Abstract:
There is provided an integrated circuit card for loading an application copy thereon and a method of loading an application copy onto the integrated circuit card, wherein the application copy is one of a plurality of copies of an application. The application copy has an associated application identifier that uniquely identifies the application from other applications and an application copy number that is unique for each copy of the application. The integrated circuit card includes a microprocessor and a memory coupled to the microprocessor. The memory includes an application history list area for storing application identifiers and application copy numbers of applications that have been previously loaded onto the integrated circuit card. The method includes receiving by the integrated circuit card the application copy, the application identifier, and the application copy number; determining by the integrated circuit card whether the application identifier and the application copy number are contained in the application history list area; and failing to load the application copy by the integrated circuit card if the application identifier and the application copy number are contained in the application history list area.

Description:
CROSS-REFERENCE TO PRIORITY APPLICATIONS 
     This application claims the priority of United States Provisional Application No. 60/046,514, filed on May 15, 1997, entitled “Design for a Multi Application Smart Card,” and United States Provisional Application No. 60/046,543, filed on May 15, 1997, entitled “Virtual Machine for a Multi Application Smart Card,” which are incorporated by reference herein in their entireties. 
    
    
     BACKGROUND OF INVENTION 
     Integrated circuit (IC) cards are becoming increasingly used for many different purposes in the world today, principally because they are ideal tools for the delivery of distributed, secure information processing at a low cost. An IC card, also called a “smart card,” is a card typically the size of a conventional credit card, but which contains a computer chip on the card. The computer chip on the IC card typically includes a microprocessor, read-only-memory (ROM), electrically erasable programmable read-only-memory (EEPROM), a random access memory (RAM), an input/output (I/O) mechanism, and other circuitry to support the microprocessor in its operations. The computer chip can execute one or more applications stored on the card. Examples of applications that IC cards are being used to store and execute include credit/debit, electronic money/purse, telephone calling card, and loyalty reward applications. 
     When an application is initially loaded onto an IC card, the application may include data that is associated with the application. Such data may include, for example, data that identifies the cardholder, such as the cardholder&#39;s name and account number. Additionally, the associated data may also include a promotional or bonus value provided by the application provider to the cardholder for loading the application. For example, with a telephone calling card application, an application provider may provide a certain amount of free calling time. As another example, with an electronic purse application, an application provider may provide bonus electronic cash. As yet another example, with a frequent flyer loyalty application, an application provider may provide free miles. 
     The use of application data to provide promotional or bonus value creates a potential problem for the IC card manufacturer and the application provider regarding the integrity of loading applications. A solution is needed to prevent a cardholder from intentionally or unintentionally copying an application when it is first loaded, and reloading the application thereafter to reload the value in the data associated with the application. By repeated reloading of an application, a cardholder may potentially obtain an unlimited amount of promotional or bonus value to which he or she is not entitled. At the same time, however, cardholders may be required to reload an application for legitimate reasons, such as for updating an application. 
     Accordingly, a need exists for a method of loading an application onto an IC card such that a cardholder is prevented from illegitimately reloading an application once it has been loaded onto the IC card. 
     SUMMARY OF THE INVENTION 
     In accordance with a preferred embodiment of the present invention, there is provided a method of loading an application copy onto an integrated circuit card, wherein the application copy is one of a plurality of copies of an application. The application copy has an associated application identifier that uniquely identifies the application from other applications and an application copy number that is unique for each copy of the application. The integrated circuit card includes a microprocessor and a memory coupled to the microprocessor. The memory includes an application history list area for storing application identifiers and application copy numbers of applications that have been previously loaded onto the integrated circuit card. The method includes receiving by the integrated circuit card the application copy, the application identifier, and the application copy number; determining by the integrated circuit card whether the application identifier and the application copy number are contained in the application history list area; and failing to load the application copy by the integrated circuit card if the application identifier and the application copy number are contained in the application history list area. 
     As it is used in this specification and the amended claims, the term “unique” to refer to application copy numbers refers to two types of numbers: (1) non-random numbers that are actually determined to be unique, and (2) random numbers that are determined to be probabilistically unique for a given cardholder. 
     The method of the present invention may further include the steps of allocating a predetermined portion of the memory for the application history list area; determining by the integrated circuit card whether the application history list area is fall; and failing to load the application copy if the application history list is full. 
