Microcircuit Card Protected Against Intrusion

The invention pertains to microcircuit cards and, more particularly, the object of the invention is microcircuit cards, protected against intrusion. Microcircuit cards are chiefly used as media for the storage of information that is often confidential, notably codes giving access to services. To ensure the requisite security of operation, it is essential for such microcircuit cards to be protected against intrusion by dishonest individuals who seek to violate the confidentiality of the information that these cards may carry. The means of observation that dishonest individuals might use are either static means wherein the card is observed without any active means of intrusion, or dynamic means wherein the card is observed by simulating the conditions of its operation.

A known way of protecting the stored items of information against intrusion by static means lies in "concealing" them to the maximum extent in the microcircuit. By contrast, there is no method, to date, of protection against an intrusion where "dynamic" observation means are used.

An object of the invention is a microcircuit card protected against intrusion by dynamic means.

According to the invention, there is proposed a microcircuit card protected against intrusion, wherein at least one strain-indicating sensor is inserted in a characteristic artificial prestressed state, this state of strain being destroyed by any attempt to take the microcircuit out of the card.

The invention will be understood more clearly and other characteristics will appear from the following description, made with reference to the appended drawing, wherein:

FIG. 1 shows a microcircuit card according to the invention, provided with three sensors;

FIGS. 2 and 3 show two examples of usable sensors;

FIG. 4 illustrates the circuit associated with the sensors for the detection of intrusion.

The invention uses the fact that, for an intrusion using dynamic means, the dishonest individual must necessarily remove the electronic component from the micromodule or from the card that supports it, in order to place it under the observation instrument. Now, usually, when the electronic component is inserted in the card or in the micromodule which is itself inserted in the card, the "active" face of the component, on the implantation or diffusion side, can still be seen. After having been fixed to the micromodule, the component is therefore covered with a protection layer aimed at protecting it against any mechanical aggression. During an attempted intrusion, this protective layer is necessarily damaged by the dishonest individual who wants to reach the microcircuit. As a consequence, the microcircuit according to the invention is such that an element to detect the damage affecting the protective layer is inserted in the card so that, upon an attempted intrusion, the card can decide not to function and/or to inform the service station with which it has to cooperate that an intrusion has been made into this card.

For this purpose, firstly a sensor enabling the detection of a mechanical strain in the microcircuit is inserted into the card and, secondly, at the same time as the microcircuit is covered with its protection layer, a stress is applied to the microcircuit and maintained for as long as the drying operation lasts: the strain resulting from the stress then persists after the drying. This prestress may preferably be obtained naturally. To this end, the protection layer is applied in the form of a hot drop that is cooled very fast. During this cooling, the hardened resin of this drop exerts the prestress. In another method, the integrated circuit is also carried to high temperature. During the cooling of the drop and of the circuit, differential expansions induce the desired prestress. From this moment onwards, the strain-indicating sensor, accessible by the internal logic of the microcircuit, is in a state that can be measured by an electrical value, indicating that the protection layer is present. If a dishonest individual tries to make a microcircuit work after having damaged the protection layer in order to remove this microcircuit from the card, the measurement given by the sensor corresponds to a lack of strain in the circuit, and this sensor informs the internal logic circuit of the circuit that there is this absence of strain. This logic circuit then prevents any normal operation.

The sensor may be of the same type as the constituent elements of strain gauges or pressure sensors using piezo-electrical effects. It is connected to an indicator, a RAM memory position or flag testable in the component, that changes its state depending on whether or not the microcircuit is subjected to a mechanical stress and depending on whether the software, or the automaton, governs the working of the microcircuit tested at each new stage of use.

The microcircuit may be associated with several elementary sensors, each associated with an indicator: in this case, the internal logic of the circuit tests all the indicators associated with the sensors. It is then possible, during the manufacture of the card, to place only some of the sensors under stress, the others being left free of any stress so as to make it more difficult to create a possible reproduction of the states of strain.

Furthermore, for certain self-adaptable microcircuits having a saved memory (EEPROM, EPROM or saved RAM) it is possible to memorize the values of all the indicators borne by the component just after manufacture, in order to keep these values as reference values used, subsequently, by the internal logic circuit. Thus it is possible to obtain and use different reference values associated with differents states of strain from one component to the other, without modifying the component manufacturing cycle.

FIG. 1 illustrates an embodiment comprising three sensors C.sub.1, C.sub.2 and C.sub.3 on a microcircuit 10, the outputs of these sensors being directly connected to the internal logic (not shown) of the microcircuit. This assembly is then covered with the protection layer.

FIG. 2 shows the equivalent diagram of a first embodiment of a resistive strain-indicating sensor Cr inserted in a measuring bridge, of the Wheatstone bridge type, in which the output voltage Vx is a function F of the deformation when the reference voltage Vo is applied between the inputs.

FIG. 3 shows the equivalent diagram of a second embodiment of a strain-indicating sensor, of the capacitive type in which: the value of the capacitance Cx varies with the stress applied and the frequency of the output signal Fx, directly linked to the capacitance Cx of the sensor, varies with the deformation.

FIG. 4 illustrates an embodiment of a logic circuit, internal to the microcircuit, associated with a set of sensors provided for on this microcircuit. Each sensor such as Cn is connected to a measuring circuit Mn that gives a measured value Vm (voltage or frequency for example) which is a function of the deformation. An associated reference register Rn has the initial value in the presence of deformation, memorized during the manufacture of the circuit. These two values are transmitted to a comparator Dn which gives their difference dn to a threshold amplifier An which also receives the maximum tolerated value En for the difference at this sensor.

When dn exceeds En, the amplifier activates a change in state of the corresponding stage of a register of indicators I tested by the internal processor P of the microcircuit during each use of the circuit.

The invention is restricted neither to the embodiment described nor to the examples of sensors shown. In particular, only one sensor may be provided for on the microcircuit or, on the contrary, there may be a greater number of sensors, and they may be arranged on the circuit in a configuration that is different from the one shown. Furthermore, to convert the deformations into electrical values, the sensors may generate variations in capacitance, frequency or resistance.