Title of Invention	A DATA CARRIER HAVING A SEMICONDUCTOR CHIP
Abstract	The invention relates to a data carrier having a semiconductor chip (5) with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (hR1R, hR1R2) generates either the output data (y) of the undisguised operation (h) or disguised output data (y ® R2) from which the output data (y) can be determined.

Title of Invention

A DATA CARRIER HAVING A SEMICONDUCTOR CHIP

Abstract

The invention relates to a data carrier having a semiconductor chip (5) with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (hR1R, hR1R2) generates either the output data (y) of the undisguised operation (h) or disguised output data (y ® R2) from which the output data (y) can be determined.

Full Text	-1 - A DATA CARRIER HAVING A SEMICONDUCTOR CHIP The present invention relates to a data carrier having a semiconductor chip in which secret data are stored. The invention relates in particular to a smart card. Data carriers containing chips are used in a great number of different applications, for example for performing monetary transactions, paying for goods or services, or as an identification means for access or admission controls. In all said applications the data carrier chip normally processes secret data which must be protected from access by unauthorized third parties. Said protection is ensured by, among other things, giving the inner structures of the chip very small dimensions so that it is very difficult to access said structures with the aim of spying out data processed in said structures. In order to impede access further, one can embed the chip in a very firmly adhering compound whose forcible removal destroys the semiconductor plate or at least the secret data stored therein. It is also possible to provide the semiconductor plate during its production with a protective layer which cannot be removed without destroying the semiconductor plate. With corresponding technical equipment, which is extremely expensive but nevertheless fundamentally available, an attacker could possibly succeed in exposing and examining the inner structure of the chip. Exposure could be effected for example by. special etching methods or a suitable grinding process. The thus exposed structures of the chip, such as conductive paths, could be contacted with micro-probes or examined by other methods to determine the signal patterns in said structures. Subsequently, one could attempt to determine from the detected signals secret data of the data carrier, such as secret keys, in order to use them for purposes of manipulation. One could likewise attempt to selectively influence the signal patterns in the exposed structures via the microprobes. The invention is based on the problem of protecting secret data present in the chip of a data carrier from unauthorized access. -1A- Accordingly, the present invention provides a data carrier having a semiconductor chip with at least one memory containing an operating program which is able to execute at least one operation (h), the execution of the operation (h) requiring input data (x) and the execution of the operation (h) generating output data (y), characterized in that: the operation (/?) is disguised before its execution, the disguised operation (h^) is executed with disguised input data (x Ri), and the disguising of the operation {h) and the input data (x) is coordinated such that the execution of the disguised operation (/?/?,) with disguised input data (x 0 Ri) yields output data (y) identical with the output data (y) determined upon execution of the undisguised operation (h) with undisguised input data (x). The present invention also provides a data carrier having a semiconductor chip with at least one memory containing an operating program which is able to execute at least one operation (h), the execution of the operation (h) requiring input data (x) and the execution of the operation {h) generating output data (y), characterized in that: the operation (h) is disguised before its execution, the disguised operation {h^) is executed with disguised input data (x Ri), the disguising of the operation (h) and the input data (x) is coordinated such that the execution of the disguised operation {hRi^) with disguised input data (x Ri) yields output data (y R2) which are disguised relative to the output data (y) determined upon execution of the undisguised operation (/?) with undisguised input data (x), and the undisguised output data (y) can be determined from the disguised output data (y R2) with the aid of data {R2) used for disguising the operation {h). The inventive solution does not aim, like the prior art, at preventing exposure of the internal structures of the chip and the mounting of microprobes. Instead - 2 - measures arc taken to make it difficult for a potential attacker to infer secret information from any signal patterns intercepted. Said measures consist according to the invention in manipulating security-relevant operations so that the secret data used in performing said security-relevant operations cannot be determined without including further secret information. For this purpose the security-relevant operations are disguised or falsified with the aid of suitable functions before execution. In order to impede or even prevent in particular a statistical