IC Card Having Internal Error Checking Capability

This invention relates to an IC card of the type having an onboard microprocessor and memory, and more particularly to a multi-function IC card.

In such IC cards, the onboard microprocessor is adapted to control access by an external terminal to the onboard memory. Most typically, access is by way of the microprocessor reading specific areas of memory and outputting desired information on its I/O lines for coupling to the terminal. However, more direct transfers of information between the memory and an external device under the control of the microprocessor are also possible.

IC cards are being developed to perform ever more complex transactions, or groups of transactions, and in so doing are utilizing more and more of the processing power and storage capacity made available by modern microelectronics. Although the capabilities of the IC card are thus increasing, with the possibility of performing multiple types of diverse transactions in connection with the same or multiple types of diverse terminals, the demands on the capabilities of the IC card are becoming more stringent. In general, in a multiple application IC card, the card is designed to partition the onboard memory space into separate application blocks and to allow a particular application (i.e., a type of transaction to be performed with a particular type of terminal) access to only the application block or blocks of memory assigned to that type of transaction. Since the types of transactions are different in scope, complexity and amount of memory required, it is desirable to allow the onboard microprocessor to partition the memory into blocks of varying size.

In an IC card system, sequences of operation are usually performed between the IC card unit and the person who possesses the IC card, as well as between the card unit and a terminal which directly operates the IC card. If the IC card is inserted into the terminal by the operator, the terminal applies a power source clock or the like so as to actuate the IC card, thereby enabling discrimination, collation, identification of the possessor of the IC card and so forth between the IC card and the terminal. This preliminary sequence can often involve assuring that the card is compatible with the terminal, checking the identification of the user to ascertain whether he has proper possession of the card, determining that the application to be accessed is available through the terminal and accessible to the card, accessing a file in the terminal data base which is assigned to the particular user, etc.

After these preliminary operations have been completed, the terminal identifies a specific block in the memory of the IC card and gains access to this block in order to perform the desired application. While various methods are available for accessing the block and performing the application, the process involves, in any event, reading the accessed block of the memory.

In general, in the case of the conventional multi-application IC card, the overall data recording error management (data error checking) is performed by the terminal alone. That is, the IC card has, in application blocks of its memory, items of directory information for access to items of data recorded in the the memory, and error check codes appended to the recorded application data for data recording error management. While the IC card can read or write recording data by using the directory, it cannot recognize or interpret an error check code recorded as the tail end of items of data recorded in each block. To effect recording data error management, the terminal must use its processing power to provide a means for searching for an error check code which is contained in the recorded data items in the accessed application block, a means for performing error checking on the basis of the contents of the recorded data and the error check code which it had located, and a means for producing an error check code from data items to be recorded. Thus, in the case of the conventional IC card, it is the terminal which incorporates these means and performs recording data error management according to its particular error checking algorithm or procedure for accessing the card. In this case, to partially change a data block, it is necessary for the terminal to read out the whole of the corresponding data block recorded in the IC card (recording data and error check code) in order to produce an error check code for this data block, since an error check code is recorded in each individual data block in the IC card which is recorded by the terminal. If the terminal in question belongs to a group which provides a plurality of application systems, it must be provided with sets of means of the above-mentioned types adapted for different types of error check codes or error code setting methods specific to those application systems. Therefore, if the terminal performs the recording data error management, the load on the terminal increases substantially.

In addition, there is the possibility of recorded data and a corresponding error check code in the conventional IC card being intentionally changed since, as described above, both the recorded data and the error check code are read out by the terminal in order to process the recorded data. This change cannot be detected by performance of a subsequent error check code operation. There is therefore a problem in terms of data security.

An example of a conventional IC card having a self-checking or on the card function for data errors is also known. While this IC card can compute an error check code on board the card, it is necessary to attach an error check code to each individual data item. As a result, the proportion of memory areas occupied by error check codes is significantly increased, and this is disadvantageous in terms of efficiency of the use of the IC card memory.

In view of the foregoing, it is a general aim of the present invention to provide an IC card which is adaptable to plural diverse applications, but which performs data error management without significant added burden to the terminal equipment.

