WO2004040579A1

WO2004040579A1 - Smart card write-only register

Info

Publication number: WO2004040579A1
Application number: PCT/US2003/025864
Authority: WO
Inventors: Mark Alan Schultz; David Jay Duffield; Dinakaran Chidambaram
Original assignee: Thomson Licensing S.A.
Priority date: 2002-08-22
Filing date: 2003-08-19
Publication date: 2004-05-13
Also published as: AU2003258285A1

Abstract

A register arrangement allows writing of data to a register without the possibility of recovering the data so written by means of an associated read arrangement. Reading of the data stored in the 'write-only' registers is performed by a read circuit arrangement which is independent of the write circuit arrangement.

Description

SMART CARD WRITE-ONLY REGISTER

Cross-Reference to Related Applications [0001] This application claims the benefit of the priority of U.S. Provisional Application 60/405,197 filed August 22, 2002 in the name of Schultz et al.

Field of the Invention [0002] The invention relates to the writing of digital information into memory in such a manner that the writing device cannot retrieve the data, but a reading device separate and independent of the writing device can read the data from the memory.

Background of the Invention [0003] FIGURE 1 is a simplified block diagram of a prior art microprocessor and an associated memory or register. In FIGURE 1, prior art arrangement 10 includes a microprocessor (μP) illustrated as a cloud 12 which is, or can be, in communication with the outside world by way of a port 12IO. Arrangement 10 also includes a memory in the form of a register 14. Register 14 includes an address port 14a, a bus port 14b, and read and write command ports 14r and 14w, respectively. The address port 14a, bus port 14b, and read and write command ports 14r and 14w, respectively, are coupled to microprocessor 12 by way of an address decoder 16 with path 16P, bus 18, and read and write paths 20 and 22, respectively.

Data read from register 14 appears on a data path 24 for application to data using devices, which are illustrated as a second microprocessor (μP) 26 andor a hardware device 28.

[0004] Details of register 14 are illustrated in FIGURE 2. In FIGURE 2, elements corresponding to those of FIGURE 1 are identified by the same reference designations or alphanumerics. FIGURE 2 shows that register 14 includes a set 14S of a plurality of individual registers OOOlh, 0002h, 0003h, 0004h, 0005h, 0006h, 0007h, 0008h, 0009h, OOOAh, OOOBh, OOOCh, OOODh, OOOEh, and OOOFh. In the illustrated embodiment, the number of individual registers is fifteen, and each individual register has or stores eight bits, but the number of individual registers and their storage capacity may be other than the number of the example.

[0005] As illustrated in FIGURE 2, the address decoder decodes addresses received from microprocessor 12, and applies an address signal to that one (or those) of the registers which are to be addressed for reading or writing. The data line 18 is coupled to the data port of each of the individual registers OOOlh, 0002h, 0003h, 0004h, 0005h, 0006h, 0007h, 0008h, 0009h, OOOAh, OOOBh, OOOCh, OOODh, OOOEh, and OOOFh, and allows that individual register selected by the address line to be written with data from the microprocessor 12. The data read from the individual registers OOOlh, 0002h, 0003h, 0004h, O005h, 0006h, 0007h, 0008h, 0009h, OOOAh, OOOBh, OOOCh, OOODh, OOOEh, and OOOFh appears on a corresponding output path 24S 24S₂, 24S₃, 24S₄, 24S₅, 24S₆, 24S₇, 24S₈, 24S₉, 24S_A, 24S_B, 24S_C, 24S_D, 24S_E, and 24S_F of set 24S. In the example, with eight-bit individual registers, each data line 24S_{1 ;} 24S₂, 24S₃, 24S₄, 24S₅, . . ., 24S_F of set 24S is an eight-bit parallel path.

[0006] As so far described, the arrangement of FIGURE 1 with the registers of FIGURE 2 is capable of writing data to the registers for storage therein, and is capable of being read to a data path of output path 14S.

[0007] Each individual register OOOlh, 0002h, 0003h, 0004h, 0005h, 0006h, 0007h, 0008h, 0009h, OOOAh, OOOBh, OOOCh, OOODh, OOOEh, and OOOFh of register set 14S of FIGURE 2 includes a two-state or bi-state memory device, which is often a flip-flop (FF) or bistable multivibrator. Thus, each individual register of register set 14 contains at least eight flip-flops, one for each bit.