     The method of the present invention may further include the step of adding the application identifier and the application copy number to the application history list area if the application identifier and the application copy number are not contained in the application history list area. Thus, once a copy of an application is loaded onto the integrated circuit card, the application identifier and the application copy number associated with the copy of the application are stored in the application history list area for future checking. 
     The method of the present invention may also provide a mechanism by which application providers not concerned with repeated loading of applications may circumvent storage of the application identifier and the application copy number in the application history list area. For example, an application copy number of zero can be used to signify that an application may be reloaded as often as desired. Accordingly, the method of the present invention may further include the step of adding the application identifier and the application copy number to the application history list area if the application identifier and the application copy number are not contained in the application history list area and the application copy number is not zero. 
     The application copy may include both application code and application data. The application identifier and the application copy number may be contained in the application data. 
     Preferably, the application copy, the application identifier, and the application copy number are transmitted to the integrated circuit card by an application provider. Preferably, before transmitting the application copy to the integrated circuit card, the application provider encrypts at least a portion of the application copy. It is also preferred that an application provider transmit a key transformation unit, which includes information relating to the encryption of the encrypted portion of the application copy. It is further preferred that the integrated circuit card has a first public key pair and that the application provider encrypts the key transformation unit with the public key of the first public key pair before transmitting the key transformation unit to the integrated circuit card. 
     When the application provider encrypts the key transformation unit with the public key of the first public key pair, the integrated circuit card may decrypt the encrypted key transformation unit with the secret key of the first public key pair. Once the key transformation unit is decrypted, the integrated circuit card may decrypt the application copy using the information contained in the decrypted key transformation unit. 
     It is also preferred that the application provider has a second public key pair and that the application provider form a signed application copy by encrypting the application copy with the secret key of the second public key pair. The application provider may then transmit both the application copy and the signed application copy to the integrated circuit card. 
     It is further preferred that the application provider register the public key of the second public key pair with a certification authority, which has a third public key pair. The certification authority may then provide a certificate to the application provider by encrypting the public key of the second public key pair with the secret key of the third public key pair. The application provider may transmit the certificate to the integrated circuit card. 
     When a certificate is transmitted to the integrated circuit card, the integrated circuit card may obtain the public key of the second key pair by decrypting the certificate using the public key of the third public key pair. The integrated circuit card may then verify the signed application copy using the public key of the second public key pair. The integrated circuit card may fail to load the application copy if the signed application copy is not verified. 
     In accordance with another preferred embodiment of the present invention, there is provided an integrated circuit card that includes a microprocessor and a memory coupled to the microprocessor. The memory includes an application history list area for storing application identifiers and application copy numbers, each application identifier and each application copy number being associated with an application copy. The application copy is one of a plurality of copies of an application. Each application identifier uniquely identifies an application from other applications, and each application copy number uniquely identifies an application copy from other application copies. The integrated circuit card of the invention further includes means for determining whether an application identifier and an application copy number associated with an application copy to be loaded into the memory area are contained in the application history list area and means for failing to load the application copy to be loaded if the associated application identifier and the associated application copy number are contained in the application history list area. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a schematic representation of an IC card in accordance with a preferred embodiment of the present invention; 
     FIG. 2 is a perspective view of an IC card and terminal in accordance with a preferred embodiment of the present invention; 
     FIG. 3 is a functional block diagram of an IC card in accordance with a preferred embodiment of the present invention; 
     FIG. 4 is a diagram of a system for remotely loading an application from an application provider onto an IC card in accordance with a preferred embodiment of the present invention; 
     FIG. 5 is a schematic representation of an application load unit in accordance with a preferred embodiment of the present invention; 
     FIG. 6 is a flowchart of exemplary steps for processing the application load unit of FIG. 5 in accordance with a preferred embodiment of the present invention; and 
     FIG. 7 is a flowchart illustrating exemplary steps of a file loading routine, which may be implemented by the operating system of an IC card in accordance with a preferred embodiment of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     FIG. 1 provides a schematic representation of a typical IC card  10  that can be used with the presently claimed invention. The IC card  10  includes an integrated circuit  12  having one or more electrical contacts  14  connected to the integrated circuit  12 . 
     FIG. 2 shows an example of a device with which the IC card  10  communicates. As used in this specification and the appended claims, the terms “interface device” and “terminal” shall be used to generically describe devices with which an IC card may communicate. A typical terminal  20 , as shown in FIG. 2, includes a card reader  22 , a keypad  24 , and a display  26 . The keypad  24  and the display  26  allow a user of the IC card  10  to interact with the terminal. The keypad  24  allows the user to select a transaction, to enter a personal identification number (“PIN”), and to enter transactional information. The display  26  allows the user to receive informational messages and prompts for data entry. Other types of terminals may include IC card-compatible ATM machines and telephones. 
