CN1122634A - a secure memory card - Google Patents

Abstract

A kind of safe storage card, which includes a mini-processor on a semi-conductor chip and one or a plurality of non-easily lose website retrievable memorizer chips. The mini-processor chip and non-easily lose memorizer chips are jointly connected with the bus inside the card. The mini-processor includes website retrievable non-easily lose memorizer. The memorizer of each chip is composed of a plurality of pieces or groups, and each memorizer chip contains a safe controlling logic circuit. These circuits contain a plurality of non-easily lose or easily lose storage devices, only when the mini-processor determinates that the user completes the pre-set recognition processing successfully with the main computer, the storage device can be provided with keys or composite information under the controlling of the mini-processor.

Description

a secure memory card

The present invention relates to the field of portable personal computers, and more particularly, to a system for maintaining data security in a mobile digital information environment.

The security of personal information is a constant concern. Security has been ensured by locks, codes and pockets. As information takes new forms, new approaches are required to meet this changing situation.

Historically, the security of information has been ensured through the use of signatures, credentials and photographs. Electronic devices such as ATMs add coded cards and personal identification numbers (PINs) to the security methods. Computer systems continue to use passwords.

More recently, a "smart card" has been used as a security tool. The "smart card" is a small microcomputer with writable non-volatile memory and simple input/output interfaces, manufactured as a single piece and enclosed in a plastic "credit card". It has external solder points (pads) that allow it to be attached to specially designed devices. The program contained in the microcomputer of the card cooperates with this device, so that the data in the non-volatile memory in the card can be read or modified according to the required algorithm, including changing the password. Special techniques have been implemented to protect stored information and make various permissions according to the situation. For example, in U.S. Patent 4,382,279, entitled "SingleChip Microprocessor with On-Chip ModifiableMemory," a structure is disclosed that allows automatic programming of non-volatile memory, which is included on the same chip as a processing and control unit, as in other systems Likewise, a microprocessor only protects memory on the same chip.

"Smart cards" have been used to simplify the identification process and serve as physical depository for valuable information. In this case, as in most cases in the past, the actual existence of the "key" and some know-how are used as part of the verification or identification process. In the above cases, identification is a dialogue between a person wishing to gain access and a fixed device such as a security guard or an automated teller machine.

The current state of portability of stand-alone computing devices makes the actual keys and identification means smaller, more portable, and thus more susceptible to loss or theft. Also, the computing device is capable of repeated heuristics to guess or infer know-how or passwords related to the identification process. This is especially the case if the identifying device or equipment is also under the control of the thief. To make matters worse, technology now allows and encourages carrying around large amounts of confidential information that is easy to steal.

Today, notebook or subnotebook-sized computers provide a powerful, self-contained environment that allows for massive computations that require additional data storage capacity. This was initially met by miniaturized hard disk devices that held programs and data. Although password protection is often used in these systems, it cannot completely protect confidential data. This is because: firstly, the identification device itself is vulnerable. More importantly, however, the disk drives containing the data can be removed and accessed in a more accessible setup for data analysis. In this case, only some form of encryption can protect the data. The nature of disk access makes this possible without performance and cost barriers. An example of such a system is disclosed in US Patent 4,985,920 entitled "Integrated Circuit Card".

The recent advent of flash memory and removable "memory cards" has greatly reduced the size and power consumption of portable computers. Flash memory combines the flexibility of random access memory (RAM) with the performance of disk. Now, the combination of these technologies allows for the inclusion of up to 20 megabytes of data without the need for power, and in a portable package the size of a credit card. The data can be present on the host system, either as if contained on a conventional disk drive, or as if it were an extension of main memory. These technological developments allow the system to be reduced in size to such an extent that it fits in a pocket rather than a handbag or suitcase.

As a result, data and its host system are more susceptible to loss or theft, while using encryption to protect stored data is more difficult as it becomes a major barrier to performance and cost.

Accordingly, it is a primary object of the present invention to provide a portable digital system having a secure memory subsystem.

Another object of the present invention is to provide a memory card which can be protected if it is removed from the portable digital system.

Another object of the present invention is to provide a memory card in which the chip of the card remains protected if it is removed from such a card.

The above objects are achieved by the security card in the preferred embodiment of the present invention. The secure memory card includes: a microprocessor mounted on a single semiconductor chip, and one or more non-volatile addressable memory chips. The microprocessor chip and the non-volatile memory chip are commonly connected to an internal card bus which is used to transfer address, data and control information to the non-volatile memory chip. The microprocessor includes addressable non-volatile memory for storing information including several keys, configuration information, and program instruction information for controlling the transfer of addresses, data, and control information on the internal bus. On-chip memory consists of several blocks or banks, each with multiple addressable locations.

According to the invention, each memory chip includes security control logic. In the preferred embodiment, these circuits include nonvolatile lock memory, nonvolatile latch enable elements and volatile access control memory, each of which can be loaded under microprocessor control. More specifically, the microprocessor first loads the lock value in the non-volatile lock memory and resets the lock storage enable element to disable access. Thereafter, the microprocessor loads the access control memory according to the configuration information. This information is only loaded after the microprocessor has determined that the user has successfully completed the intended identification process with the host computer. The security logic of each memory allows the reading of information stored in selected address blocks of the flash memory according to the configuration information loaded in the access control memory of the memory chip. The user is periodically required to successfully perform identification processing with the host computer, and the user continues to read information as permitted by the access control memory. In a preferred embodiment, the host computer is coupled to the memory card through a standard interface, such as an interface compliant with the Personal Computer Memory Card International Association (PCMCIA) standard.