[0008] FIGURE 3 is a simplified schematic diagram illustrating how a storage device such as a single flip-flop of an individual register is arranged in the prior art so that the written data can be verified. In FIGURE 3, the flip-flop 314 which performs the actual storage of one data bit is illustrated as including the cascade of two inverters 301 and 302. The input of inverter 301 is the data input port which sets the flip-flop to the desired state, and the stored data bit appears at the output port of inverter 302. A feedback path, illustrated as 314f, provides the regeneration required to maintain the set state. Feedback path 314f may include a series resistor, as illustrated, to control the amount of regeneration. As illustrated in FIGURE 3, the one bit of data applied on a single bit path 318 of FIGURE 3 of the bus 18 of FIGURES 1 and 2 is coupled to a node 303 through a first switch 330, illustrated as a field- effect transistor (FET), which is controlled by the decoded address for that register. Thus, selection of the address of the register enables switch 330, and provides bus access to node 303 for reading or writing. Node 303 is connected to the input port of inverter 301 by way of a switch 332, which is controlled by the Write signal or strobe. Node 303 is connected to the output port of inverter 302 by way of a switch 334, which is controlled by the Read signal or strobe. Depending upon the desired read or write function, one or the other of switches 332 or 334 is enabled by the corresponding command, and connects node 303 to the appropriate inverter port. More particularly, if it is desired to Write to FF 314, switches 330 and 332 are enabled or turned ON, and switch 334 is left OFF. This allows the bit to be stored to be applied to the input port of inverter 301 to set the FF 314, whereupon the bit appears at the output port of inverter 302. At a later time, the data stored in FF 314 may be accessed by enabling switches 330 and 334, and disabling switch 332. This allows the stored bit to be coupled through switch 334 to node 303, and from node 303 through switch 330 to the bus line 318. Such a read function may be used to verify that the data was correctly written. The stored data is continuously available to the outside world on one-bit output signal path 324. FIGURE 5 shows a secure register in the form of a simplified schematic diagram according to an aspect of the present invention. Note that the write path is the same as that of FIGURE 3 while the read path is completely missing. No verification of the written information can be performed on the "write-only" register shown in FIGURES 4-5.

[0009] Data can be written to the output port 324 of the arrangement of FIGURE 3 simply by applying drive from the output bus. Such drive sets the output of inverter 302 both directly and by control through inverter 301.

[0010] There may be situations in which the data being stored should be kept securely. Such information might, for example, be a cryptographic key applied to a smart card, where the smart card performs cryptographic processing on the key to derive other keys, which are stored, at least temporarily, on the smart card. It is undesirable, in such a situation, for the source of the data (the original cryptographic key) to be able to read the result of the processing stored in the smart card. The source of the data provides a method for the encrypted key to be sent to the smart card microprocessor (μP) for decrypting. The decryption process may include complex math run in software with a unique key (number) delivered as an output of the decryption process. When this final number is written into a secure register, the software running the program is deleted from active memory so the only remaining information concerning the actual key is in the secure register. This prevents someone moving the key from the smart card by modifying the μP program. Once the key is written into the secure register, no outside access of software can be used to recover the key.

Summary of the Invention [0011] A register according to an aspect of the invention, in which the reading and writing functions are separated, comprises a two-state storage device, such as a flip-flop, includes a data port for receiving data having one of two possible states. A write strobe circuit is connected to the storage device, for, in response to application of a write strobe to the write strobe circuit, enabling the storage device to accept the data and to store the one of the two states. A read strobe circuit independent of the write strobe circuit is connected to the storage device, for enabling reading of the storage device in response to a read strobe applied to the read strobe circuit.

[0012] A method according to an aspect of the invention is for loading information into memory in a manner which cannot be read by the loading software. The method comprises the steps of generating a bit of data to be loaded into memory, where the bit of data has two possible states. A write strobe is generated. The method includes the step of procuring, for each bit of information to be loaded into memory, (a) a two-state storage device including a data port for receiving data having one of two possible states, (b) a write strobe circuit connected to the storage device, for, in response to application of the write strobe to the write strobe circuit, enabling the storage device to accept the data and to store the one of the two states, and (c) a read strobe circuit independent of the write strobe circuit, the read strobe circuit being connected to the storage device, for enabling reading of the storage device in response to a read strobe applied to the read strobe circuit. The method also includes the step of applying the bit of data to the data port in timed relationship with application of the write strobe to the write strobe circuit, and at a later time, applying a read strobe to the read strobe circuit to enable reading of the storage device.