In that regard, it is an object of the present invention to perform error checking on the IC card itself, utilizing the onboard processor, while still allowing great flexibility in partitioning the memory into various sized blocks.

It is a more detailed object of the present invention to provide an IC card in which security of the stored data is enhanced while still allowing full terminal access to the actual application data.

To this end, there is provided an IC card adapted to interface with a terminal for performing a plurality of applications. The IC card has an onboard memory divided into a plurality of application blocks of variable (or different) size for storage of application data and a further block which is a protected block, i.e., cannot be accessed by the terminal. The protected block has a location related to each of the application blocks, and each location is adapted to store identification data and an error check code for the associated application block. The onboard microprocessor controls access to the memory in such a way as to prevent access to the protected block by the terminal, and to selectively allow access to the application blocks by the terminal. Prior to allowing terminal access to an application block, error checking of the stored data for the selected application is performed. When new data is written to the IC card memory in the application block, the computed error check code for the new data is stored in the protected block in the location associated with the selected application block.

In accordance with detailed aspects of the present invention, the IC card incorporates means for performing error checking of recording data, including a means for producing an error check code, and a means for performing error checking by using the error check code and the data. If the IC card is designed to also perform data correction, it further incorporates a data correction means. When data is recorded in a predetermined application block of the memory in the IC card, the error check code producing means simultaneously produces from this recording data an error check code related thereto, and this error check code is recorded in a protected block corresponding to the application block in which the data is recorded. Error checking of the recording data is performed by the error checking means on the basis of the data recorded in the application block and the error check code corresponding to this block. To also effect data correction, the correction means decodes the contents of the result of the checking performed by the error checking means, and corrects errors in the data. If the data is rewritten, a new error check code for the rewritten data in the application block is produced and is recorded in the corresponding protected block. In practice, a program for conducting the processing is stored in a ROM provided in the IC card and is executed by the microprocessor.

Other objects and advantages will become apparent from the following detailed description when taken in conjunction with the drawings, in which :

FIG. 1 is a block diagram showing an IC card constructed in accordance with the present invention interfaced with an external unit or terminal; and

FIG. 2 is a block diagram showing an operational sequence of use of an IC card according to the present invention.

While the invention will be described in connection with a preferred embodiment, there is no intent to limit it to that embodiment. On the contrary, the intent is to cover all alternatives, modifications and equivalents included within the spirit and scope of the invention as defined by the appended claims.

Turning now to the drawings, FIG. 1 shows an IC card 1, exemplifying the present invention, connected by a data path 10 to a terminal 5. The terminal 5 typically incorporates a reader/writer, has its own internal processor and also frequently has a communications link to a central computer or data base.

The IC card 1 has an onboard microprocessor 2 and memory means shown in the drawings as separate data memory 3 and program memory or ROM 4. The data memory 3 can be a RAM, an EPROM or an EEPROM, while the program memory can be a ROM or an EPROM or EEPROM. Conveniently, the memories 3, 4 are combined in the same memory device, and most conveniently are both incorporated on the same chip as the microprocessor such that the IC card 1 requires only a single semiconductor to be embedded therein and requires no connections between semiconductors.

Before further describing the internal structure of the IC card and the means for partitioning the memory, it will first be noted that the data path 10 provides a connection for transfer of data between the terminal 5 and the IC card 1. An example of such a connection is the non-contact IC card and terminal available today in which coupling coils on the IC card and terminal are brought into juxtaposition when the card is inserted in the terminal, such that data bits can be transferred from the card to the terminal or from the terminal to the card by magnetic coupling between the juxtaposed coils.

The terminal will not be described in detail since it is conventional and well known, but typically includes its own processor for performing local operations and a communications link to a central data base which maintains a central file for applications to be performed by all of the users which have access to the system.

Turning again to the IC card 1, the ROM 4 contains a stored program which controls the microprocessor 2 to cause the IC card 1 to perform the logical functions assigned to it. Typically, the ROM 4 is a comparatively limited section of memory which requires tight and simple programming in order to maximize the effectiveness of the IC card 1.