The present invention combines "smart card" and "memory card" technologies that are key to utilizing fast storage technology to protect large amounts of data in a "secure" environment that has achieved electronic miniaturization. Furthermore, the present invention is able to take advantage of improvements and enhancements of both technologies.

In addition, the secure logic of the present invention is incorporated into and operates with flash memory in a manner that reduces the amount of changes to the basic logic of the flash memory. More specifically, flash memory can be operated in a secure manner, or it can be operated in a non-secure manner, in which case the security logic is bypassed, allowing the flash memory to be operated as if no such circuitry existed. operate. The non-secure mode is entered when the contents of the non-volatile lock memory of the flash memory are erased. This generally indicates an unprogrammed or completely erased flash memory, which is usually erased to a predetermined state (ie, all "1" states).

With the addition of a small amount of logic to the flash memory and the "Access Control Processor" (ACP), the contents of the flash memory are made secure without data encryption. Therefore, the present invention eliminates the operation of encrypting data and decrypting data, which is quite time-consuming for large blocks of data.

In operation, the ACP periodically prompts the user to enter some form of identification. This could be a password, a PIN, a specific pen computer "gesture" made at a specific point on the writing surface, a voice command or a "user's voice print". Methods vary by system. The programmable ACP allows the user to change the specific content recognized and the frequency of the reminder. The code for identification and the data required to lock and access control memory are stored in the ACP's non-volatile memory, which is on the same chip as the ACP and thus protected.

As noted above, successful recognition causes the ACP to enable or sequentially enable access to all or selected blocks of flash memory. A failure renders access to the flash memory impossible. Thus, similar to "dead man suffocation", any failure to successfully complete the identification will have the flash memory data protected. In addition, instructions issued by the user can also cause access to be prohibited. Furthermore, when power is first applied from a power-off condition, access is blocked, thereby protecting the contents of the memory until the first identification is successfully completed.

Thus, if the memory card or its host processor is lost, stolen, powered off or left unattended, the data in the memory is protected from access immediately or immediately after the identification of the current cycle is complete. In the event of theft, even if the memory card is opened and electronically probed, or the memory chip is removed and placed in another device, the memory data can be protected from access.

The above objects and advantages of the present invention will be better understood from the following description in conjunction with the accompanying drawings. in:

FIG. 1 is an overall block diagram of a system including a memory card of the present invention.

FIG. 2 is a detailed diagram of the access control processor (ACP) of FIG. 1 including non-volatile memory.

FIG. 3 is a detailed block diagram of a modification of the standard flash memory of FIG. 1 according to the present invention.

4 and 5 are flow charts of various identification processes performed by the memory card of the present invention.

Figure 1 is a block diagram of a secure portable handheld computing system 1 that can be used as a personal computer or as a transaction processor. System 1 includes a memory card 3 constructed in accordance with the present invention, which is connected via bus 102 to host processor 5 . The main processor 5 may be in the form of a handheld personal computer, such as the HP95LX manufactured by Hewlett-Packard. The main processor 5 includes a liquid crystal display (LCD) 5-2, a keyboard 5-4, a microprocessor 5-6, a memory 5-8, and a serial interface 5-10, all of which are connected to the bus 106. Memories 5-8 include a 1 Mbyte read only memory (ROM) and a 512K byte random access memory (RAM).

The connection between the memory card 3 and the main processor 5 is established through a standard bus interface. In the preferred embodiment, bus 102 complies with the Personal Computer Memory Card International Association (PCM-CIA) standard. The interface 102 provides a path for transferring address, control and data information between the main processor 5 and the memory card system 3 through the standard interface chip 104 and the memory card bus 105 . Buses 102, 105 and 106 each include a data bus, a control bus and an address bus and provide a continuous signal path through all such buses. For example, the bus 105 includes an address bus 105a, a data bus 105b, and a control bus 105c.

The PCMCIA bus standard has evolved from one that supports disk emulation on memory cards to another completely different standard that allows random access to stored data. The memory card of the present invention supports this new standard of protection by providing fast access to random storage locations without encryption. By controlling the data path that carries data from the storage array to the host, the memory card of the present invention protects data without adding any time-consuming buffering, decryption, or other serial processing in this path.

Typically, the user operates the operating system 1 from the keyboard 5-4 to perform typical operations, such as performing a spreadsheet and a database function of displaying information on the display 5-2 and updating information stored in a file in the memory card 3 . The host processor 5 then sends the address information over the bus 102 to retrieve the information, update it if necessary, and send this information back to the memory card 3 along with the necessary address and control information.

As shown in Figure 1, the memory card 3 of the present invention comprises the access control processor (ACP) 10 that is connected with the bus 105, and several (n) CMOS fast memory chips 103a to 103n, each of which is connected with the bus 105 . ACP 10 is generally the same type of processing element used in a "smart card". The CMOS flash memories 103a to 103n may take the form of flash memory chips manufactured by In-tel Corporation. For example, it may be in the form of an Intel flash memory chip designated Intel28F001BX 1M, which includes eight 128K bytes x 8 CMOS flash memories. In this way, a 4M fast memory card can include 32 CMOS fast memories. That is, "n"=32.