evaluation in case of multiple execution of the security-relevant operations, a random component enters into the disguising function. As a result, an attacker cannot determine the secret data from any data streams intercepted. The security-relevant operation will be represented in the following by function h mapping input data x on output data^, i.e. y = h{x). To prevent secret input data x from being spied out the invention provides for disguised function hR\tn to be determined, so that the following holds: y®R2 = hRlR2(x®Rl), The security-relevant operation is now performed by means of disguised function hRiK2 whose input data are not authentic secret data JC but disguised secret data x ® Ri generated by combining authentic secret data x with random number R\. Without knowledge of random number R\ one cannot determine authentic secret data x from disguised secret data x ® R\. As a result of applying disguised function hum to disguised secret data x ® /?f one obtains disguised output dataj & R2. From -disguised output datay R2 one can determine output data y by suitable combination. Before each new execution of the security-relevant function one can preset new random numbers R{ and R2 from which new disguised function hmn s determined in each case. Alternatively, a plurality of disguised functions hRiia can be permanently stored, one of which is selected randomly before execution of the security-relevant operation. It is especially advantageous to use two functions hHi#2 and hftw random numbers R\' and /?/ being the inverse values of random numbers R] and R2 with respect to the type of combination selected for disguising. In a further variant, random numbers R{ and R2 can also be identical. In particular, random num- -3- bers Hi and R2 can be selected statistically independently so that there is no correlation between input and output data which can be used for an attack. If further operations are executed before or after security-relevant operation h in question here, random numbers Rx and R2 can also be used for disguising the data processed with the further operations. The inventive solution can be used especially advantageously for security-relevant operations containing nonlinear functions. With nonlinear functions one cannot apply known protective measures based on disguising the secret data before execution of the functions. Known protective measures presuppose that the functions are linear with respect to the disguising operations so that disguising can be undone after execution of the functions. In the inventive solution, however, not only the secret data are falsified or disguised but also the security-relevant operations processing the secret data. The disguising of the secret data and the security-relevant operations is coordinated such that the authentic secret data can be derived from the disguised secret data after execution of the security-relevant operations. Coordination between disguising of the secret data and the security-relevant operations can be realized especially simply if the security-relevant operations are realized in the form of tables, so-called lookup tables. In the stated tables each input value x has output value y associated therewith. The functions realized by the tables are executed by looking up output values y belonging to particular input values x. The invention will be explained below with reference to the embodiments shown in the figures, in which: Fig. 1 shows a smart card in a top view, Fig. 2 shows a greatly enlarged detail of the chip of the smart card shown in Fig. 1 in a top view. Figs. 3a, 3b, 3c and 3d show representations of lookup tables. Fig. 1 shows smart card 1 as an example of the data carrier. Smart card 1 is composed of card body 2 and chip module 3 set in a specially provided gap in card body 2. Essential components of chip module 3 are contact surfaces 4 for producing an electric connection with an external device, and chip 5 electrically connected with contact surfaces 4. As an alternative or in addition to contact surfaces 4, a coil not - 4 - shown in Fig, 1 or other transfer means can be present for producing a communication link between chip 5 and an external device. Fig, 2 shows a greatly enlarged detail of chip 5 from Fig, 1 in a top view. The special feature of Fig. 2 is that it shows the active surface of chip 5, ie. it does not show all layers generally protecting the active layer of chip 5. In order to obtain information about die siipial patterns in the interior of the chip one can for example contact exposed structures 6 with microprobes. Microprobes are very thin needles which are brought in electric contact with exposed structures 6, for example conductive paths, by means of a precision positioning device. The signal patterns picked up by the microprobes are processed wife suitable measuring and evaluation devices with the aim of inferring secret data of the chip. The invention makes it very difficult or even impossible for an attacker to gain access to in particular secret data of the chip even if he has managed to remove the protective layer of chip 5 without destroying the circuit and to contact exposed structures 6 of chip 5 with microprobes or intercept then? in some other way. The invention is of course also effective if an attacker gains access to the