     FIG. 3 provides a functional block diagram of the integrated circuit  12 . At a minimum, the integrated circuit  12  includes a processing unit  100  and a memory unit  110 . Preferably, the integrated circuit  12  also includes control logic  150 , a timer  160 , security circuitry  170 , input/output ports  180 , and a co-processor  190 . The control logic  150  provides, in conjunction with the processing unit  100 , the control necessary to handle communications between the memory unit  110  and input/output ports  180 . The timer  160  provides a timing reference signal for the processing unit  100  and the control logic  150 . The security circuitry  170  preferably provides fusible links that connect the input/output ports  180  to internal circuitry for testing during manufacturing. The fusible links are burned after completion of testing to limit later access to sensitive circuit areas. The co-processor  190  provides the ability to perform complex computations in real time, such as those required by cryptographic algorithms. 
     The memory unit  110  may include different types of memory, such as volatile and non-volatile memory and read-only and programmable memory. For example, as shown in FIG. 3, the memory unit  110  may include read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and random-access memory (RAM). 
     The memory unit  110  stores IC card data such as secret cryptographic keys and a user PIN. The secret cryptographic keys may be any type of well-known cryptographic keys, such as the private keys of public-key pairs. Preferably, the secret cryptographic keys are stored in a secure area of ROM or EEPROM that is either not accessible or has very limited accessibility from outside the IC card. 
     The memory unit  110  also stores the operating system of the IC card. The operating system loads and executes IC card applications and provides file management and other basic card services to the IC card applications. Preferably, the operating system is stored in ROM. 
     In addition to the basic services provided by the operating system, the memory unit  110  may also include one or more IC card applications. For example, if the IC card is to be used as an electronic cash card, an application called MONDEX™ PURSE (from Mondex International Limited) might be included on the IC card, which loads an electronic value of a certain currency from a user&#39;s account in a financial institution onto the IC card. Preferably, the operating system of the IC card  10  should support multiple applications, such as the MULTOS™ operating system from Mondex International Limited. 
     An IC card application may include both program and associated data files, which are typically stored in EEPROM. The application program may be written either in the native programming code of the processing unit  100  or it may be written in a higher level language that must be translated before it is executed on the processing unit  100 . An example of such a higher level language for use on IC cards is the MULTOS™ Executable Language (MEL). Advantageously, by using a higher level language such as MEL, an application program is capable of running on multiple hardware platforms without any need for re-writing. 
     Because IC cards typically have limited memory capacity due to the size and cost restraints of placing memory on the IC cards, an IC card may also have primitives stored in ROM, which are subroutines that perform frequently used functions or procedures, such as mathematical functions. The primitives are usually written in the native language of the processing unit  100  so that they can be executed very quickly. 
     In FIG. 4, there is shown a diagram of a system for remotely loading an application from an application provider  401  onto an IC card  403 . The application provider  401  may be a card issuer, a bank, or any other entity that provides application loading services. The IC card  403  communicates with the application provider  401  through an interface device  405 , which may be a bank terminal, an ATM, or any other device that communicates with an IC card. The application provider  401  and the interface device  405  communicate by way of a data conduit  407 , which can be a telephone line, a cable line, a satellite link, an Internet connection, an intra-net connection, or any other type of communications link. 
     When loading applications onto an IC card remotely, an application provider is required to address several security issues. First, an application provider must ensure that an application is sent only to the cardholder who is intended to receive the application. Second, the application provider must ensure the privacy of any confidential or trade secret information contained in the applications to be loaded. Third, because the data conduit  407  may be an open link and subject to third parties possibly intercepting or replacing applications being transmitted, an application provider must take security measures to enable the IC card to authenticate the application. 
     The solutions to these security issues typically involve encryption using symmetric and/or asymmetric cryptography techniques. Symmetric cryptography involves encoding and decoding data using the same mathematical number, called a “key,” which must be kept secret. On the other hand, asymmetric cryptography, or “public key” cryptography as it is also called, involves encoding data with one key and decoding data with another key. The two keys are referred to as a key pair, and one of the key pair must be kept secret while the other of the key pair may be publicly distributed. Each key of a key pair may be used to encode data; however, once data is encoded by using one key, it can only be decoded by using the other key. 