Figure 2 is a block diagram of the access control processor (ACP) of the preferred embodiment of the present invention. As shown, ACP 10 includes protected non-volatile memory 10-2, random access memory (RAM) 10-4, microprocessor 10-6, interval counter 10-8, and interface block 10-10 connected to bus 105 . Non-volatile memory has address locations where identifying information and programs are stored. More specifically, storage location 10-2a stores one or more personal identification numbers (PINs), protocol sequences, or other identifying information used to authenticate a user's access to the system and to Blocks in flash memory 103a to 103n that can be accessed outside of the time interval value of .

The storage location 10-2b stores a key value used to protect each flash memory 103a to 103n or a code used to protect each block of each flash memory 103a to 103n.

Memory location 10-2c stores a sequence of program instructions for performing the required identification operations and for clearing the system if preset failure conditions are met. Certain program instructions cause the user to control the setting of interval counter 10-8, which is established when user re-identification occurs. The re-identification interval defines the time between interrupts and is used to issue interrupts to the host 5 that require the user to re-enter a PIN or other password for user identification. The interval count 10-8 receives the clock pulse from the host computer 5 through the bus 102, and is set by the user according to his working environment. For example, at home, the user can turn off the timer (ie set it to the maximum value), or set the time interval to 1 hour. On an airplane, users can set it to 10 minutes for added protection. As described herein, the user is reminded to recheck the interval setting each time the power is turned on, thereby forcing periodic re-identification to ensure safety.

FIG. 3 is a detailed block diagram of the flash memories 103a to 103n. Only the detailed logic circuit of memory 103a is shown because 103b to 103n have the same structure as 103a.

The flash memory 103a basically consists of two parts, one part contains the secure access control circuit of the present invention, and the other part contains the basic or standard logic circuit of the flash memory.

As can be seen from Fig. 3, the security control circuit of the present invention comprises 32 key registers, 32 volatile lock registers 33, 12 delay counters 32, comparator circuits 39, all check signal circuits 38 of 1 (ONES), non-volatile Unlock memory 35, one-bit non-volatile lock storage enabling element 36, volatile access control memory 43, access correction permission AND gate 34 and output OR gate 45 are arranged as shown in the figure. It will be noted that this part receives command control signals represented by different hexadecimal values (eg 31H to 38H) from the command register 50 included in the basic logic part. These signals indicate the various data values of the command set received from the ACP 10 by the command register 50 via the data bus 105b. These instructions are an important extension to the instruction set commonly used by flash memories. Standard flash memory instructions take the form of instructions utilized by the 28F001BX flash memory. These instructions are described in the already published "Memory Products" published by Intel Corporation, which is incorporated herein by reference. The instructions used in the present invention are shown in Table 1.

Referring to Table 1, the first instruction shown is the Load Lock Memory instruction which is used to load the random number generated lock value into the non-volatile lock memory (LM) 35 in each memory 103a to 103n. Each memory 103a to 103n can have a different lock value or the same lock value, depending on the user's security needs. The lock value is loaded into LM35 under the control of 1-bit non-volatile storage element 36 through key (K) register 31 . The reset lock storage enable command of Table 1 is used to reset storage element 36 . This prevents the lock value stored in LM 35 from being changed, since storage element 36, once reset by the reset lock store enable command, cannot be set again. The nonvolatile contents of LM35 are transferred to L register 33 at power-on. It will be noted that the location and location of lock memory 35 is a matter of design. For example, memory 35 may be implemented as an extension to storage array 54 .

The load key register instruction of Table 1 is used to load the key register 31 and set the delay counter 32 . The Decrement Delay Counter instruction is used to decrement the content of the delay counter 32 by one through the ACP. The allow read memory block and disable read memory block instructions are used by the ACP 10 to allow or disable access to different memory blocks of the memory array 54 during loading of the access control memory 43 .

Table 2 instruction First Bus Cycle Operation address data Second bus cycle address data Load Lock Memory Reset Lock Store Start Load Key Register Decrement Delay Counter Allow Reading Memory Blocks Disable Reading Memory Blocks write write write write write 31H33H32H35HMBA 34HMBA 38H write can't use write can't use write Unavailable Unavailable Key Data Unavailable MBAMBA

Load lock memory (31H)

This instruction copies the contents of the key register 31 into the non-volatile lock memory 35 if and only if the lock store enable 36 output signal is TRUE.

Reset lock storage start (33H)

This instruction resets the lock store enable logic element 36, thereby inhibiting the lock store 35 from being loaded or changed.

Load key register (32H)

This instruction shifts the original contents of key register 31 by one byte (LSB to MSB) and loads the "key value" from ACP 10 into the LSB of the key store.

Furthermore, it sets the delay counter 32 to its maximum value, ie all ones.

Decrease delay counter (35H)

This instruction decrements the content of delay counter 32 by one. The delay counter must equal zero to allow subsequent reads to the memory array 54 .

Allow to read storage block (34H)

This instruction sets the bit in address control memory 43 corresponding to the memory block address (MBA) if and only if address modification enable signal 37 is TRUE. This allows read access to selected blocks.

Prohibition of reading memory block (38H)

This instruction resets the bit in the address control memory 43 corresponding to the address of the memory block.

After examining Table 1 in detail, it can be seen that Table 1 also represents the bus cycle operations for each additional instruction. During each first bus cycle for each instruction requiring two bus cycles, instruction register 50 receives an 8-bit instruction issued by ACP 10 via data bus 105a of bus 105 and input buffer 51. The instruction register 50 conditions the selected logic elements to receive from the data bus 105b the information necessary to execute the instruction during the second bus cycle. As shown, the second bus cycle is specified as not available (N/A) because the Reset Lock Store Start and Decrement Latency Counter instructions only take one cycle.

