step 17 , where the operation of the microprocessor ends or returns to the initial state. On the other hand, if there is still data at step 15 , the write address is incremented at step 16 and steps 13 through 15 are repeated until the entire add-on program has been loaded.

In this context, it should be pointed out that in some cases, which are not specifically shown in FIG. 2, it is also possible to automatically or continuously execute the additional program already loaded into the programmable memory, immediately after the loading process has ended, as is the case is described below in connection with FIG. 3.

On the other hand, if the microprocessor 2 is switched to the execution mode at step 11 , the program flow goes to step 18 , where it is determined whether the execution mode of the microprocessor 2 has been changed from a first or normal execution mode to a second or special execution mode. If this is the case, the microprocessor 2 calls up a suitable program and executes it, which is loaded by the external device 5 into the extended programmable memory area. However, if the result at step 18 is "No", the program flow goes to step 20 , where the microprocessor 2 calls and executes an application program that is stored in the fixed program memory 3 . Finally, the program flow proceeds from step 19 or 20 to step 21 , where the operation of the microprocessor 2 is ended or it returns to the initial state.

Of course, the steps of FIG. 2 are only exemplary of the other applications of the invention, the IC card 1 normally executing internally stored programs when needed, and when requested by an external device, it loads programs from that external device the programmable memory in an additional operating mode and executes these programs in a further operating mode.

From the above it follows that the IC card system described enables the loading and execution of external programs without significantly affecting the security of the card. While the programs are loaded into predetermined areas of the programmable memory 4 under the control of the program memory 3 , any access to the programmable memory 4 takes place only via the microprocessor 2 . The data bus 2 A, which connects the microprocessor 2 with its associated memories, is provided internally in the IC card 1 and is available by normal means during program execution. It is difficult, if not impossible, to access the information stored within the programmable memory 4 , except by authorized means, since the microprocessor 2 and its operating programs contained in the ROM 3 control each such access.

Among the programs that can be stored in an external device 5 in order to load them into the IC card 1 are additional operating programs which can occasionally be caused by changes in the IC card system and which one wishes to implement as desirable, but not with the disadvantage that all IC cards in the system would have to be reissued with updated memories. Thus, an external device 5 , e.g. B. a reader / writer can be used to load an external operating program into an allocated area of the programmable memory 4 , and this program can be called up if necessary when the IC card is used in the card system.

As a second example, testing of the IC card is provided to ensure that it meets all requirements and standards, which may be desirable before the IC card is issued. In order to support the testing or checking of the cards, an additional program is loaded from the external device 5 into the IC card 1 in order to test or test the functionality and variety of functions of the internal components. For example, the program can individually test all of the cells within the programmable memory, check the various functions of the microprocessor and check the integrity of the fixed operating program to ensure that the IC card can pass the check before it is issued. It is emphasized that such a test process can be carried out without the requirement that, as was previously believed, the internal data bus 2 A must be made directly accessible to the device using an extended test program, which is external to the IC -Card 1 are provided.

In the following, an example of testing the functionality and variety of functions of the IC card will be described with reference to FIG. 3.

After the test program has been started, a test program for testing certain functions, which are selected in the desired manner from the IC card, is entered into the external device 5 in step 111 . The test program is then loaded into the expanded programmable memory area 4 A in step 112 , as described above. Typically, the loading takes place with one byte or a group of bytes at a time at which the entire additional program is already contained in the extended area of the programmable memory. At step 113 , the test program thus loaded is executed by the microprocessor in the manner described below.

More specifically, "0" is written as an initial input in all of the memory cells to be tested in the IC card 1 , and the data thus written in the first of the addresses is read out, and it is checked, whether the data thus read out is "0". Then the addresses to be checked are incremented in steps of 1 and the same checking process is repeated until the last address is reached. In this case, if the test procedure described above normally runs through all the memory cells, all the data stored therein are converted into "1". The same test process is then repeated in sequence for all memory cells using the data "1", ie it is determined for each memory cell whether the data contained therein have the value "1".

Thereafter, the microprocessor delivers an output signal at step 114 , which indicates the test results to the external device 5 . At step 115 , the external device 5 analyzes the test results to determine whether there is a fault in any of the memory cells under test. In this connection, it can be stated that the IC card 1 is not in normal operation, for example if no signal is supplied from the microprocessor to the external device within a predetermined period of time, or if the content of the output signal from the microprocessor deviates from a predetermined content. In addition, the inspection program may be structured so that if any abnormality or an error in a specified address is detected during inspection, the information about the location of the erroneous address, the expected data value, the detected value, and the like is transmitted to the external device can be so that the content or the nature of the error can be determined.

At step 116 , it is determined whether or not the checking process has ended. If the answer is "yes", the program flow proceeds to step 117 , where the test program in the programmable memory 4 in the IC card 1 is deleted. Thus, it is possible to prevent any data or information stored in the memories, namely the ROM 3 and the programmable memory 4 , from being accessed from outside the IC card, so that the security standard of the IC card 1 is improved.

On the other hand, if it is determined at step 116 that the checking process has not ended, the program flow returns from step 116 to step 111 . By repeating steps 111 to 116 , it is possible to perform a more complicated inspection process. This means that another test program can be executed, which is then selected, on the basis of the test results obtained in step 115 , and such a further test program can be entered in the external device 5 in step 111 . As a result, the IC card 1 can be checked in detail for a fault in a special operating mode, for example. For example, if an error is found, the factors of the error can be determined, such as: B. the characteristics and type of the fault, in order to examine the fault as a whole in detail.

As an example of the ROM in the above Embodiment can be a mask ROM, an erasable pro Programmable read-only memory EPROM and an electrical one erasable programmable read-only memory EEPROM specified will. As examples of memories that are programmable Memory can be used, an EEPROM, a Specify CMOSRAM and an EPROM.

Claims (10)

IC card system, with an external device ( 5 ) and an IC card ( 1 ), which comprises - a microprocessor ( 2 ), - a fixed program memory ( 3 ) - A freely programmable memory ( 4 ) and - A data bus ( 2 A), which connects the microprocessor ( 2 ) and the associated memory ( 3 , 4 ) to each other and is arranged within the IC card ( 1 ) inaccessible from the outside, and - An extended programmable memory area ( 4 A) for receiving an additional program from the external device ( 5 ), characterized by - includes an extended program memory area (3 A), the instruction codes for the microprocessor (2) for accepting and loading of the additional program in the extended programmable memory area (4 A), - A device in the extended program memory area ( 3 A) for switching between a first operating mode of the microprocessor ( 2 ) for accepting and loading the additional program, and a second operating mode for executing the additional program, - The additional program is a test program to be deleted after its program execution, which can be loaded into the extended programmable memory area ( 4 A) and which is executed to check the functionality of the IC card components, and - Furthermore, test results from the test program of the external device ( 5 ) for determining the fault location and the fault type of the IC card components are supplied.