The data memory 3 is typically much larger than the ROM 4, but must also be efficiently utilized in order to gain maximum efficiency from the IC card 1. The largest part of the data memory 3 is devoted to an application area 32 which is divided into a series of application blocks 32-1, 32-2, . . . 32-n for storing data groups relating to the respective applications. The data memory 3 is also partitioned to provide a smaller protected block 31 which contains directory information for each of the application blocks as well as error correction code information for each of the application blocks. The area 31 is protected in the sense that the microprocessor 2 is programmed to prevent access to the protected area 31 by the terminal 5. The microprocessor 2, however, has access to the data within the protected area 31, but uses that information only internally of the IC card. The area 31 is protected by programming the ROM 4 in such a way that prevents the microprocessor 2 from addressing the locations within block 31 in connection with the program steps which allow transfer of data between the terminal 5 and data memory 3.

FIG. 1 illustrates that the application area 32 is divided into a plurality of application blocks 32-1, 32-2, . . . 32-n which are usually of different sizes. In certain circumstances, the blocks can be pre-partitioned before the IC card is put in service, or alternatively the microprocessor 2 in conjunction with its internal program and information received from the terminal 5 can partition the blocks during the course of performing its applications.

Within the protected area 31, and corresponding to each of the application blocks, is an application block information location, such as memory locations 31-1, 31-2, . . . 31-n. In the case of the protected area 31, each of the locations can be of the same size, and there is one location for each of the application blocks. As shown in FIG. 1, each of the application block identifier blocks or words contains information specific to the associated application block; the stored information includes directory data and an error check code for each associated application block. As one example, the directory information may contain a group of bits specifying an ID number of the particular application, a further group of bits specifying the starting address of the application file assigned to that application, and a further group of bits specifying the size of that application file. Thus, when the IC card 1 is inserted in a terminal 5 and the terminal requests access to a particular application, the microprocessor 2 can search the protected area 31 for the identification number of the requested application and then immediately has access to the starting location and size of the file within the application field 32 assigned to that particular application.

In addition, and in accordance with the invention, the processor also has access to an error check code stored in a protected area relating to the particular data which is then stored in the associated application file.

In accordance with the present invention, in the ROM 4 is also stored a program for producing an error check code, and a program for performing error checking. The microprocessor 2 conducts error check code information and data error checking. If data is recorded in an application block (e.g., application block 32-1) in the application area 32, an error check code related to this data is produced by the microprocessor 2, and this error check code is recorded in the memory location 31-1 in the protected area 31 corresponding to the application block 32-1. At the time of error checking, the microprocessor 2 checks the data recorded in the application block on the basis of the corresponding error check code. In other words, the error check code can be accessed on the basis of the directory information at the same time the application data is accessed based on the same directory information, so that both are available to allow the onboard microprocessor to perform an error check on the stored information.

In summary, in accordance with the present invention, the microprocessor reads out the error check code under the control of the program stored in the ROM. The microprocessor also reads out under control of the ROM the application data stored in the corresponding application block by using the corresponding directory data. Therefore, the error check code and the application data are simultaneously available and can be related to each other in the onboard microprocessor for any authorized application, and thus the error checking can be performed in the microprocessor for any application for which the IC card has been authorized.

Various methods are applicable to the error checking. An example of a well-known method relating to cyclic redundancy check is described in "Data Communication Handbook", issued by Denshi Tsushin Gakkai (Oct. 1984), pp. 49-53. In this method, a determinant is formed from items of serial data on the basis of an application of a principle which resides in that a unit matrix is obtained by multiplying a determinant by an inverse matrix thereof. If the result of this operation (usually called a syndrome) is zero, there is no data error. If it is not zero, the existence of data errors can be detected. To also effect data correction, it is necessary to previously store a data correction program in the ROM 4. In that case, the state of data error can be analyzed from the syndrome. Errors in the data are corrected by decoding the contents of the syndrome. When the data is rewritten, a new error check code for the data in the application block is produced and is recorded in the predetermined location in the corresponding protected area (that is, the error check code is rewritten).