During normal operation, the K register 31 is loaded with the key value received from storage location 10-2b using the load key register instruction, and the delay counter is set to its maximum value. Delay counter 32 is decremented all the way to zero in response to successive decrement delay counter commands received by ACP 10 and produces a zero count output signal 41 which is applied to the input of AND gate 34 .

Each delay counter 32 limits access attempts to flash memory 103a to 103n as the thief removes the chip and places it on an "illegal card" and programs the processor or device to repeatedly try to guess the keyed value of each memory chip times. In other words, the counter 32 ensures that enough attempts must be made to illegally access flash memory. The parameters of the choice key and delay counter make this test take an unreasonable amount of time.

More specifically, key register 31 stores approximately 4 gigabytes (2 ³² ) of different combinations. In the preferred embodiment, delay counter 32 is a 12-bit counter. Assuming that the delay counter 32 is decremented by 1 every microsecond, each trial in guessing the key value will take ²¹² times or 4 milliseconds. After the ACP10 knows the correct key value, there is only a 4 millisecond delay when it is first established. A random trial to guess the key value would require ²³¹ attempts for a 50% probability of success. It would take 2 ³¹ × 2 ¹² milliseconds or 102 days to guess the key value. That's enough time to stop most burglars. Of course, longer or shorter times can be provided by varying the key and delay counter 32 parameters.

When the memory card of the present invention is stolen and put into an "illegal host", the ACP 10 utilizes known techniques to limit the number of attempts the thief makes to guess the PIN. Such techniques may include locking access or corrupting data if a threshold number of incorrect guesses is exceeded.

During the first identify operation of flash memory 103a, the key value is loaded into 32-bit K register 31 in response to four consecutive load key register commands (ie, data bus 105b is a one byte wide bus). The delay counter 32 is forced to its maximum value (all 1s) and decremented by the ACP 10 issuing a Decrease Delay Counter instruction on the first consecutive bus cycle. When the delay counter is decremented to zero, a zero count signal 41 is issued, which is applied to an input of AND gate 34 .

If the key value stored in the K register 31 is equal to the lock value stored in the corresponding L register 33, it means that the user provides correct identity to the host computer 5, and then the comparison logic 39 adds the comparison equal signal 42 to the AND gate 34. another input. This causes AND gate 34 to generate access change enable signal 37 at its output, which initiates writing to access control memory 43 under the control of ACP 10 . This in turn allows access to the storage array 54 .

Each block/group of memory array 54 of access control memory 43 includes 1 bit of volatile storage. These bits are cleared to zero as part of the fast memory power-up sequence. In order for data to be read from memory 103a, the bit corresponding to the addressed memory block must be a logic 1. These bits are set by the ACP 10 issuing the Allow Read Memory Block command if and only if the access change enable signal 37 is TRUE.

As shown in Table 1, during the second bus cycle that allows the read memory block instruction, the three high-order address bits of the selected memory block of the memory array 54 are sent through the address bus 105c, and sent to the memory block by the data bus 105a. The instruction register 50 repeatedly issues the instruction identification code in hexadecimal. This results in a 1 being written to the addressed bit location in the access control memory 43 . In the preferred embodiment, the sequence of read memory block instructions is allowed to be repeated eight times since memory array 54 is formed of 8 blocks of 16K bytes each. ACP 10 can restrict access to selected blocks in a similar manner by issuing sequences of prohibit read memory block commands.

The output of the access control memory 43 of the present invention is sent to the output buffer 52 as an enable input during each fast memory read cycle when the contents of any block location of the memory array 54 is read. That is, a read cycle can occur, however, reading data through output buffer 52 is inhibited in the absence of an appropriate block access control memory gate signal. More specifically, in the case of the preferred embodiment, the access control memory 43 includes 8 individually addressable bit storage elements connected to the input of each storage element 3 to 8 bit address decoder and connected to 1 to 8 output multiplexer circuit for the output of each storage element. The three high-order address bits of each address are decoded and used to select storage elements for the block whose contents are to be changed. Similarly, the same three bits are used to select the output of the storage element for the block containing the flash memory location being read.

If the lock memory 35 is completely erased, ie all 1s, as indicated by the contents of the L register 33 being all 1s, then the output buffer 52 is always enabled. That is, when the lock register 33 contains "all ones", a signal is sent from the all ones detection element 38 to the OR gate 15 to enable the output buffer 52 . This puts the flash memory 103a in non-secure mode. This bypasses all of the safety logic of the present invention. Thus, the same flash memory chip can be used for secure and non-secure applications, which results in reduced costs.

As shown in Figure 3, the fast storage basic logic circuit includes a storage array 54, an instruction register 50, an input/output logic circuit 60, an address latch 56, a write state machine 61, a clear voltage system 62, an output multiplexer 53, Data register 55, input buffer 51, output buffer 52 and status register 58 are shown. The basic logic circuit of the flash memory 103a as described above takes the form of a circuit included in the flash memory of 28F001BX manufactured by Intel Corporation. Since such circuits are conventional, they will be described to the extent required. Additional information on this circuit can be found on pages 3-109 through 3-134 of publication entitled "Memory Products" Serial No. 210830, published by Intel Corporation in 1992. As shown in Figure 3, the flash memory basic circuit receives several input signals (A0-A16), addresses, data signals (D00-D07) and control signals (CE, WE, DE, PWD and VPP). These signals are described in Table 2.