signal patterns of chip 5 is another way-Figures 3a, 3b, 3c and 3d show simple examples of lookup tables in which the input and output data each have a length of 2 bits. All table values are represented as binary data. The first line states input data JC, and the second line output data^ associated therewith in the particular column. Figure 3a shows a lookup table for undisguised function k. Figure 3a indicates that input value x = 00 has output value h(x)-0l associated therewith, input value 01 output value 11, input value 10 output value 10, and input value 11 output value 00. The lookup table according to Figure 3a represents nonlinear function h which is to be executed within the framework of a security-relevant operation. According to the invention, however, one does not use the lookup table shown in Figure 3a itself in executing the security-relevant operation, but derives a disguised lookup table from said lookup table according to Figures 3b, 3c and 3d. Figure 3b shows an intermediate step in determiBirtg the disguised lookup table. The lookup table according to Figure 3b was generated from die lookup table - J) - according to Figure 3a by EXORing each value of the first line of the table from Figure 3a with random number Ri * 11. Thus, EXORing the value 00 of the first line and first column of the table from Figure 3a with the number 11 yields the value 11, which is now the element of the first line and first column of the table of Figure 3b. The remaining values of the first line of the table shown in Figure 3b are determined accordingly from the values of the first line of the table shown in Figure 3a and random number Rx - 11, The table shown in Figure 3b could already be used as a disguised lookup table for processing secret data likewise disguised with random number R\ = 11. The result would be the plaintext values to be read in line 2 of the table from Figure 3b. One usually arranges the individual columns of a lookup table according to ascending input data x. A table determined by accordingly sorting the table in Figure 3b is shown in Figure 3c. If me table according to Figure 3c is to be disguised further or yield as output values likewise disguised values rather than plaintext values, one applies a further EXOR operation with further random number R2. Figure 3d shows the result of applying said further EXOR operation. In said operation the elements of the second line of the table according to Figure 3c are each EXORed with random number R2 ~ 10. The element in the second line and the first column of the table according to Figure 3d thus results from EXORing the element in the second line and first column of the table according to Figure 3c with random , number R2 =* 10. The further elements of the second line of the table according to Figure 3d are formed accordingly. The first line of the table according to Figure 3d is adopted by Figure 3 c unchanged. With the table shown in Figure 3d one can determine likewise disguised output data from disguised input data. The thus determined disguised output data can be supplied to further operations for processing disguised data or one can determine plaintext data therefrom by EXORing with random number R2 = 10. Use of the table shown in Figure 3d makes it possible to perform nonlinear operations with disguised secret data and protect said secret data from unauthorized access. The security-relevant operations themselves are still also protected from un- 6- authorized access since differently disguised functions can be used at every execution of the operations and the security-relevant operations themselves cannot be inferred even if the disguised functions could be determined. After conversion to plaintext, however, both the original security-relevant operations and the operations performed with the aid of disguised functions yield identical results. For example, input value 00 yields output value 01 according to the table in Figure 3a. In order to check whether the disguised table shown in Figure 3d yields the same output value one must first EXOR input value 00 with random number Ri - 11. As a result of said combination one obtains the value 11. According to the table from Figure 3d, input value 11 likewise yields output value 11. In order to determine the plaintext from said output value one must EXOR the output value with random number i?2 ~ 10. As a result of said combination one obtains the value 01 which exactly matches the value determined with the aid of the table shown k Figure 3a. Disguising the security-relevant operations or the input values can be effected not only by EXORing but also by other suitable types of combination, for example modular addition. Furthermore, the invention is not limited to the application of nonlinear functions represented by means of lookup tables. One can also use any nonlinear and even linear functions for which a suitable disguised function can be determined. -7- WE CLAIM : 1. A data carrier having a semiconductor chip (5) with at least one memory containing an operating program which is able to execute at least one operation (h), the execution of the operation (h) requiring input data (x) and the execution of the operation (h) generating output data (y), characterized in that: - the operation (/?) is disguised before its execution, - the disguised operation (h^) is executed with disguised input data (x ® Ri), and - the disguising of the operation (h) and the input data (x) is coordinated such that the execution of the disguised operation (/?RI) with disguised input data (x (8) Ri) yields output data (y) identical with the output data (y) determined upon execution of the undisguised operation (/?) with undisguised input data (x). 