The feature of processing the error check code, as described above, is important because it allows the checking of the application data to be carried out on the IC card rather than in the terminal. In the conventional IC card, the contents of the error check code cannot be recognized or interpreted by the microprocessor, so that the conventional IC card simply reads out and transfers the stored data to the terminal or writes and transfers the data from the terminal. Therefore, the stored error check code cannot be used in error checking. In the present invention, since the error check code is located with the directory, and the memory has a sufficient capacity, the error check code can be utilized in the IC card in error checking.

The operation of the IC card 1 in accordance with the present invention will be described below with reference to the flow chart shown in FIG. 2. It will be appreciated by those skilled in this art that when the ROM 4 is properly programmed, it renders the microprocessor and its associated memory structure as means for performing the steps described in connection with FIG. 2. It will also be appreciated that the procedure illustrated in FIG. 2 represents only a portion of an IC card transaction and does not, for example, illustrate the conventional steps of inserting the IC card in the terminal and performance of the necessary preliminary identification checks. As shown in FIG. 2, after the preliminary authentication is performed, a step 20 assigns an application file within the application blocks 32 for access by the terminal. Thus, the step 20 can be considered an open command which allows access to the application file. The type of application to be accessed is identified and, during the course of performance of the step 20, the directory information in the area 31 is searched to find the location having an application identification number which matches that to be assigned. Thus, the microprocessor 2 has at that time access to the address of the application block and the size of the block.

In practicing the invention, in the step 21, the microprocessor also has access to and reads the error check code which had previously been written into the location associated with that file based on the data then stored in the file. A step 22 is then performed on the data group resident in the application file block, by detecting an error on the data in the file. It is emphasized that the size of the application file can be different than that of the other files, but it is still operated on by the same processor and with the same error detecting program. If an error is detected in step 23, the program branches to a step 28 for error processing or error correction. In its simplest form, the error processing can take the form of simply aborting the transaction and returning the card to the user, and later the card is withdrawn by an issuer.

If no error is detected, the microprocessor 2 then makes the file available to the terminal for reading and writing information. The terminal may read certain information from the accessed file to determine starting parameters for the transaction to be performed, and on completing the transaction may write updated information into the same or different fields of the accessed file. Following the interaction between the terminal and the accessed block of memory, as controlled by the microprocessor 2, a step 25 is performed to determine if new data has been written into the onboard memory. If no data has been written, a step 26, which is, in effect, a close command, signifies that the file access is complete, and if the transaction is then complete, the card is returned to the user. However, if data has been written, a step 27 is performed, solely within the IC card, by which the microprocessor 2 performs a computation on the whole of data field within the selected application block. That error check code, by performance of the step 27, is then written into the protected area 31 of memory in the location reserved for the error check code for the application block in question. Thus, the new code is available the next time the application field is selected to assure continued integrity of the data. After the error check code is computed and recorded by way of step 27, the close command step 26 again signals that the file access is complete and control is returned either to the application program for accessing different files or the card returned to the user.

In the above-described embodiment, the error check code reading and the data error checking are performed at the start of the file access process while the error check code formation and recording are performed at the end of the file access process. However, the former may be performed when a read command is supplied from the terminal, while the latter is performed when a write command is supplied from the terminal. In this case, the flow chart is formed by deleting steps 20 and 26 from the chart shown in FIG. 2.

If the data correction is also performed after the recording data error checking has been performed, the syndrome which is the result of the above-mentioned checking may be decoded, thereby enabling errors in the data to be corrected. In that case, the process returns, after the error processing of step 28, to step 24.

It is worthy of note that by performing the error check code on the IC card two significant benefits result. First of all, the terminal need not be burdened with the performance of error checking, which would require reading out all of the data within the accessed application block before an error check computation could be performed. Instead, the error checking function is performed solely within the IC card without burdening the terminal. It is also significant to note that the error check code is performed without providing external access to the error check code itself and thus inhibiting the opportunity of unauthorized persons from tampering with the error check code and thereby tampering with the data. Not only is the error check performed on the IC card itself, and not only is it performed in such a way that the error check code is inaccessible to external devices, but it is furthermore performed in a multi-purpose IC card which is capable of accessing diverse applications and in which the applications can demand application blocks of memory which are of varying size, each with its own, protected error check code.