Table 2. Signal Description Symbol Name and Function A0—A16 Address Input for Memory Address.

  During the write cycle, the address is internally latched D00-D07 Data input/output: input data and pointers during the memory write cycle

Command; output data during store and status read cycles. When the chip is not selected

When the selection or output is disabled, the data pointer is active when it is high and floats to

Three-state break. During a write cycle, data is latched internally. The CE chip allows: control logic of the boot device, input buffer, decoding

amplifiers and sense amplifiers. It works when CE is low, but not when CE is high.

Select memory devices and reduce power consumption to spare levels. PWD Power Down: Puts the device into deep power down mode. PWD is low

It works when PWD is high; it controls normal operation when PWD is high. PWD =

VHH allows memory block programming. PWD is active when low and also

Latch clear or write operations to provide data protection during power transitions

protect. OE Output Enable: Controls the device through the data buffer during a read cycle

Output. Active when OE is low. WE Write permission. Controls writing to instruction registers and array blocks. WE is low

works when . Address and data are latched on the rising edge of the WE pulse

live. V _pp Clear/Program Power. The block used to clear the array or the code for each block

program bytes. Note: When V _pp < V _pp Max, memory contents are not

Can change.

As shown in Table 2, chip enable (CE), write enable processor (WE) and output enable (OE) signals are added to instruction register 50 and I/O logic 60 from host computer 5 through bus 102 and control bus 105b, and are separated to control dedicated logic blocks. A power down (PWD) signal is also applied to command register 50 to cause the flash memory to perform the operations specified in Table 2. This signal can be used to clear the volatile memory elements of the flash memory security control section as needed, thereby forcing user identification when normal operation resumes.

In general, the basic logic elements of flash memory operate in the following manner. Information is stored in memory array 54 via data bus 105a, input buffer 51 and data register 55 at the address location of one of the memory blocks specified by the address received by address logic 56 from address bus 105c. Information is read from specific address locations of blocks of memory array 54 and sent to host processor 5 via output multiplexer 53, output buffer 52, data bus 105a and bus 102. Status register 58 is used to store the state of the write state machine, error pending state, clear state, program state and V _pp state.

Write state machine 61 controls block clearing and controls program algorithms. The program/clear voltage system 62 is used to clear the blocks of the memory array 54 or the programming bytes of each block along with the variation of the V _pp value (that is, when V _pp is high, programming can be performed; if V _pp is low, the memory 54 as read-only memory).

The operation of the secure memory card of the present invention is described below with reference to the flowcharts of FIGS. 4 and 5 . Before explaining this operation in detail, the steps related to the manufacture, specification and operation of the memory card will be described first.

As a first step, when the card is manufactured, the ACP 10 sets the lock value for each memory chip on the memory card. This is done by loading key values into the lock memory of Figure 3. These values are stored in the ACP's protected non-volatile memory 10-2 (ie keys 1-n in Figure 2). The lock store enable element 36 is then set to zero to inhibit further changing or reading of the contents of the lock store. Because these elements are nonvolatile, they cannot be changed unless the entire flash memory chip is erased.

As a second step, when normalization is applied, the memory card can be loaded with its data or application software since the write is not affected by the protection function. The ACP 10 is then loaded with information regarding the block structure of the memory and the degree of protection applied to each block of memory.

As a third step, during user normalization, the user establishes parameters regarding the manner and frequency of identification as well as specific data required (eg Personal Identification Numbers (PINS)). This information is stored in the memory of the ACP.

As a fourth step, when the power is turned on, "key register", "access change permission" signal and "access control memory" are initialized, thereby prohibiting access to data or writing to the access control memory 43 . A first identification session is initiated.

During the first identification session, the ACP 10 uses the services of its host 5 to alert the user and receive identification information. If the identification is not successful, no more operations are performed; if successful, the key register of each memory chip is loaded with the value stored in the ACP memory. During this operation, delay counter 32 disables chip operation for a period of time after loading, thereby rendering random probing an ineffective process. Loading of the key register causes the "Access Change Enable" signal to be TRUE in each chip. The ACP 10 then loads the access control memory according to the stored information configuration, thereby enabling access.

As a sixth step, the ACP 10 performs additional user identification (re-identification) when the identification session is periodically performed in accordance with the user's configuration thereafter. In the event of a failure, the ACP 10 forces all memory chips to a powered state, thereby prohibiting any access to data in the memory by clearing the access control store 43 and clearing the contents of the key register 31 . Referring now to FIGS. 4 and 5, the operation of the system of FIG. 1 will be described.

Figure 4 illustrates the various modes of operation in block diagram form. Blocks 402 and 401 represent two start conditions. In block 402, the user inserts the memory card 3 in the host computer 5, which is pre-powered. In block 401, the user powers on the host 5 with the memory card 3 installed.

In each of the start-up operations described above, during block 402, the ACP 10 and its interfaces are initialized in a conventional manner, and block 403 clears all "n" K registers 31 and "n" access control stores 43 as flash memories 103a to Part of the 103n's internal initialization sequence. This prevents any data from being read from the memories 103a to 103n because the output buffer 52 in each memory is disabled. As a result of power-up, the lock value is loaded into "n" L registers 33 from the respective LMs 35 .