[0013] An electronic device for securely storing data in a register arrangement comprises a controller operable for generating read, write, and data signals. A first set of read/write registers is coupled to the controller via a bus for communicating data from/to the controller. A register arrangement comprises a second set of write-only registers. In response to a write signal applied from the controller to at least one of the first set of registers and to at least one of the second set of registers, data from the controller is written to a given register of the first set, and passed to a corresponding register of the second set. The corresponding register of the second set is selected according to an address value stored in another one of the registers of the first set. Read access to the second set of write-only registers is independent of a read signal from the controller. In one configuration, the electronic device is a smart card adapted to utilize a read write register set to address and write data into a second register set supporting write-only commands.

Brief Description of the Drawings [0014] FIGURE 1 is a simplified block diagram of a prior art microprocessor arrangement;

[0015] FIGURE 2 is a simplified block diagram, illustrating details of a register or memory of FIGURE 1 ;

[0016] FIGURE 3 is a simplified schematic diagram of a one-bit portion of a portion of a register of FIGURE 2;

[0017] FIGURE 4 is a simplified diagram, in block and schematic form, of a microprocessor arrangement according to an aspect of the invention, in which "write-only" registers are used to isolate the processed and stored data from the original data source; and

[0018] FIGURE 5 is a simplified block and schematic diagram of a one-bit portion of the write-only register of FIGURE 4.

Description of the Invention

[0019] FIGURE 4 illustrates an arrangement according to an aspect of the invention. In FIGURE 4, elements corresponding to those of FIGURE 2 are designated by like reference alphanumerics. The invention may be embodied in an electronic device such as a smart card capable of carrying out the process of writing data into a secure memory location while preventing outside queries from external sources (e.g. sources coupled via an interface from μP 12) to gain access to the data stored in those memory locations. As illustrated in FIGURE 4, the outputs of all the individual registers of register set 14S except registers 0004h and 0005h are ignored, and the registers may be used in the usual manner for temporary storage of data or for control purposes. Individual register 0004h of register set 14S of FIGURE 4 is illustrated as having its 8-bit output path 24S4 connected to the input of an address decoder 416. Individual register 0005h is illustrated as having its 8-bit output path 24S5 connected to the data bus 418 of a further set of individual 8-bit registers 414S of a "write-only" register 414. The 8-bit address applied to address decoder 416 is capable of individually identifying as many as 256 elements. Thus, register 414 can have as many as 256 individual registers, with each uniquely identified.

[0020] When data is to be written to write-only register set 414, the data is transferred to register 0005h of register set 14S, and the address of the write-only register to which the data is to be written is loaded into register 0004h of register set 14. The selected or addressed one of the write-only registers of set 414S of registers is therefore enabled for writing the data on the data bus 418, awaiting only the WRITE command. When the WRITE command is made to the selected one of the write-only registers, the data originating from read/write register 0005h is written to the write-only register. Note that the READ command produced by microprocessor 12 is not coupled to write-only register set 414S, so there is no way to access the data written to the read/write registers after the data is overwritten or erased from the read/write registers. In this manner, access from an external source via an interface (e.g. port 12IO, see FIGURE 1) to the microprocessor or controller associated with the smart card or other electronic device is deterred. Each of the registers 414 shown in FIGURE 4 have corresponding output paths 424Sι, 424S₂, 424S₃, 424S₄, ...,424S_F of set 424S. Logic circuitry including for example, another processor, hardware and/or firmware, or other electronic components, may be coupled to the output paths 424S of the write-only registers 414 for accessing the data in the corresponding write-only register independent of a read signal from μP 12. If desired, a register can be used which is capable only of writing, and not of reading back to the source. [0021] FIGURE 5 is a simplified diagram in block and schematic form illustrating a write-only register which might be used in the arrangement of FIGURE 4. FIGURE 5 is similar to FIGURE 3, and similar elements are designated by like reference numerals. In FIGURE 5, the READ switch 334 is absent, which prevents reading back to the source of the stored data bit, even if a READ signal should be applied. A READ signal, even if applied, would find no switch on which to act.

