Note: Descriptions are shown in the official language in which they were submitted.
DEC-20-99 16:19 Wordsmith P.02 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time' 4:12:06
PM Page 2 of 22
Chip Card for Executing Non-modifiable System Program
Routines and Their Associated Replacement Program
Routines, and a Method for Operating
the Chip Card
EP 0 451 936 A1 describes a program control system for a
transportable data storage unit, in particular, for a chip card.
With the aid of a communications program, a program for priority
monitoring, and a table, the programs can be replaced by
alternative programs if such an exchange is requested by way of an
instruction from the read/write device.
In the case of chip cards, the data, programs rmztines, and the
like that are stored in the non-volatile read memory of the chip
card cannot be modified subsequently. This presents a particular
problem if the programming on the basis of which the chip card is
manufactured has not been finalized, or if i~ intended that
subsequent modifications can be installed. Particularly in the
case of system program routines that are used, fevr example, to
provide for cryptographic security or interface operation
functions, it is frequently desirable to be able to make such
subsequent modifications or adaptations as may be required for a
particular application.
-1-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.03 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 3 of 22
As a rule, the program routines, in particular tree system program
routines, which can, for example, be component of an operating
system of the chip card, can be stored in a non-volatile read
memory in the chip card. Such a non-volatile read memory is, for
example, the so-called read-only memory (KOM) or a non-volatile
read memory that can be reprogrammed but only at great expense
(EPROM).
It is a disadvantage that in order to modify ~vroc~ram routines or
data stored in the non-volatile read memory of the chip card, it
may be necessary to replace all the memory module by a newly
programmed memory modmle. In the case of chip cards, this poses a
special problem if the memory modules have already been integrated
and sealed into the chip card, which means that the chip card is
rendered unusable and a new one has to be mane-factured.
It is the objective of the present invention to make the non
changeable system program routines of a chip card adaptable.
This objective has been achieved with the method for operating a
chip card according to the present invention, as is described in
Claim 1, and a chip card, as described in Claim ~, which is used
to carry out the method according to the present invention.
-2-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.04 R-378 Job-131
From: Collett Calverley 613 849 2280 To: Robert J. Cleland Date: Time: 4:12:08
PM Page 4 of 22
The advantage of the present invention is the fact that the non-
changeable system prcgram routines can be repla~Jed selectively by
replacement program routines. According to the present invention,
when this is done, it can be established whether or not a
replacement program routine is associated with a non-changeable
system program routine by using a check routine incorporated in
the chip card. Should this be the case then, according to the
present invention, the replacement program routine is
executed, whereas in the other case the originally stored system
program routine will be used.
It is an added advantage that instr~zctions of the processing unit
in the chip card, in particular operating system instructions,
which serve to call up the non-changeable sy.~tem program routines
are stored as modified. This means, for example, that the
operating system can be developed and programmed as was usually
the case. Then, in particular, the jump addresses that are used to
call up the system program routines are repla~~~e~~ by new j ump
addresses which lead to the check routines according to the
present invention. This can be effected, for example, by a
modified compiler. A code is transferred as the transfer
parameter to the check routine and this code fl:~gs the system
program routine that was to have been executed ~-~riginally. Each
code is associated with a specific system program routine. In
particular, only the jump addresses that ~,a17up those system
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.05 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 5 of 22
program routines which are to be replaced by replacement program
routines are modified. Because of this, when the chip card is
programmed, two classes of system program ro~ztinPS can be
established, i.e., "replaceable" and "non-replaceable."
It is advantageous that a code that identifi.e~; .~ system program
routine, for example, a so-called "identifier," serves as a search
criterion of the check routine, in particwla.r in a pointer table.
In this, the appropriate codes are associated, for example, with
the memory addresses with which the corresponding replacement
program routines can be called up and executed. And it is an
advantage that a plurality of pointer tables that are linked to
each other can be chained together. It is advantageous that an
additional second pointer table for branching b.~~_k into the
original system program routines serves the check routine in the
event that no appropriate replacement program r~m;tine could be
found. Thus, the operating system remains fully functional by
means of the system program routines, even without replacement
program routines.
One advantage of the ~~hip card according to the present invention
is the fact that the system program routines care be stored in a
non-volatile read memory such as a so-called ROM so as to be
invariable. In contrast to this, the replacement program routines
are stored in a read-write in memory such as an FEPROM
-4-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.O6 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 6 of 22
[electrically erasable read-only mernory]. In this connection, it
is advantageous that replacement programs routines that are
intended to replace specific system program r~~ufi~nes can still be
stored at any time subsequently, even when the chip card is being
operated. This provides for a high level of adaptability and
flexibility in the way that. the chip card accc~r~~ing to the present
invention is used. Furthermore, a more rapid developmental process
for the chip card as possible since when installing the software
in the hardware, in particular the system pro~.~ram routines, it is
not essential that all the details have to be known conclusively.