At this point, at block 404, the ACP 10 issues an interrupt signal to the host 5, which responds by requesting a PIN or other identifying information from the user. At block 405, the ACP 10 checks, by the program stored in the storage location 10-2a, whether the PIN or other identification information matches the information stored in the storage location 10-2a. If not, decision block 406 counts an error, and ACP 10 turns to block 404 to repeat the trial. If the preset number of test failures is reached, decision block 406 turns to block 407 to cause ACP 10 to lock or destroy the contents of memory 103a to 103n.

If in decision block 106 there is a match indicating successful recognition, then in block 408, ACP 10 loads each K register 31 with the appropriate key value from storage location 10-2b by a load key register instruction. Block 409 also repeatedly decrements the contents of delay counter 32, issuing successive decrement delay counter instructions to binary zeros, thereby generating zero count signal 41 in FIG.

In block 410, each access control memory 43 location is loaded with information allowing a read memory bank instruction, thereby allowing access to the selected corresponding block in flash memory 103a to 103n.

At block 411, the ACP 10 waits for the end of the preset time interval established by the information issued by interval counter 10-8 and stored in memory location 10-2a before requesting user re-identification. Then, at block 412, the ACP 10 interrupts the host 5 to request the user to re-enter the PIN or other required identification.

Decision block 413 checks whether the PIN or other information received from host 5 matches the information stored in memory location 10-2a and records the output of interval timer 10-8. The user generally has a preset time interval of 30 seconds, during which the identification information is entered into the host computer 5 . Although the clock is running, if the decision block 413 test fails, then block 414 records it as an error. At the same time, it checks for the maximum number of errors received and turns to repeat blocks 412 and 413. If the number of errors is equal to the maximum number of times, then in block 415 the APC 10 clears the flash memory K register 31 with successive load key register instructions and clears the access control memory 43 with successive disable read memory instructions. Block 415 then branches to block 404, allowing a new "first identify" operation.

If the test in block 413 is successful, the K register 31 remains unchanged (ie retains the key previously loaded by the ACP) and the user is allowed to continue with the operating system 1 . In the event that 30 seconds have elapsed without a PIN or other message being received at decision block 413, ACP 10 then clears K register 31 and access control memory 43 as before.

FIG. 5 illustrates how the host 5 responds to an interrupt request from the APC 10 to recognize in response to blocks 404 and 412 of FIG. 4 . As shown, decision block 501 waits for an interrupt from ACP 10 requesting the user to re-enter a PIN or other information. Decision block 501 branches to block 502 when an interrupt from block 404 or 412 is received. Block 502 displays a request for a PIN or other information on the host display 5-2. Block 503 receives information from the keyboard and block 504 interrupts ACP10. Block 5 sends the PIN to ACP10.

Those skilled in the art can understand that various modifications can be made to the embodiments of the present invention without departing from the concept thereof. For example, the present invention can use different types of non-volatile memory and different interfaces, etc.

While the best form of the invention has been described in terms of construction and configuration, certain changes may be made without departing from the concept of the invention as set forth in the claims and, in some cases, certain features of the invention can be used advantageously.

Claims (26)

1. safe memory card that is used for portable principal computer, described storage card comprises:

Be used for transmitting and from the connected microprocessor of described main frame receiver address, data and control information, and described microprocessor comprises to described main frame:

Addressable nonvolatile memory is used for storing the information that comprises a plurality of key assignments and configuration information;

With the internal bus that described microprocessor links to each other, be used for transfer address, data and control information, these information limit the operation that described card will carry out; And

The addressable memory that at least one is non-volatile, link to each other with described bus together with described microprocessor, be used for receiving described address, data and control information, described storer comprises nonvolatile memory part and security control part, described storage area contains the storage array of forming by some, each piece has a plurality of addressable unit, and control logic device, be used for carrying out described storage operation, and described security control partly is connected to described internal bus, described control logic device and described storage array, and described security control partly comprises:

A plurality of non-volatile and volatile memory devices, be used for storing at least one described key assignments with described relevant configuration information; And,

The access control logic device, it links to each other with described control logic device, described memory storage, described access control logic device is only handled in the definite predetermined identification of described microprocessor and is finished with described principal computer, thereby and started described access control logic device and allow from described storage array to read after the described information according to described configuration information, just permission is read by described configuration information and is stored in the institute's canned data that is addressed in the piece described in the described storage array.

2. storage card as claimed in claim 1, wherein said microprocessor and described nonvolatile memory are included on the semi-conductor chip.

3. storage card as claimed in claim 1, wherein said card also comprises interface circuit device, and it is connected to described principal computer to described linking, and wherein said interface circuit device and described microprocessor are included on the same semi-conductor chip.

4. storage card as claimed in claim 1, wherein said nonvolatile memory and described Nonvolatile memory device are short-access storages.

5. storage card as claimed in claim 1, one of them described Nonvolatile memory device is a kind of lock memory, be used for storing and a described corresponding drop lock of key assignments, second of described non-volatile device is one and latchs storage permission element, it links to each other with described lock memory, described lock memory is loaded with described drop lock at first, and the described storage permission element that latchs converts the state of forbidding revising described drop lock under the control of described microprocessor.

6. storage card as claimed in claim 2, the storage of wherein said drop lock and described conversion of latching storage permission element occur in during the initial manufacturing of described storage card.