2. A data carrier as claimed in claim 1, wherein at least one random number (Ri) enters into the determination of the disguised operation (fo?i) and the disguised input data (x ® Ri). 3. A data carrier as claimed in any of claims 1 or 2, wherein the determination of the disguised operation (/7RI) and the disguised input data (x Ri) is effected with the aid of EXOR operations. 4. A data carrier as claimed in any of claims 1 to 3, wherein the disguised operation (h^) is permanently stored in the data carrier in advance. 5. A data carrier as claimed in claim 4, wherein at least two disguised operations (/JRI, hm) are permanently stored in the data carrier in advance and one of the stored disguised operations (/?RI, tiRr) is selected randomly when a disguised operation is to be executed. -8- 6. A data carrier as claimed in any of claims 1 to 3, wherein the disguised operation (/7R1) is recalculated before its execution and the at least one random number (RA) is determined for such calculation. 7. A data carrier as claimed in any of claims 1 to 6, wherein the operation (h) is realized by a table stored in the data carrier which establishes an association between the input data (x) and the output data (y). 8. A data carrier as claimed in claim 7, wherein the disguising of the input data (x) contained in the table is effected by combination with the at least one random number (R,). 9. A data carrier having a semiconductor chip (5) with at least one memory containing an operating program which is able to execute at least one operation {h), the execution of the operation (h) requiring input data (x) and the execution of the operation (h) generating output data (y), characterized in that: - the operation (h) is disguised before its execution, - the disguised operation (hR1) is executed with disguised input data (x ® ft), - the disguising of the operation (h) and the input data (x) is coordinated such that the execution of the disguised operation (h^Rz) with disguised input data (x Ri) yields output data (y R2) which are disguised relative to the output data (y) determined upon execution of the undisguised operation (h) with undisguised input data (x), and - the undisguised output data (y) can be determined from the disguised output data (y R2) with the aid of data (R2) used for disguising the operation -9- 10. A data carrier as claimed in claim 9, wherein at least one random number (Ri) enters into the determination of the disguised input data (x ® R,) and at least two random numbers (Ri, R2), enters into the determination of the disguised operations (/fare)- 11. A data carrier as claimed in claim 9 or 10, wherein the determination of the disguised operation (hmR2) and the disguised input data (x Ri) is effected with the aid of EXOR operations. 12. A data carrier as claimed in any of claims 9 to 11, wherein the disguised operation (tiRim) is permanently stored in the data carrier in advance. 13. A data carrier as claimed in claim 12, wherein at least two disguised operations (hR1R2, hRvRz) are permanently stored in the data carrier in advance and one of the stored disguised operations (/fare, hRiv&) is selected randomly when a disguised operation is to be executed. 14. A data carrier as claimed in claim 13, wherein the random numbers (Ri, R2) for determining the first disguised disguised operation (hmm) are inverse to the random numbers (RV, R2') for determining the second disguised operation (hm'Rr) with respect to the combination used for determining the disguised operations (hmR2, hmm). 15. A data carrier as claimed in any of claims 9 to 11, wherein the operation ( hm/a) is recalculated before its execution and the random numbers (Ri, R2) are redetermined for said calculation. -10- 16. A data carrier as claimed in any of claims 9 to 15, wherein the operation ( h) is realized by a table stored in the data carrier which establishes an association between the input data (x) and the output data (y). 17. A data carrier as claimed in claim 16, wherein the disguising of the input data (x) contained in the table is effected by combination with the at least one random number (Ri) and the disguising of the output data (y) contained in the table is effected by combination with the at least one further random number (R2). 18. A data carrier as claimed in any of claims 1 to 17, wherein the operation ( h) is a non-linear operation with respect to the combination used for disguising the operation (/?). 19. A data carrier having a semiconductor chip, substantially as herein described, particularly with reference to and as illustrated in the accompanying drawings. The invention relates to a data carrier having a semiconductor chip (5) with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (hR1R, hR1R2) generates either the output data (y) of the undisguised operation (h) or disguised output data (y ® R2) from which the output data (y) can be determined.