     In the system of FIG. 4, it is assumed that the application provider  401  and the IC card  403  each have cryptographic key pairs. The generation of cryptographic keys is performed by any manner known by those skilled in the art. The system also utilizes a Certification Authority (CA)  409 , which also has a cryptographic key pair. The CA  409  may be any entity that is trusted to keep the secret key of its public key pair private and to authenticate the identity of other entities—as, for example, the identity of the application provider  401 . 
     In the system of FIG. 4, the application provider  401  applies for registration of its public key with the CA  409 . To do so, the application provider  401  must meet the identification requirements of the CA  409 . If the application provider  401  meets these identification requirements, the CA  409  will issue an Application Load Certificate (ALC)  413 , which includes the public key of the application provider  401  encoded or “signed” by the secret key of the CA  409 . The ALC  413  may be decoded using the public key of the CA  409 , which is publicly distributed. Since the CA  409  is trusted to keep its secret key private and to authenticate the identity of the application provider  401 , any entity receiving the ALC  413  is assured that the public key contained within the certificate belongs to the application provider  401 . 
     To load an application onto the IC card  403 , the application provider  401  transmits an Application Load Unit (ALU)  411  to the interface device  405  via the data conduit  407 . The contents of the ALU  411  are shown schematically in FIG.  5 . The ALU preferably includes an Application Unit (AU)  415 , a signed Application Unit (AU s )  417 , a Key Transformation Unit (KTU)  419 , and the ALC  413 . 
     The AU  415  contains the application code and data that are to be stored on the IC card. Some or all of the application code and data may be encrypted to protect confidential or trade secret portions of the application code and data. 
     The AU s    417  is the application code and data AU  415  signed with the secret key of the application provider  401 . Using the public key of the application provider  401  provided in the ALC  413 , the IC card  403  may decode the AU s    417  and compare it to the AU  415  to ensure that the AU  415  has not been tampered with during transmission. 
     The KTU  419  contains information relating to the encrypted portions of the AU  415 . This information allows the IC card  403  to decode those encrypted portions so that the application code and data can be accessed by the IC card  403 . The KTU  419  is signed with the public key of the IC card  403 , which ensures that only the intended IC card  403  can decode the KTU  419  (using the IC card&#39;s secret key). Once the KTU  419  is decoded, the IC card  403  may use the information contained in the KTU  419  to decode the encrypted portions of the application code and data of AU  415 . 
     FIG. 6 shows a flow chart of the steps for processing the ALU  411  when it is received by the IC card  403 . In step  601 , the IC card  403  receives the ALU  411  from the application provider  401 . The ALU  411  is placed in the EEPROM of the IC card  403  along with header information indicating the location in memory of AU  415 , AU s    417 , KTU  419  and ALC  413 . 
     In step  603 , the ALC  413  is decoded using the public key of the CA  409 . The IC card  403  preferably stores in its memory a copy of the CA public key because it may be used in many transactions. Alternatively, the IC card could obtain the public key from a trusted storage location, such as the interface device  405 . Once decoded, the ALC  413  provides the IC card  403  with a trusted copy of the public key of the application provider  401 . 
     In step  605 , the IC card  403  uses the application provider&#39;s public key to verify the AU  415  was not tampered with during transmission. Using the public key of the application provider  401 , the IC card  403  decodes the AU s    417 , which was signed with the secret key of the application provider  401 . Once the AU s    417  is decoded, the decoded AU s    417  is compared to the AU  415 . If the two units match, then the AU  415  is verified. 
     In step  607 , the KTU  419 , which has been encrypted with the public key of the IC card  403 , is decoded using the private key of the IC card  403 . In step  609 , the information in the decoded KTU  419  is used to decode the encrypted portions of the AU  415 . The KTU  419  may contain, for example, either an algorithm or a key for use in decoding the AU  415 . 
     In addition to the security and authentication measures discussed above, other security and authentication measures may also be employed. Additional methods of security and authentication have been addressed, for example, in the related patent applications entitled, “Secure Multi-Application IC Card System Having Selective Loading and Deleting Capability,” by Everett et al., filed Feb. 12, 1998, and “Key Transformation Unit for an IC Card,” by Richards et al., filed May 11, 1998. Both of these applications are hereby incorporated by reference. 
