Abstract:
In order to shorten an access time and thus to shorten the entire data processing time, a sector size of a memory device is adapted to respective applications. Each application is assigned a respective sector. The access right is checked only once for each application.

Description:
CROSS-REFERENCE TO RELATED APPLICATION  
       [0001]    This application is a continuation of copending International Application PCT/EP00/04940, filed May 30, 2000, which designated the United States. 
     
    
     
       BACKGROUND OF THE INVENTION  
       FIELD OF THE INVENTION  
         [0002]    The invention relates to a method for accessing a memory having sectors, wherein a number of rows form a sector and wherein a number of keys are provided for the memory. The invention furthermore relates to a memory device having a memory with a plurality of sectors and a plurality of keys.  
           [0003]    Credit cards, telephone cards, insurance or identity cards, to name just a few examples of a number of so-called machine-readable smart cards, are equipped with a data memory in which, in part, highly sensitive data are stored, which must be protected against unauthorized access. In order to protect highly sensitive data, there are usually a plurality of keys stored on the smart card. Prior to processing the data stored in the memory of the smart card, for example reading, writing, erasing or changing, a computation operation is performed to ascertain, both on the smart card and in the read/write device, whether the read/write device is authorized to do this. Thus, by way of example, keys are provided which provide authorization for read-only, for reading and writing of data or for debiting, crediting and debiting of values.  
           [0004]    The memory of a smart card according to the prior art is divided into sectors of equal size, each sector being allocated two keys. However, applications often require more than one sector, so that each sector associated with an application must also be assigned at least one key.  
           [0005]    Since, in such cases, the access right is therefore checked anew for each sector during the processing of the data within an application, the data processing time is disadvantageously increased.  
           [0006]    [0006]FIG. 2 shows a known memory SP according to the prior art with n sectors S 1  to Sn; each of the sectors S 1  to Sn includes three rows Z 1  to Z 3 . Each sector is assigned one or more keys A 1 , B 1  to An, Bn; each key provides authorization for an access right.  
           [0007]    By way of example, if the sectors S 1  and S 2  include an application, for example debiting from an account, then the sector S 2  is assigned the same keys as the sector S 1 . Whenever access is made from one sector to the other, that is to say from the sector S 1  to the sector S 2  or vice versa, the access right is checked anew, as a result of which the access time and hence the entire data processing time is increased. Since the sectors are not always fully utilized in the case of relatively small applications, existing memory locations are not utilized and so they are actually superfluous.  
         SUMMARY OF THE INVENTION  
         [0008]    It is accordingly an object of the invention to provide a method for accessing a memory which overcomes the above-mentioned disadvantages of the heretofore-known methods of this general type and which significantly shortens the data processing time and optimizes the utilization of the memory. A further object of the invention is to provide a memory device which can be used with the method according to the invention.  
           [0009]    With the foregoing and other objects in view there is provided, in accordance with the invention, a method for accessing a memory, the method includes the steps of:  
           [0010]    providing a memory including a plurality of rows, a respective number of the rows forming a respective sector;  
           [0011]    providing, for each application, at least one sector having a variable sector size;  
           [0012]    assigning an application-specific sector code to a sector;  
           [0013]    providing a plurality of keys;  
           [0014]    assigning at least one access right and a key link number to a key; and  
           [0015]    assigning at least one key link number to an application-specific sector code such that rights are assigned to a corresponding sector.  
           [0016]    In other words, the object of the invention is achieved by virtue of the fact that, for each application, one sector, or alternatively, if appropriate, a plurality of sectors, with variable sector size is or are provided.  
           [0017]    With the objects of the invention in view there is also provided, a memory device, including:  
           [0018]    a memory including a plurality of rows and a plurality of sectors, a respective number of the rows forming a respective one of the sectors;  
           [0019]    each of the sectors having an application-specific size;  
           [0020]    each of the sectors being provided with a respective application-specific sector code, at least one key link number being assigned to the respective application-specific sector code such that rights are assigned to a corresponding segment of the memory; and  
           [0021]    a plurality of keys, each of the keys being assigned at least one access right and a key link number, each of the keys being provided with at least one code, the at least one code authorizing a respective one of the keys only for access to a given one of the sectors determined by a corresponding application-specific code.  
           [0022]    In other words, the object of the invention with regard to the memory device is achieved by virtue of the fact that each of the sectors has an application-specific size, that each sector is provided with an application-specific code, and that each key is likewise provided with a code which authorizes the key only for accessing a sector which is determined by the corresponding application-specific code.  
           [0023]    According to another feature of the invention, the memory is configured to store a signature for each unit formed from a key, a code for the key and an associated access right, and the memory is configured such that the signature is checked during authentication for protection against manipulations.  
           [0024]    According to another feature of the invention, the memory is configured to store, for each of the sectors, a respective signature to be checked during each data access.  
           [0025]    According to another feature of the invention, the memory is configured to store a signature containing a chip serial number.  
           [0026]    According to another feature of the invention, the keys are provided in respective ones of the rows and the sectors.  
           [0027]    A second way of achieving the object of the invention provides for a row to be assigned one or more access rights and one or more linkages, via which the row may be assigned one or more keys, for rows with and without keys to be provided, and for all rows with the same linkage to form a virtual sector.  
           [0028]    Accordingly, with the objects of the invention in view there is also provided, a method for accessing a memory, the method includes the steps of:  
           [0029]    providing a memory including a plurality of rows, a respective number of the rows forming a respective sector;  
           [0030]    providing a plurality of keys;  
           [0031]    assigning at least one access right and at least one linkage to a row, the at least one linkage being usable for assigning at least one key to a row;  
           [0032]    providing some of the rows with keys and providing some of the rows without keys; and  
           [0033]    forming a virtual sector with rows having a same linkage.  