Full Text

-1 -
A DATA CARRIER HAVING A SEMICONDUCTOR CHIP
The present invention relates to a data carrier having a semiconductor chip in which secret data are stored. The invention relates in particular to a smart card.
Data carriers containing chips are used in a great number of different applications, for example for performing monetary transactions, paying for goods or services, or as an identification means for access or admission controls. In all said applications the data carrier chip normally processes secret data which must be protected from access by unauthorized third parties. Said protection is ensured by, among other things, giving the inner structures of the chip very small dimensions so that it is very difficult to access said structures with the aim of spying out data processed in said structures. In order to impede access further, one can embed the chip in a very firmly adhering compound whose forcible removal destroys the semiconductor plate or at least the secret data stored therein. It is also possible to provide the semiconductor plate during its production with a protective layer which cannot be removed without destroying the semiconductor plate.
With corresponding technical equipment, which is extremely expensive but nevertheless fundamentally available, an attacker could possibly succeed in exposing and examining the inner structure of the chip. Exposure could be effected for example by. special etching methods or a suitable grinding process. The thus exposed structures of the chip, such as conductive paths, could be contacted with micro-probes or examined by other methods to determine the signal patterns in said structures. Subsequently, one could attempt to determine from the detected signals secret data of the data carrier, such as secret keys, in order to use them for purposes of manipulation. One could likewise attempt to selectively influence the signal patterns in the exposed structures via the microprobes.
The invention is based on the problem of protecting secret data present in the chip of a data carrier from unauthorized access.

-1A-
Accordingly, the present invention provides a data carrier having a semiconductor chip with at least one memory containing an operating program which is able to execute at least one operation (h), the execution of the operation (h) requiring input data (x) and the execution of the operation (h) generating output data (y), characterized in that: the operation (/?) is disguised before its execution, the disguised operation (h^) is executed with disguised
input data (x Ri), and the disguising of the operation {h) and the input data (x) is coordinated such that the execution of the disguised operation (/?/?,) with
disguised input data (x 0 Ri) yields output data (y) identical with the output data (y) determined upon execution of the undisguised operation (h) with undisguised input data (x).
The present invention also provides a data carrier having a semiconductor chip with at least one memory containing an operating program which is able to execute at least one operation (h), the execution of the operation (h) requiring input data (x) and the execution of the operation {h) generating output data (y), characterized in that: the operation (h) is disguised before its execution, the disguised operation {h^) is executed with disguised
input data (x Ri), the disguising of the operation (h) and the input data (x) is coordinated such that the execution of the disguised operation {hRi^) with
disguised input data (x Ri) yields output data (y R2) which are disguised relative to the output data (y) determined upon execution of the undisguised operation (/?) with undisguised input data (x), and the undisguised output data
(y) can be determined from the disguised output data (y R2) with the aid of data {R2) used for disguising the operation {h).
The inventive solution does not aim, like the prior art, at preventing exposure of the internal structures of the chip and the mounting of microprobes. Instead

- 2 -
measures arc taken to make it difficult for a potential attacker to infer secret information from any signal patterns intercepted. Said measures consist according to the invention in manipulating security-relevant operations so that the secret data used in performing said security-relevant operations cannot be determined without including further secret information. For this purpose the security-relevant operations are disguised or falsified with the aid of suitable functions before execution. In order to impede or even prevent in particular a statistical evaluation in case of multiple execution of the security-relevant operations, a random component enters into the disguising function. As a result, an attacker cannot determine the secret data from any data streams intercepted.
The security-relevant operation will be represented in the following by function h mapping input data x on output data^, i.e. y = h{x). To prevent secret input data x from being spied out the invention provides for disguised function hR\tn to be determined, so that the following holds:
y®R2 = hRlR2(x®Rl),
The security-relevant operation is now performed by means of disguised function hRiK2 whose input data are not authentic secret data JC but disguised secret data x ® Ri generated by combining authentic secret data x with random number R\. Without knowledge of random number R\ one cannot determine authentic secret data x from disguised secret data x ® R\. As a result of applying disguised function hum to disguised secret data x ® /?f one obtains disguised output dataj & R2. From -disguised output datay R2 one can determine output data y by suitable combination. Before each new execution of the security-relevant function one can preset new random numbers R{ and R2 from which new disguised function hmn *s determined in each case. Alternatively, a plurality of disguised functions hRiia can be permanently stored, one of which is selected randomly before execution of the security-relevant operation. It is especially advantageous to use two functions hHi#2 and hftw* random numbers R\' and /?/ being the inverse values of random numbers R] and R2 with respect to the type of combination selected for disguising. In a further variant, random numbers R{ and R2 can also be identical. In particular, random num-