For example, a system program routine can exist as a type of place
holder, and can be incorporated later as a replac-,ement program
routine for a particular application.
Additional and advantageous versions of the present invention are
described in the corresponding secondary ~~lairra.
The present invention will be described in greater detail below on
the basis of embodiments that are shown in the drawings appended
hereto. These drawings show the following:
Figure 1: the schematic structure of a chip card according to the
present invention, with a non-volatile read memory for
system program routines and a read-write memory for
replacement program routines;
-5-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.O7 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 7 of 22
Figure 2: an example of a flowchart for the method according to
the present. invention that is used to operate a chip
card.
Figure 1 is a diagram showing the structure oi- a chip card CK
according to the present invention with an operating system H that
serves to execute at least the non-changeable system program
routines U, U1...Un. In the method according to the present
invention, before a system program routines U is executed, the
operating system H calls up a check routine OMF and transfers a
code ID which flags the particular system pro~~ram routine to this.
The OMF check routine is also referred to as the overload
management function. Calling up the check routine OMF is indicated
in Figure 1 by the dashed line and arrow that i:~ designated Q11.
Using the check routine OMF and the code ID thar_ has been
transferred, according to the present invention, the operating
system H checks as to whether or not a corresponding replacement
program routine U' is associated with the system program routine
U. This is indicated in Figure 1 by the dashed line and arrow that
is designated Q12. If a replacement program routine U' can be
associated with the current system program routine U, this is
executed, as is indicated by the dashed arrow Q.31. If this is not
the case, the origina_L system program i:outine U is executed, as is
indicated by the dashed arrows Q32 and Q41.
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.08 R-378 Job-131
From: Collect Calverley 613 649 2280 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 8 of 22
In particular, the system program routines U, U1...Un are stored
so as to be invariable in a non-volatile read memory S1 of the
chip card CK so as to execute the method arc~rding to the present
invention. The non-volatile read memory S1 can be a so-called
ROM, for example. The memory addresses A, A1...An of the non-
volatile read memory S1. prcvide the direct or indirect starting
addresses for calling up the system program routines U, LJl...Un.
Furthermore, in the example shown in Figure 1, the replacement
program routines U', U1', U4' are stored, in Fvarticular, in a
read-write memory S2 of the chip card acc~~rding to the present
invention, the memory addresses A', A1', A4' providing the
corresponding starting addresses. As an example, the read-write
memory S2 can be a so-called EEPROM.
In one advantageous embodiment of the method according to the
present invention, the operating system instructions Hl...H3
within the operating system H serve, particu~yarly, to call up non-
changeable program routines U. In the example shown in Figure 1,
this is the jump instruction "CALL." As a rule, this type of jump
instruction has a direct or indirect jump address JMP, which
results in branching to a system program U and to its execution.
When this occurs, in the example shown in figure 2, the jump
instruction that bears the reference number H% causes direct
execution of the system program routine U2. For this reason, the
system program routine U2 cannot be replaced by a corresponding
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.09 R-378 Job-131
From: Collect Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 9 of 22
replacement program routine. In contrast to this, the jump
instructions that bear the reference numbers H1 and H3 serve to
call up the system program routines IJ1 and U3 when, according t.o
the present invention, before these are executed a check is
performed in order to ascertain whether or not a corresponding
replacement program routine U' which is meant to been executed in
place of the system program routine has been assigned. As an
example, in the case of the jump instructions designated H1 and
H3, the original jump addresses JMP which serve to branch directly
to the memory addresses A1 and A3 of the system program routines
U1 and U3 are each replaced by a jump address JMP, which branch es
to check routine OMF. In such a case, the cod es ID1 or ID3 that
are shown symbolically in Figure 1 enclosed in brackets, are
transferred, in particular, as parameters to the check routine OMF
so that this can check whether or not appropriately associated
replacement program routines U' are present..
In another advantageous embodiment of the method according to the
present invention, a memory address A' is assigned to each of the
codes ID of the system program routine U to whi~:h a replacement
program routine U' is assigned. At the memory address A', the
operating system H branches to the corresponding replacement
program routine U', which executes this routine. In the chip card
CK according to the present invention, which is used to perform
the method according to the present invention, a first associ_ati~~n
_g_
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.10 R-378 Job-131
From: Collett Calverley 613 648 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 10 of 22
means T1 serves to provide the association between the
corresponding codes ID and the replacement program routines U'.