7. storage card as claimed in claim 5, one of wherein said volatile memory device is addressable access control storer, it has a plurality of positions that quantitatively are equivalent to piece number described in the described storage array, be used for storing described configuration information, described access control storer is connected in described internal bus and described access control logic device, thereby described access control storer only described microprocessor determined described predetermined identification handle successfully finished first by described principal computer make that described access control logic device allows described access control storage after, just under the control of described microprocessor, be loaded.

8. storage card as claimed in claim 7, drop lock in the described lock memory of wherein said threading all is 1, and wherein said security control part also comprises complete 1 detector circuit, it links to each other with described lock memory, the response of described detector circuit is described to be that 1 drop lock produces a signal entirely, this signal is the described security control part of bypass effectively, makes described nonvolatile memory as not operating when described security control control section has not existed.

9. storage card as claimed in claim 7 is wherein connected for the first time with described main computer communication the time when described storage card, at first carries out described predetermined identification and handles.

10. storage card as claimed in claim 9, wherein said access control device comprises that continuous being used for receives the lock register from the described drop lock of described lock memory, comparator circuit, be used for storing the key register that sends the key assignments of described key register by described microprocessor to, be used for storing the counting of determining predetermined time interval delay counter and with described access control storer, the door gear that described comparer links to each other with described delay counter, described comparator circuit is connected to described lock and key register and described door gear, and described door gear links to each other with described delay counter, be used for responding described comparator circuit and produce access modification permission signal, described comparator circuit is when described delay counter has sent signal that described predetermined time interval finishes, send the homogeneity comparison signal between the described lock code value of putting into described lock register, described access is revised and is allowed signal to adjust described access control storer, so that load described configuration information.

11. as the storage card of claim 10, wherein said control logic device comprises and is used for responding by described microprocessor used predetermined instruction group when the operation of the described security control part of each memory chip of control, produces the circuit of command signal.

12. storage card as claim 11, first group of described predetermined instruction that wherein said control logic device response is produced by microprocessor, generation is used for described lock code value is put into first signal of described lock memory, and described first array predetermined sets of instructions produces during the initial manufacturing of described card.

13. storage card as claim 12, second group of described predetermined instruction that wherein said control logic device response is produced by described microprocessor, produce secondary signal, be used for making and describedly latch storage and allow element to be converted to the described drop lock that is stored in the described lock memory is forbidden described reading or the predetermined state of described modification.

14. storage card as claim 12, the 3rd group of described predetermined instruction that wherein said control logic device response is produced by described microprocessor, produce the 3rd signal, being used for a predetermined described key-value pair key memory loads, and described the 3rd group of predetermined instruction has only when described microprocessor have been determined just to be produced by described microprocessor after described predetermined identification processing is successfully finished.

15. storage card as claim 14, wherein to force described delay counter simultaneously be a predetermined count value to described the 3rd signal that is produced by described control logic device, be used for setting up the beginning of described predetermined time interval, and wherein said control logic device response makes described predetermined count value subtract 1 by each the 4th group of described predetermined instruction that described microprocessor produces, after the 4th group of described array predetermined sets of instructions was performed a predetermined quantity, described delay counter sent the signal that the described time interval finishes.

16. storage card as claim 11, several the 5th and the 6th described array predetermined sets of instructions that wherein said control logic device response is sent by described microprocessor, produce the 5th, the 6th signal, be used for according to described configuration information, be provided with and be reset at the position in the described access control storer, thereby which piece in determining described allows sense information.

17. one kind can be installed in the portable principal computer, thus the safe memory card of communicating by letter with described principal computer realization, and described storage card comprises:

Be contained in the microprocessor on the single semiconductor chip, be used for transmitting and from the connected microprocessor of described main frame receiver address, data and control information, described microprocessor comprises to described main frame:

Addressable nonvolatile memory is used to store and comprises and be used for limiting a plurality of key assignments that the user carries out access to the memory block, and limits the memory configurations information that can read a described memory block;

Internal bus is used for transmitting address, data and the control information of the storage operation that qualification finished by described card; And

At least one non-volatile addressable memory links to each other with described internal bus together with described microprocessor, be used for receiving described address, data and control information, described storage chip comprises storage area and security, described storage area contains the non-volatile memory array, it has data output end, and form by some, each piece has a plurality of addressable positions, and control logic device, be used for carrying out described storage operation, described security and described internal bus, described control logic device and the output of described data link to each other, and described security comprises:

With the non-volatile lock memory that described internal bus interrelates, be used for first the reception and the drop lock of being scheduled to that one of storage for good and all and described some key assignments are consistent;

The access control logic device, it links to each other with described control logic device and described lock memory, and selected one that is used in detecting the described key assignments of being delivered to described internal bus by described microprocessor produces the permission signal when conforming to described pre-lock code value; And,

Addressable easy mistake access control storer, it has quantitatively the corresponding a plurality of positions of described number with described storage array, be used for the described memory configurations information of reading accessibility of area definition, described access control storer and described control logic device, described storage array data output, described internal bus and described access control logic device link to each other, thereby described access control logic device has only successfully been finished predetermined identification processing and has been transmitted a described predetermined described storage key code at the definite described principal computer of described microprocessor and made described access control logic device generation be added on the described permission signal of described data output, after thereby output allows to read to the data that limited by described access control memory configurations information, just allow to read the information in the piece that is addressed in described that is stored in the described storage array that limits by described memory configurations information.