-3-
bers Hi and R2 can be selected statistically independently so that there is no correlation between input and output data which can be used for an attack.
If further operations are executed before or after security-relevant operation h in question here, random numbers Rx and R2 can also be used for disguising the data processed with the further operations.
The inventive solution can be used especially advantageously for security-relevant operations containing nonlinear functions. With nonlinear functions one cannot apply known protective measures based on disguising the secret data before execution of the functions. Known protective measures presuppose that the functions are linear with respect to the disguising operations so that disguising can be undone after execution of the functions. In the inventive solution, however, not only the secret data are falsified or disguised but also the security-relevant operations processing the secret data. The disguising of the secret data and the security-relevant operations is coordinated such that the authentic secret data can be derived from the disguised secret data after execution of the security-relevant operations. Coordination between disguising of the secret data and the security-relevant operations can be realized especially simply if the security-relevant operations are realized in the form of tables, so-called lookup tables. In the stated tables each input value x has output value y associated therewith. The functions realized by the tables are executed by looking up output values y belonging to particular input values x.
The invention will be explained below with reference to the embodiments shown in the figures, in which:
Fig. 1 shows a smart card in a top view,
Fig. 2 shows a greatly enlarged detail of the chip of the smart card shown in Fig. 1 in a top view.
Figs. 3a, 3b, 3c and 3d show representations of lookup tables.
Fig. 1 shows smart card 1 as an example of the data carrier. Smart card 1 is composed of card body 2 and chip module 3 set in a specially provided gap in card body 2. Essential components of chip module 3 are contact surfaces 4 for producing an electric connection with an external device, and chip 5 electrically connected with contact surfaces 4. As an alternative or in addition to contact surfaces 4, a coil not

- 4 -
shown in Fig, 1 or other transfer means can be present for producing a communication link between chip 5 and an external device.
Fig, 2 shows a greatly enlarged detail of chip 5 from Fig, 1 in a top view. The special feature of Fig. 2 is that it shows the active surface of chip 5, ie. it does not show all layers generally protecting the active layer of chip 5. In order to obtain information about die siipial patterns in the interior of the chip one can for example contact exposed structures 6 with microprobes. Microprobes are very thin needles which are brought in electric contact with exposed structures 6, for example conductive paths, by means of a precision positioning device. The signal patterns picked up by the microprobes are processed wife suitable measuring and evaluation devices with the aim of inferring secret data of the chip.
The invention makes it very difficult or even impossible for an attacker to gain access to in particular secret data of the chip even if he has managed to remove the protective layer of chip 5 without destroying the circuit and to contact exposed structures 6 of chip 5 with microprobes or intercept then? in some other way. The invention is of course also effective if an attacker gains access to the signal patterns of chip 5 is another way-Figures 3a, 3b, 3c and 3d show simple examples of lookup tables in which the input and output data each have a length of 2 bits. All table values are represented as binary data. The first line states input data JC, and the second line output data^ associated therewith in the particular column.
Figure 3a shows a lookup table for undisguised function k. Figure 3a indicates that input value x = 00 has output value h(x)-0l associated therewith, input value 01 output value 11, input value 10 output value 10, and input value 11 output value 00. The lookup table according to Figure 3a represents nonlinear function h which is to be executed within the framework of a security-relevant operation. According to the invention, however, one does not use the lookup table shown in Figure 3a itself in executing the security-relevant operation, but derives a disguised lookup table from said lookup table according to Figures 3b, 3c and 3d.
Figure 3b shows an intermediate step in determiBirtg the disguised lookup table. The lookup table according to Figure 3b was generated from die lookup table