[0022] Thus, a register (500) according to an aspect of the invention, in which the reading and writing functions are separated, comprises a two-state storage device (314), such as a flip-flop, including a data port for receiving data having one of two possible states. A write strobe circuit (332) is connected to the storage device (314), for, in response to application of a write strobe to the write strobe circuit (332), enabling the storage device (314) to accept the data and to store the one of the two states. A read strobe circuit independent of the write strobe circuit (332) is connected to the storage device, for enabling reading of the storage device in response to a read strobe applied to the read strobe circuit.

[0023] A method according to an aspect of the invention is for loading information into memory in a manner which cannot be read by the loading software. The method comprises the steps of generating a bit of data to be loaded into memory, where the bit of data has two possible states. A write strobe is generated. The method includes the step of procuring, for each bit of information to be loaded into memory, (a) a two-state storage device including a data port for receiving data having one of two possible states, (b) a write strobe circuit connected to the storage device, for, in response to application of the write strobe to the write strobe circuit, enabling the storage device to accept the data and to store the one of the two states, and (c) a read strobe circuit independent of the write strobe circuit, the read strobe circuit being connected to the storage device, for enabling reading of the storage device in response to a read strobe applied to the read strobe circuit. The method also includes the step of applying the bit of data to the data port in timed relationship with application of the write strobe to the write strobe circuit, and at a later time, applying a read strobe to the read strobe circuit to enable reading of the data applied.

[0024] While the foregoing invention has been described with reference to the above embodiments, various modifications and changes can be made without departing from the spirit of the invention. Accordingly, all such modifications and changes are considered to be within the scope of the appended claims.

Claims

WHAT IS CLAIMED IS

1. A register in which the reading and writing functions are separated, comprising: a two-state storage device including a data port for receiving data having one of two possible states; a write strobe circuit connected to said storage device, for, in response to application of a write strobe to said write strobe circuit, enabling said storage device to accept said data and to store said one of said two states; and said two-state storage device lacking a read strobe port.

2. A register according to claim 1, wherein said two-state storage device comprises: at least first and second registers, each including write command and read command input ports, and data input and output ports; third and fourth registers, each including an address port, a write command input port, and data input and output ports, but not including a read command port; a bus coupling said data input port of said fourth register to said data output port of said second register; an address decoder coupled to said output port of said first register, and having a decoded address output port coupled to at least said address port of said third and fourth registers; control means including a write command output port coupled to said write command input ports of said first, second, third, and fourth registers, a read command output port coupled to said read command input ports of said second and third registers, and a data output port coupled to said data input ports of said second and third registers, for writing to said first register the address of said third register, for writing particular data to said second register which is to be written to said third register, so that a write command applied to said third and fourth registers writes said particular data from said second register to said third register, and so that said control means cannot read said particular data from said third register, but said particular data remains available at said data output port of said third register.

3. A register according to claim 1, wherein said two-state storage device comprises: at least first and second registers, each including write command and read command input ports, and data input and output ports; third and fourth registers, each including an address port, a write command input port, data input and output ports, and a read command port; a bus coupling said data input port of said fourth register to said data output port of said second register; an address decoder coupled to said output port of said first register, and having a decoded address output port coupled to at least said address port of said third and fourth registers; control means including a write command output port coupled to said write command input ports of said first, second, third, and fourth registers, a read command output port coupled to said read command input ports of said second and third registers, and a data output port coupled to said data input ports of said second and third registers, for writing to said first register the address of said third register, for writing particular data to said second ^" register which is to be written to said third register, so that a write command applied to said third and fourth registers writes said particular data from said second register to said third register, and so that said control means cannot read said particular data from said third register, but said particular data remains available at said data output port of said third register; and a source of read command signals which is independent of said control means and which is coupled to said read command input ports of said third and fourth registers, for enabling reading of said particular data.

4. A method for loading into memory information in a manner which cannot be read by the loading software, said method comprising the steps of: generating in said loading software a bit of data to be loaded into memory, said bit of data having two possible states; procuring, for each bit of information to be loaded into memory, (a) a two-state storage device including a data port for receiving data having one of two possible states, (b) a write strobe circuit connected to said storage device, for, in response to application of said write strobe to said write strobe circuit, enabling said storage device to accept said data and to store said one of said two states, and (c) a read strobe circuit independent of said write strobe circuit, said read strobe circuit being unconnected to said storage device; applying said bit of data to said data port in timed relationship with application

11. The electronic device of claim 5, further comprising logic circuitry coupled to outputs of said write-only registers for accessing said data in said corresponding write-only register independent of a read signal from said controller.