18. a safe memory card that comprises several non-volatile memory chips, each storage chip comprises the storage array of being made up of the piece of addressable point, has the ability by some pattern operations, and described card comprises:

Be used for storing the lock memory of drop lock;

Be used for producing the control device of first and second instructions and predetermined key assignments;

The key register that also can respond described first instruction that links to each other with described control device is used for storing described predetermined key assignments;

The comparer that links to each other with described lock memory and described key memory, when described drop lock was equal with described predetermined key assignments, described comparer produced a comparison signal;

That link to each other with described generation device and described first instruction responded to be used for setting its count value be peaked delay counter, and when described delay counter has reduced to zero.The second continuous instruction sequence of its response produces the count value of zero signal;

With the logic circuit apparatus that described comparer and described delay counter link to each other, described logic circuit apparatus responds described comparison signal and described zero count signal, produces access and revises the permission signal;

Described control device is used for producing the 3rd instruction, first address signal and address signal in succession and is used for discerning respectively first described and piece in succession; And,

The access control memory storage, link to each other with described control device with described logical unit, described access control memory storage responds the indication that described access storage allows signal, described address signal and described the 3rd instruction to be used for storing to show a described piece and described in succession piece to be allowed to read.

19. as the system of claim 18, wherein said predetermined value and maximal value are selected enough big, prevent to be accessed in easily the described information of storing in the described nonvolatile memory when making in described storage card is placed in undelegated principal computer.

20. as the card of claim 18, wherein said control device comprises microprocessor, it links to each other with described storer, recognizes when operation when successfully finishing first user, and its produces described first, second and the 3rd instruction.

21. as the card of claim 20, wherein said first instruction is the load key instruction, described second instruction is to reduce instruction, and described the 3rd instruction is to read to allow block instruction.

22. card as claimed in claim 18, wherein said storer also comprises CCE, be used for to predetermined instruction group decoding, make the described capable normal storage operation that sticks into, described CCE comprises the device that additional instruction group is deciphered, described additional instruction group comprises the described the first, the second and the 3rd instruction, thereby provides security for the information that is stored in the described storer.

23. one kind is used to constitute the method that can be contained in the safe memory card in the principal computer, described safe memory card comprises some non-volatile memory chips, each storage chip comprises that described method comprises the following steps: by the piece storage array that constitutes and the control logic circuit that is used to produce the command signal of carrying out storage operation of addressable point

(a) microprocessor is added in the described card, when handle is installed in the principal computer, it links to each other with principal computer and communicates, described microprocessor comprises addressable nonvolatile memory, is used for storing comprising and being used to limit the user to the information of a plurality of key assignments of the accessibility of memory block and limit store configuration information to the accessibility of described memory block;

(b) safety logic circuit of in each non-volatile memory chip, packing into, described safety logic circuit comprises and is used for the non-volatile lock memory of storing predetermined drop lock, the access control logic device that links to each other with described lock memory and addressable easy mistake access control storer, it has quantitatively and the described corresponding a plurality of positions of number, but is used for according to described configuration information storage access bit information;

(c) described microprocessor and the interconnection of each storage chip, so that to each storage chip transfer address, data and control information;

(d) revise described control logic circuit, make its response be used to operate a plurality of instructions of described safety logic circuit;

(e) recognize operation with described principal computer by the user that described microprocessor begins to set up in advance; And

(f) have only when the operation of the identification in step (c) has successfully been finished, just send special instruction in some the described instructions of described each chip to by means of described microprocessor, thereby but the described information that allows to be stored in the different masses be read out according to the described access bit information of in described access control storer, storing.

24. as the method for claim 23, wherein said microprocessor nonvolatile memory has several parts, and wherein also comprises the step that described key assignments is produced random value in the step (a), and described key assignments is put into first part of described several portions.

25. method as claim 24, wherein said microprocessor also comprises the interval counter that links to each other with described microprocessor nonvolatile memory, and wherein step (a) also comprises generation user select time at interval also the step of putting into described interval counter corresponding to the time interval value of described user's selection, and wherein said method also comprises the following steps:

(g) in the time interval that described user selects, the user who starts termly in the described step (e) recognizes operation; And,

(h) as long as the described identification in the step (b) is operated successfully to be finished, but the described information that just continues to allow to be stored in described according to described access bit information is read out.

26. method of making safe memory card, described safe memory card comprises some non-volatile memory chips, be used for storing a large amount of information, each storage chip comprises the storage array of being made up of the piece of addressable position and is used to produce command signal so that carry out the control logic circuit of storage operation that described method comprises the following steps:

(a) microprocessor of in described card, packing into, described microprocessor comprises addressable nonvolatile memory, be used for storing comprise limit the user memory block is carried out access several key assignments information and limit the store configuration information that access is carried out in described memory block;

(b) safety logic circuit of in each non-volatile memory chip, packing into, described safety logic circuit comprises and is used for the non-volatile lock memory of storing predetermined drop lock, the access control logic device that links to each other with described lock memory and addressable easy mistake access control storer, it has quantitatively and the described corresponding a plurality of positions of number, but is used for according to described configuration information storage user access bit information;

(c) described microprocessor and the interconnection of each storage chip, thereby to described each storage chip transfer address, data and control information; And

(d) change described control logic circuit; a plurality of instructions of packing into; be used to operate described safety logic circuit; as the expansion of one group that provides by described control logic circuit general instruction, make described safety logic circuit when described storage card is taken away, protect the described information that described plurality of chips, comprises to be read out in undelegated mode thus at described chip.

Images