- J) -
according to Figure 3a by EXORing each value of the first line of the table from Figure 3a with random number Ri * 11. Thus, EXORing the value 00 of the first line and first column of the table from Figure 3a with the number 11 yields the value 11, which is now the element of the first line and first column of the table of Figure 3b. The remaining values of the first line of the table shown in Figure 3b are determined accordingly from the values of the first line of the table shown in Figure 3a and random number Rx - 11, The table shown in Figure 3b could already be used as a disguised lookup table for processing secret data likewise disguised with random number R\ = 11. The result would be the plaintext values to be read in line 2 of the table from Figure 3b.
One usually arranges the individual columns of a lookup table according to ascending input data x. A table determined by accordingly sorting the table in Figure 3b is shown in Figure 3c.
If me table according to Figure 3c is to be disguised further or yield as output values likewise disguised values rather than plaintext values, one applies a further EXOR operation with further random number R2.
Figure 3d shows the result of applying said further EXOR operation. In said operation the elements of the second line of the table according to Figure 3c are each EXORed with random number R2 ~ 10. The element in the second line and the first column of the table according to Figure 3d thus results from EXORing the element in the second line and first column of the table according to Figure 3c with random , number R2 =* 10. The further elements of the second line of the table according to Figure 3d are formed accordingly. The first line of the table according to Figure 3d is adopted by Figure 3 c unchanged.
With the table shown in Figure 3d one can determine likewise disguised output data from disguised input data. The thus determined disguised output data can be supplied to further operations for processing disguised data or one can determine plaintext data therefrom by EXORing with random number R2 = 10.
Use of the table shown in Figure 3d makes it possible to perform nonlinear operations with disguised secret data and protect said secret data from unauthorized access. The security-relevant operations themselves are still also protected from un-

6-
authorized access since differently disguised functions can be used at every execution of the operations and the security-relevant operations themselves cannot be inferred even if the disguised functions could be determined. After conversion to plaintext, however, both the original security-relevant operations and the operations performed with the aid of disguised functions yield identical results. For example, input value 00 yields output value 01 according to the table in Figure 3a. In order to check whether the disguised table shown in Figure 3d yields the same output value one must first EXOR input value 00 with random number Ri - 11. As a result of said combination one obtains the value 11. According to the table from Figure 3d, input value 11 likewise yields output value 11. In order to determine the plaintext from said output value one must EXOR the output value with random number i?2 ~ 10. As a result of said combination one obtains the value 01 which exactly matches the value determined with the aid of the table shown k Figure 3a.
Disguising the security-relevant operations or the input values can be effected not only by EXORing but also by other suitable types of combination, for example modular addition. Furthermore, the invention is not limited to the application of nonlinear functions represented by means of lookup tables. One can also use any nonlinear and even linear functions for which a suitable disguised function can be determined.

-7-
WE CLAIM :
1. A data carrier having a semiconductor chip (5) with at least one memory
containing an operating program which is able to execute at least one operation
(h), the execution of the operation (h) requiring input data (x) and the execution
of the operation (h) generating output data (y), characterized in that:
- the operation (/?) is disguised before its execution,
- the disguised operation (h^) is executed with disguised input data
(x ® Ri), and
- the disguising of the operation (h) and the input data (x) is coordinated
such that the execution of the disguised operation (/?RI) with disguised input
data (x (8) Ri) yields output data (y) identical with the output data (y) determined upon execution of the undisguised operation (/?) with undisguised input data (x).
2. A data carrier as claimed in claim 1, wherein at least one random
number (Ri) enters into the determination of the disguised operation (fo?i) and
the disguised input data (x ® Ri).
3. A data carrier as claimed in any of claims 1 or 2, wherein the
determination of the disguised operation (/7RI) and the disguised input data
(x Ri) is effected with the aid of EXOR operations.
4. A data carrier as claimed in any of claims 1 to 3, wherein the disguised
operation (h^) is permanently stored in the data carrier in advance.
5. A data carrier as claimed in claim 4, wherein at least two disguised
operations (/JRI, hm) are permanently stored in the data carrier in advance and
one of the stored disguised operations (/?RI, tiRr) is selected randomly when a
disguised operation is to be executed.

