Abstract:
The invention relates to a data carrier having a semiconductor chip ( 5 ) with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (h R1R , h R1R2 ) generates either the output data (y) of the undisguised operation (h) or disguised output data (y{circle around (x)}R 2 ) from which the output data (y) can be determined.

Description:
BACKGROUND OF THE INVENTION 
   1. Field of the Invention 
   This invention relates to a data carrier having a semiconductor chip in which secret data are stored. The invention relates in particular to a smart card. 
   2. Description of Related Art 
   Data carriers containing chips are used in a great number of different applications, for example for performing monetary transactions, paying for goods or services, or as an identification means for access or admission controls. In all said applications the data carrier chip normally processes secret data which must be protected from access by unauthorized third parties. Said protection is ensured by, among other things, giving the inner structures of the chip very small dimensions so that it is very difficult to access said structures with the aim of spying out data processed in said structures. In order to impede access further, one can embed the chip in a very firmly adhering compound whose forcible removal destroys the semiconductor plate or at least the secret data stored therein. It is also possible to provide the semiconductor plate during its production with a protective layer which cannot be removed without destroying the semiconductor plate. 
   With corresponding technical equipment, which is extremely expensive but nevertheless fundamentally available, an attacker could possibly succeed in exposing and examining the inner structure of the chip. Exposure could be effected for example by special etching methods or a suitable grinding process. The thus exposed structures of the chip, such as conductive paths, could be contacted with microprobes or examined by other methods to determine the signal patterns in said structures. Subsequently, one could attempt to determine from the detected signals secret data of the data carrier, such as secret keys, in order to use them for purposes of manipulation. One could likewise attempt to selectively influence the signal patterns in the exposed structures via the microprobes. 
   SUMMARY OF THE INVENTION 
   The invention is based on the problem of protecting secret data present in the chip of a data carrier from unauthorized access. 
   The inventive solution does not aim, like the prior art, at preventing exposure of the internal structures of the chip and the mounting of microprobes. Instead measures are taken to make it difficult for a potential attacker to infer secret information from any signal patterns intercepted. Said measures consist according to the invention in manipulating security-relevant operations so that the secret data used in performing said security-relevant operations cannot be determined without including further secret information. For this purpose the security-relevant operations are disguised or falsified with the aid of suitable functions before execution. In order to impede or even prevent in particular a statistical evaluation in case of multiple execution of the security-relevant operations, a random component enters into the disguising function. As a result, an attacker cannot determine the secret data from any data streams intercepted. 
   The security-relevant operation will be represented in the following by function h mapping input data x on output data y, i.e. y=h(x). To prevent secret input data x from being spied out the invention provides, in one example, for a disguised function h R1  to be determined, so that the following holds:
 
 h ( x )= h   R1 ( x{circle around (x)}R   1 )
 
as shown in  FIGS. 3   a - 3   c , or in a variation of the basic disguising operation, for disguised function h R1R2  to be determined, so that the following holds:
 
 y{circle around (x)}R   2   =h   R1R2 ( x{circle around (x)}R   1 ),
 
as shown in  FIG. 3   d.  
 