These are stored i.n the read-write memory ~2 in the form of a
first pointer table. It is advantageous that the first association
means T1 serve to associate the codes ID1 t.o the memory addresses
A' of the read-write memory S2, which branch to the appropriate
replacement program routines U'. In this case, as a rule, the
memory addresses A' provide the direct or indirect starting
addresses in the read-write memory S2, where the corresponding
replacement program routines U' are stored.
In the example shown in Figure l, the replacement program routines
U1' or U4' are associated with the system program routines U1 and
U4. According to the present invention, the replacement program
routines U1' or U4' are executed in place of the system program
routines LJ1 and U4. The corresponding memory addresses A1' or A4'
of the read-write memory S2 are associated with the codes IDl and
ID4 which the system program routines U1 or U4 flag, by means of
the first pointer table T12, and these branch to the replacement
program routines U1' or U4'
As an example, on execution of the operating system instruction
H1, the operating system H searches for the c~_~de ID1 in the first
pointer table T1, using the check function OMF. In the example
shown in Figure 1 the memory address Al', by which the operating
_g_
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.11 R-3T8 Job-131
From: Collett CaNerley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 11 of 22
system H branches to the replacement program routine U1', which is
stored in the read-write memory S2, and then executes, is
associated with this.
In one preferred embodiment of the chip card CK according to the
present invention, this incorporates second association means T2
which are stored in the non-volatile memory S1, in particular in
the form of a second pointer table. In the event that the
operating system establishes the fact that nc.~ replacement program
routine U' is associated with the current system program routine U
when it is checking by means of the first association means T1, by
way of the check routine OMF, then the the se,-.ond association
means T2 are invoked. The second association means T2 provide
the association between the corresponding codes ID and the
original system program routines U. It is an advantage that when
this is done, the memory addresses A of the non-volatile read
memory S1 which branch to the corresponding system program
routines U in the non-volatile read memory S1, are associated with
the codes ID.
It is preferred that only the codes ID, ID1, ID3...IDm of the
system program routines U, U1, U3...Um are contained in the second
association means T2, which are also meant t~> bE replaceable by
the replacement program routines U'. In particular, these are the
system program routines U, U1, U3...Um in which the original jump
-10-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.12 R-378 Job-131
From: Collect Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:08
PM Page 12 of 22
addresses of the operating system instructions H1, H3 in the
operating system H that are to be called up are replaced by the
jump addresses JMP, OMF of the check function OMF.
In the example shown in Figure 1, when executing the operating
system instruction H3, the operating system H checks by way of the
check function OMF and the flagging code ID3 whether an
appropriate replacement program routine is associated with the
system program routine U3. Since that is not the case here,
according to the present invention, the code ID3 is searched for
in the second pointer table and branches by means of the memory
address A3 that is associated there to the system program routine
U3 in the non-volatile read memory S1, and executes this.
It is advantageous that the check routine OMF be stored in the
non-volatile read memory S1 and is, in particular, a component
part of the operating system H. In particular, this also includes
the system program routines U and the second association means T2
which, it is preferred, are similarly stored in the non-volatile
read memory S1. A data processing unit P of the chip card CK
serves to operate the operating system H. In this connection, the
data processing unit P also incorporates a microprocessor.
Figure 2 shows an example of a flow chart for a preferred
embodiment of the method ar_cording to the present. invention, i.zsed
-11-
CA 02294469 1999-12-21
DEC-20-99 16:19 Wordsmith P.13 R-378 Job-131
From: Collett Calverley 613 649 2260 To: Robert J. Cleland Date: Time: 4:12:06
PM Page 13 of 22
to operate a chip card CK. The reference nurnk~ers used relate to
those used in Figure 1. According to the method according to the
present invention, before a non-changeable system program routs.ne
U is executed, the check routine OMF is called ~~p and a code ID
that flags the particular system program routine U is transferred
to this and associated with it. The call up c:f the check routine
OMF is indicated symbolically in Figure 2 by the blocks Q1, Q2,
and the arrow Q11. By using the check routine OMF and the code
ID, the operating system H ascertains whether or not a replacement
system program routine U' has been associated with the system
program routine U, which it does by searching for the code ID in
the first pointer table T1. This is indi~.~ated, for example, by
the arrow Q12 and the rhombus Q3. If the code ID is found in the
first pointer table T1, the replacement program routine that is
stored in the read-write memory S2 is executed, as indicated by
the arrow Q31 and the block Q6. If, on the ot.hPr hand, the code
ID is not found in the first pointer table T1, then it is sought
in the second pointer table T2, and the origirual system program
routine U that is stored in the non-volatile memory S1 is
executed. This is indicated symbolically in Figure 2 by the
arrows Q32 and Q41, and by the blocks Q4 and Q5.
-12-
CA 02294469 1999-12-21