-8-
6. A data carrier as claimed in any of claims 1 to 3, wherein the disguised
operation (/7R1) is recalculated before its execution and the at least one random
number (RA) is determined for such calculation.
7. A data carrier as claimed in any of claims 1 to 6, wherein the operation
(h) is realized by a table stored in the data carrier which establishes an
association between the input data (x) and the output data (y).
8. A data carrier as claimed in claim 7, wherein the disguising of the input
data (x) contained in the table is effected by combination with the at least one
random number (R,).
9. A data carrier having a semiconductor chip (5) with at least one memory
containing an operating program which is able to execute at least one operation
{h), the execution of the operation (h) requiring input data (x) and the execution
of the operation (h) generating output data (y), characterized in that:

- the operation (h) is disguised before its execution,
- the disguised operation (hR1) is executed with disguised input data
(x ® ft),
- the disguising of the operation (h) and the input data (x) is coordinated
such that the execution of the disguised operation (h^Rz) with disguised input
data (x Ri) yields output data (y R2) which are disguised relative to the output data (y) determined upon execution of the undisguised operation (h) with undisguised input data (x), and
- the undisguised output data (y) can be determined from the disguised
output data (y R2) with the aid of data (R2) used for disguising the operation

-9-
10. A data carrier as claimed in claim 9, wherein at least one random
number (Ri) enters into the determination of the disguised input data (x ® R,)
and at least two random numbers (Ri, R2), enters into the determination of the
disguised operations (/fare)-
11. A data carrier as claimed in claim 9 or 10, wherein the determination of
the disguised operation (hmR2) and the disguised input data (x Ri) is effected with the aid of EXOR operations.
12. A data carrier as claimed in any of claims 9 to 11, wherein the disguised
operation (tiRim) is permanently stored in the data carrier in advance.
13. A data carrier as claimed in claim 12, wherein at least two disguised
operations (hR1R2, hRvRz) are permanently stored in the data carrier in advance
and one of the stored disguised operations (/fare, hRiv&) is selected randomly
when a disguised operation is to be executed.
14. A data carrier as claimed in claim 13, wherein the random numbers (Ri,
R2) for determining the first disguised disguised operation (hmm) are inverse to
the random numbers (RV, R2') for determining the second disguised operation
(hm'Rr) with respect to the combination used for determining the disguised
operations (hmR2, hmm).
15. A data carrier as claimed in any of claims 9 to 11, wherein the operation (
hm/a) is recalculated before its execution and the random numbers (Ri, R2) are
redetermined for said calculation.

-10-
16. A data carrier as claimed in any of claims 9 to 15, wherein the operation (
h) is realized by a table stored in the data carrier which establishes an
association between the input data (x) and the output data (y).
17. A data carrier as claimed in claim 16, wherein the disguising of the input
data (x) contained in the table is effected by combination with the at least one
random number (Ri) and the disguising of the output data (y) contained in the
table is effected by combination with the at least one further random number
(R2).
18. A data carrier as claimed in any of claims 1 to 17, wherein the operation (
h) is a non-linear operation with respect to the combination used for disguising
the operation (/?).
19. A data carrier having a semiconductor chip, substantially as herein
described, particularly with reference to and as illustrated in the accompanying
drawings.
The invention relates to a data carrier having a semiconductor chip (5) with at least one memory. The memory contains an operating program that is able to perform at least one operation (h). In order to prevent unauthorized access to the data (x) processed with the operation (h), both said data and the operation (h) itself are disguised. The disguising of the data (x) and the operation (h) is coordinated such that the disguised operation (hR1R, hR1R2) generates either the output data (y) of the undisguised operation (h) or disguised output data (y ® R2) from which the output data (y) can be determined.

Documents:

« Previous Patent

Next Patent »

Patent Number

202614

Indian Patent Application Number

IN/PCT/2001/00190/KOL

PG Journal Number

09/2007

Publication Date

02-Mar-2007

Grant Date

02-Mar-2007

Date of Filing

15-Feb-2001

Name of Patentee

GIESECKE & DEVRIENT GMBH

Applicant Address

PRINZREGENTENSTRASSE 159, D-81677, MUNCHEN, GERMANY

Inventors:

#	Inventor's Name	Inventor's Address
1	VATER HARALD	AN DEN SCHULGARTEN 23 D-35398 GIESSEN GERMANY
2	DREXLER HERMANN	OBERLANDERSTRASSE 5A, D-81371, MUNCHEN GERMANY

PCT International Classification Number

G 06 F 12/14

PCT International Application Number

PCT/EP99/06580

PCT International Filing date

1999-09-07

PCT Conventions:

#	PCT Application Number	Date of Convention	Priority Country
1	198 41 676.8	1998-09-11	Germany