     In accordance with a preferred embodiment of the present invention, the data portion of the AU  415  includes an application identifier for the application to be loaded onto the IC card  403  and an application copy number, which is unique for each copy of an application to be loaded onto the IC card  403 . As it is used in this specification and the amended claims, the use of the term “unique” in relation to application copy numbers refers both to non-random numbers that are actually determined to be unique and to random numbers that are determined to be probabilistically unique for a given IC card. Preferably, the data portion of the AU  415  containing the application identifier and the application copy number is encoded (and the KTU  419  contains the information necessary to decode this data portion). 
     FIG. 7 is a flowchart illustrating the steps of a file loading routine that may be implemented by the operating system of the IC card  403  to take advantage of the application identifier and the application copy number contained in the AU  415  to prevent a cardholder from repeatedly loading the same application onto the IC card  403 . In the embodiment of FIG. 7, the application copy number is a random number, also called a “random seed.” In step  701 , the file loading routine receives the file loading command load_file_command from the security manager of the operating system, OS_Security_Manager. The OS_Security_Manager of the operating system is responsible for verification and decoding of the ALU  411  as discussed with regard to FIG.  6 . 
     In step  703 , the application identifier and random seed associated with the application, referred to as load_file_command.application_id and load_file_command.random_seed, respectively, are checked against entries in an application history list stored on the IC card, referred to as os_global_data.app_history_list. The application history list contains entries for each set of application identifier and random seed associated with an application loaded onto the IC card  403 . It is preferred that the application history list be stored in a secure area of EEPROM that is not accessible from outside the IC card. 
     If the application identifier and random seed associated with the application to be loaded are found in the application history list, in step  705 , the response status load_file_response.status is set to “failed” and the error description load_file_response.error_cause is set to “application previously loaded.” The error response load_file_response is returned to the OS_Security_Manager, indicating that the load file routine failed to load the application because the application had previously been loaded onto the IC card. 
     If the application identifier and random seed associated with the application to be loaded are not found in the application history list, in step  707 , the random seed is checked to determine whether it is equal to zero and the application history list is checked to determine whether it is full. A random seed with a value of zero indicates that the application does not contain any economic value included in its data, and thus may be reloaded as often as desired. If the random seed associated with the application is not zero (indicating there is an economic value included with the application) and the application history list is full, the response status load_file_response.status is set to “failed” and the error description load_file_response.error_cause is set to “application history list full.” In this case, the application cannot be loaded because the application history list is full and, therefore, the application identifier and random seed cannot be added to the application history list for future checking. 
     If an error condition has not been triggered in steps  703  or  707 , in step  711 , the directory file record associated with the application is added to the directory file of the IC card—i.e., the application is loaded onto the IC card  403 . In step  713 , it is checked whether the random seed is equal to zero. If the random seed is not equal to zero (indicating that there is an economic value included with the application), the application identifier and the random seed are added to the application history list for checking against subsequent applications sought to be loaded onto the IC card. After updating the application history list, the response status load_file_response.status is set to “success” and sent to the OS_Security_Manager. 
     If the random seed is equal to zero (indicating that there is no economic value included with the application), the application identifier and random seed are not added to the application history list. Instead, step  717  is skipped, and the response status load_file_response.status is set to “success” and sent to the OS_Security_Manager. 
     Advantageously, the file loading routine of FIG. 7 prevents a cardholder from illegitimately reloading an application. If a cardholder intercepts and copies an application to be loaded onto an IC card, the cardholder cannot later reload the application because, once the application is loaded, the application identifier and random seed are stored permanently on the IC card. If a cardholder attempts to reload the application, the operating system of the IC card will fail to reload the application because the application identifier and random seed of the application will match an entry in the application history list of the IC card. 
     On the other hand, a cardholder is not prevented from legitimately reloading an application from an application provider. Since an application provider will generate a new random seed for each copy of an application it provides, it will be unlikely for a cardholder to receive a second copy of the application from the application provider with the same random seed. Of course, the application provider must use a random seed of sufficient length to ensure that the probability of any cardholder twice receiving the same random seed is sufficiently unlikely. 
     Alternatively, instead of using a random number, an application provider may use any unique number associated with copies of applications it provides to each cardholder. For example, an application provider may keep a counter that tracks the number of copies of an application that is has provided. The application provider may use the value of the counter to provide a unique number each time it provides a copy of the application to a cardholder. The random seed embodiment is preferred, however, because it is easier to manage (i.e., there is no information that is required to be stored or managed). 
     Although the present invention has been described with reference to certain preferred embodiments, various modifications, alterations, and substitutions will be known or obvious to those skilled in the art without departing from the spirit and scope of the invention, as defined by the appended claims.