           [0034]    Another mode of the invention includes the step of assigning at least one access right to a key link number.  
           [0035]    A further mode of the invention includes the step of assigning at least one access right to a row link number.  
           [0036]    Yet another mode of the invention includes the step of assigning at least one application-specific sector code to a sector.  
           [0037]    Another mode of the invention includes the step of assigning at least one key code to a key allowing access only to sectors with a corresponding sector code.  
           [0038]    A further mode of the invention includes the step of assigning at least one access right to a key code.  
           [0039]    Another mode of the invention includes the step of assigning at least one access right to a sector code.  
           [0040]    In contrast to the known memory organization on a smart card, according to the invention the size of the sectors is not identical, but rather can be adapted to the respective application.  
           [0041]    In one embodiment of the invention, a memory is divided into a plurality of sectors which are constructed from individual rows. The number of rows of a sector is chosen in a manner dependent on the application. Each row is assigned at least one row link number. Rows associated with the same application have the same row link number. In order to organize the access according to access rights, a plurality of keys are provided. In a similar manner to how each row is assigned a row link number, each key is assigned a key link number. The key link number of a key corresponds to the row link number of that row or rows which is or are assigned to the key. A key only has access to those rows whose row link number corresponds to its key link number.  
           [0042]    By virtue of the measure of adapting the sector size to the respective application, only one key is required for each application and hence for each sector, whereas in the prior art each sector of the same application is assigned a key. In the case of the invention, therefore, the access right is checked only once during the implementation of each application, whereas it is checked anew for each sector in the case of the prior art. The method according to the invention therefore achieves an acceleration of the data processing and utilizes the memory optimally.  
           [0043]    A third exemplary embodiment of the invention provides for a signature to be provided for each unit including key, key link number and associated access right. These signatures are stored in the memory SP and checked during authentication.  
           [0044]    Another mode of the invention includes the steps of storing, in the memory, a signature for each unit formed of a key, a key code and an associated access right; and checking the signature stored in the memory during authentication for protection against manipulations.  
           [0045]    A further exemplary embodiment provides for rows having the same row link numbers to he assigned a signature which is likewise stored in the memory SP and checked during each access.  
           [0046]    The signatures may, for example, contain the serial number of the chip in addition to further data.  
           [0047]    In order to give individual rows of a sector different access authorizations, provision is made for assigning a plurality of row link numbers to a row. Each key whose key link number corresponds to one of the numbers of a row therefore has access to this row.  
           [0048]    The application-specific code of a sector corresponds to the link number of the sector or the rows thereof. The key code corresponds to the key link number in a similar manner. Therefore, a key only allows access to a sector whose applications-specific code is assigned to the code of the key.  
           [0049]    In a further exemplary embodiment, a signature is provided for each unit including key, code of the key and associated access right. These signatures are stored in the memory and checked during authentication.  
           [0050]    In accordance with a further exemplary embodiment of the invention, each sector is assigned a signature which is likewise stored in the memory and checked during each access. Further exemplary embodiments of the invention include the measures presented below.  
           [0051]    For rows having the same row link numbers or for sectors, a signature is stored in the memory, which signature is checked during each data access.  
           [0052]    As has already been mentioned earlier above, the signatures may, for example, contain the serial number of the chip in addition to further data.  
           [0053]    A key link number or a row link number may be assigned one or more access rights. In a similar manner, a key code or a sector code may be assigned one or more access rights. The key code of a key only allows access to sectors with a corresponding sector code.  
           [0054]    A row may also be assigned a plurality of row link numbers.  
           [0055]    Further exemplary embodiments and refinements of the invention are provided by the following measures.  
           [0056]    A successful authentication with a key allows all accesses in accordance with the access rights assigned to the key link numbers or the key codes. An access in accordance with an access right to a sector or a row is possible only when one of the sector codes or one of the row link numbers corresponds to one of the key link numbers or key codes of the keys which have been successfully authenticated. In a similar manner, an access in accordance with an access right to a sector or a row is possible only when all keys whose key link numbers or key codes correspond to the row link numbers or sector codes assigned to the respective access rights have been successfully authenticated.  
           [0057]    Furthermore, provision may be made for providing the keys in rows or sectors which are managed by access rights. By way of example, a read right may be required in order to allow an authentication with a key. It is also possible to provide a particular right for authentication in order to allow an authentication with a key. However, this does not preclude the fact that it is also possible for rows or sectors to be provided which require no authentication for specific types of access.  
           [0058]    Analogously to the authentication, a particular access right may be provided for the free access. A free access may be regulated through the use of a particular row link number or a particular sector code. Finally, it is also possible to provide a particular key in order to regulate a free access.  
           [0059]    Another mode of the invention includes the step of assigning a key pair to rows having keys.  
           [0060]    Another mode of the invention includes the step of providing the key pair as a pair of keys of equal authorization.  
           [0061]    A further mode of the invention includes the step of providing the keys as keys that are authenticated by themselves or via other keys.  
           [0062]    Another mode of the invention includes the step of providing the key pair as a pair of hierarchically ordered keys.  
           [0063]    Other features which are considered as characteristic for the invention are set forth in the appended claims.  
           [0064]    Exemplary embodiments of a memory organization according to the invention will now be described and explained with reference to the drawings. Although the invention is illustrated and described herein as embodied in method for accessing a memory and a corresponding memory device, it is nevertheless not intended to be limited to the details shown, since various modifications and structural changes may be made therein without departing from the spirit of the invention and within the scope and range of equivalents of the claims. 
       