   The security-relevant operation is now performed by means of disguised function h R1R2  whose input data are not authentic secret data x but disguised secret data x{circle around (x)}R 1  generated by combining authentic secret data x with random number R 1 . Without knowledge of random number R 1  one cannot determine authentic secret data x from disguised secret data x{circle around (x)}R 1 . As a result of applying disguised function h R1R2  to disguised secret data x{circle around (x)}R 1  one obtains disguised output data y{circle around (x)}R 2 . From disguised output data y{circle around (x)}R 2  one can determine output data y by suitable combination. Before each new execution of the security-relevant function one can preset new random numbers R 1  and R 2  from which new disguised function h R1R2  is determined in each case. Alternatively, a plurality of disguised functions h R1R2  can be permanently stored, one of which is selected randomly before execution of the security-relevant operation. It is especially advantageous to use two functions h R1R2  and h R1′R2′ , random numbers R 1 ′ and R 2 ′ being the inverse values of random numbers R 1  and R 2  with respect to the type of combination selected for disguising. In a further variant, random numbers R 1  and R 2  can also be identical. In particular, random numbers R 1  and R 2  can be selected statistically independently so that there is no correlation between input and output data which can be used for an attack. 
   If further operations are executed before or after security-relevant operation h in question here, random numbers R 1  and R 2  can also be used for disguising the data processed with the further operations. 
   The inventive solution can be used especially advantageously for security-relevant operations containing nonlinear functions. With nonlinear functions one cannot apply known protective measures based on disguising the secret data before execution of the functions. Known protective measures presuppose that the functions are linear with respect to the disguising operations so that disguising can be undone after execution of the functions. In the inventive solution, however, not only the secret data are falsified or disguised but also the security-relevant operations processing the secret data. The disguising of the secret data and the security-relevant operations is coordinated such that the authentic secret data can be derived from the disguised secret data after execution of the security-relevant operations. Coordination between disguising of the secret data and the security-relevant operations can be realized especially simply if the security-relevant operations are realized in the form of tables, so-called lookup tables. In the stated tables each input value x has output value y associated therewith. The functions realized by the tables are executed by looking up output values y belonging to particular input values x. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The invention will be explained below with reference to the embodiments shown in the figures, in which: 
       FIG. 1  shows a smart card in a top view, 
       FIG. 2  shows a greatly enlarged detail of the chip of the smart card shown in  FIG. 1  in a top view, 
       FIGS. 3   a ,  3   b ,  3   c  and  3   d  show representations of lookup tables. 
   

   DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     FIG. 1  shows smart card  1  as an example of the data carrier. Smart card  1  is composed of card body  2  and chip module  3  set in a specially provided gap in card body  2 . Essential components of chip module  3  are contact surfaces  4  for producing an electric connection with an external device, and chip  5  electrically connected with contact surfaces  4 . As an alternative or in addition to contact surfaces  4 , a coil not shown in  FIG. 1  or other transfer means can be present for producing a communication link between chip  5  and an external device. 
     FIG. 2  shows a greatly enlarged detail of chip  5  from  FIG. 1  in a top view. The special feature of  FIG. 2  is that it shows the active surface of chip  5 , i.e. it does not show all layers generally protecting the active layer of chip  5 . In order to obtain information about the signal patterns in the interior of the chip one can for example contact exposed structures  6  with microprobes. Microprobes are very thin needles which are brought in electric contact with exposed structures  6 , for example conductive paths, by means of a precision positioning device. The signal patterns picked up by the microprobes are processed with suitable measuring and evaluation devices with the aim of inferring secret data of the chip. 
   The invention makes it very difficult or even impossible for an attacker to gain access to in particular secret data of the chip even if he has managed to remove the protective layer of chip  5  without destroying the circuit and to contact exposed structures  6  of chip  5  with microprobes or intercept them in some other way. The invention is of course also effective if an attacker gains access to the signal patterns of chip  5  in another way. 
     FIGS. 3   a ,  3   b ,  3   c  and  3   d  show simple examples of lookup tables in which the input and output data each have a length of 2 bits. All table values are represented as binary data. The first line states input data x, and the second line output data y associated therewith in the particular column. 
     FIG. 3   a  shows a lookup table for undisguised function h.  FIG. 3   a  indicates that input value x=00 has output value h (x)=01 associated therewith input value 01 output value 11, input value 10 output value 10, and input value 11 output value 00. The lookup table according to  FIG. 3   a  represents nonlinear function h which is to be executed within the framework of a security-relevant operation. According to the invention, however, one does not use the lookup table shown in  FIG. 3   a  itself in executing the security-relevant operation, but derives a disguised lookup table from said lookup table according to  FIGS. 3   b ,  3   c  and  3   d.    
     FIG. 3   b  shows an intermediate step in determining the disguised lookup table of  FIG. 3   c . The lookup table according to  FIG. 3   b  was generated from the lookup table according to  FIG. 3   a  by XORing each value of the first line of the table from  FIG. 3   a  with random number R 1 =11. Thus, XORing the value 00 of the first line and first column of the table from  FIG. 3   a  with the number 11 yields the value 11, which is now the element of the first line and first column of the table of  FIG. 3   b . The remaining values of the first line of the table shown in  FIG. 3   b  are determined accordingly from the values of the first line of the table shown in  FIG. 3   b  are determined accordingly from the values of the first line of the bale shown in  FIG. 3   a  and random number R 1 =11. Basically the XOR function changes 00, 01, 10, and 11 of  FIG. 3A  to 11, 10, 01, 00. Since h(x) as shown in  FIG. 3A  maps 00 to 01, 01 to 11, 10 to 10 and 11 to 00, the result of disguising the input data would be to map 11 to 00, 10 to 10, 01 to 11, and 00 to 01. However, as shown in  FIG. 3B , as a result of the disguised input data x, the operation is also disguised to become the disguised operation h R1 (x), so that 11 now maps to 01, 10 to 11, 01 to 10 and 00 to 00. The result is that the second line of  FIG. 3B  is exactly the same as the second line of  FIG. 3A , but that the input data is disguised and the operation in the form of a mapping, is also disguised. Thus, table shown in  FIG. 3   b  could already be used as a disguised lookup table for processing secret data likewise disguised with random number R 1 =11. The result would be the plaintext values to be read in line 2 of this table from  FIG. 3   b.    
   One usually arranges the individual columns of a lookup table according to ascending input data x. A table determined by accordingly sorting the table in  FIG. 3   b  is shown in  FIG. 3   c.    
   If the table according to  FIG. 3   c , which preserves the mapping or disguised input data and disguised operation of  FIG. 3   b , is to be disguised further or yield as output values likewise disguised values rather than plaintext values, one applies a further XOR operation with further random number R 2 . 
     FIG. 3   d  shows the result of applying said further XOR operation. In said operation the elements of the second line of the table according to  FIG. 3   c  are each XORed with random number R 2 =10. The element in the second line and the first column of the table according to  FIG. 3   d  thus results from XORing the element in the second line and first column of the table according to  FIG. 3   c  with random number R 2 =10. The further elements of the second line of the table according to  FIG. 3   d  are formed accordingly. The first line of the table according to  FIG. 3   d  is adopted by  FIG. 3   c  unchanged. 
   With the table shown in  FIG. 3   d  one can determine likewise disguised output data from disguised input data. The thus determined disguised output data can be supplied to further operations for processing disguised data or one can determine plaintext data therefrom by XORing with random number R 2 =10. 
   Use of the table shown in  FIG. 3   d  makes it possible to perform nonlinear operations with disguised secret data and protect said secret data from unauthorized access. The security-relevant operations themselves are still also protected from un-authorized access since differently disguised functions can be used at every execution of the operations and the security-relevant operations themselves cannot be inferred even if the disguised functions could be determined. After conversion to plaintext, however, both the original security-relevant operations and the operations performed with the aid of disguised functions yield identical results. For example, input value 00 yields output value 01 according to the table in  FIG. 3   a . In order to check whether the disguised table shown in  FIG. 3   d  yields the same output value one must first XOR input value 00 with random number R 1 =11. As a result of said combination one obtains the value 11. In order to determine the plaintext from said output value one must XOR the output value with random number R 2 =10. As a result of said combination one obtains the value 01 which exactly matches the value determined with the aid of the table shown in  FIG. 3   a.    
   Disguising the security-relevant operations of the input values can be effected not only by XORing but also by other suitable types of combination, for example modular addition. Furthermore, the invention is not limited to the application of nonlinear functions represented by means of lookup tables. One can also use any nonlinear and even linear functions for which a suitable disguised function can be determined.