    
    
       [0065]    The construction and method of operation of the invention, however, together with additional objects and advantages thereof will be best understood from the following description of specific embodiments when read in connection with the accompanying drawings.  
       BRIEF DESCRIPTION OF THE DRAWINGS  
       [0066]    [0066]FIG. 1 is a block diagram illustrating an exemplary memory organization according to the invention;  
         [0067]    [0067]FIG. 2 is a block diagram illustrating a memory organization according to the prior art; and  
         [0068]    [0068]FIG. 3 is a block diagram illustrating an exemplary memory organization according to a further embodiment of the invention. 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0069]    Referring now to the figures of the drawings in detail and first, particularly, to FIG. 1 thereof, there is shown an exemplary memory organization according to the invention. In this memory organization two applications are integrated on the smart card, an application A 1 , which relates for example to the debiting of values, and an application A 2 , which relates for example to the crediting of values. The application A 1  requires six rows Z 1  to Z 6 , which are combined to form a sector S 1 , while the application A 2  requires 15 rows Z 7  to Z 21 , which are combined to form a sector S 2 . Three keys A, B, C are provided. The key A provides authorization for read-only; the keys B and C provide authorization for reading and writing. The key A and the key B belong to the application A 1 ; they both have the key link number  1 . The rows of the sector S 1  all have the same number, namely  1 , which corresponds to the key link number of the key A and of the key B. All rows of the sector S 2  have the number  2 , which is assigned to the key C. Therefore, all rows with the row link number  1  can be read with the key A. With the key B, all rows with the number  1  can be read and also be written to. With the key C, all rows with the row link number  2  can be read and be written to. By contrast, the rows with the row link number  2  cannot be accessed with the keys A and B. Equally, the rows with the row link number  1  cannot be accessed with the key C.  
         [0070]    By virtue of the measure according to the invention, namely to adapt the sector size to the individual applications, only one check of the access right per application is necessary, whereas, as already mentioned, in the prior art as many checks are necessary as an application occupies sectors.  
         [0071]    An exemplary embodiment of the method which is shown in FIG. 3 will now be described and explained.  
         [0072]    The memory configuration represented in FIG. 3 is largely configured flexibly. The memory is subdivided into n rows each having eight bytes, for example, which are initially not assigned to any segment. However, each of these rows has an additional sector index register SI and also a configuration register AC, for which only two bytes are additionally required. Through the use of the sector index SI, a row is assigned the keys K 1  to Kk required for authentication. A row may be assigned one key or alternatively a plurality of keys. A preferred refinement of the invention provides for a key pair to be provided for each row. The two keys of the key pair may have equal authorization or be ordered hierarchically. In the case of the hierarchical key concept, the access rights of an individual key can be set individually in the configuration register AC of the row. The keys themselves can also again be authenticated through the use of other keys or by themselves and be read or written in accordance with the access rights held in the configuration register. All rows with the same sector index are associated with the same application and form a virtual sector.  
         [0073]    One advantage of this concept is that each application key only has to be stored once irrespective of the size of the application. The size and number of the segments is freely selectable. The number of defined segments determines the number of key pairs required, so that the remaining memory space is entirely available for application data.  
         [0074]    The invention is particularly suitable for use on a smart card. However, the invention is not restricted to this one application, because it can advantageously be used wherever the access to memory locations is regulated by access rights.