NFC "sub-stack" architecture with tamper-resistant wireless interface controller

Abstract

A device for processing a wireless interface communication type application includes: a host controller circuit that processes a device application and a host driver that communicates wired based on a first interface protocol; a wireless interface controller circuit processing a wireless interface and a controller driver in wired communication with the host controller circuit; wherein the host controller circuit processes a first transport module in wired communication with the host driver based on a first interface protocol and in wired communication with the controller driver based on a second interface protocol, the device comprises a secure element circuit for storing secure application or key information and comprising a direct hardware connection with a wireless interface controller circuit, the wireless interface controller circuit comprising a boot loader circuit, the wireless interface controller circuit is configured to request a controller firmware stack stored in the secure element circuit to be transmitted into a memory of the wireless interface controller circuit for processing by the wireless interface controller circuit to implement a contactless interface of the wireless interface communication type.

Description

Technical Field

[0001] The present invention relates to a device configured to handle applications of a wireless interface communication type. The device includes: a host controller circuit configured to handle device applications using a wireless interface communication type application and configured to handle a host driver for wired communication based on a first interface protocol; a wireless interface controller circuit configured to handle a wireless interface for a wireless interface communication type application and configured to handle a controller driver for wired communication with the host controller circuit; and wherein the host controller circuit is configured to handle a first transmission module that communicates with the host driver over a wired connection based on the first interface protocol and communicates with the controller driver over a wired connection based on a second interface protocol.

[0002] The present invention also relates to a chipset for such a device and a method of handling an application of a wireless interface communication type with such a device. Background Art

[0003] Document US2009 / 0206984 A1 discloses such a device, such as a mobile phone having a Near Field Communication (NFC) function, as an example of an application of a wireless interface communication type. Other applications of a wireless interface communication type may be Ultra Wide Band or or other similar technologies. NFC technology was developed by an industry consortium named NFC Forum (http: / / www.nfc-forum.ofg) and is derived from RFID technology. NFC components can operate in "reader", "card emulation", and "device" modes standardized by ISO 18.092. NFC components emit a magnetic field through their near field communication contactless interface, send data by modulating the amplitude of the magnetic field, and receive data by load modulation and inductive coupling. In the emulation mode described, for example, in EP 1 327222, the NFC component operates passively like a transponder to communicate with another reader and is regarded as an RFID chip by other readers.

[0004] The device disclosed in US2009 / 0206984 A1 includes a host controller circuit or a mobile phone processor, which processes all device applications related to normal phone functions. For example, these applications can answer calls, send text messages, or search the Internet. To add near field communication functionality to such a mobile phone, a separate integrated circuit called an NFC controller circuit (wireless interface controller circuit) has been added to such a mobile phone. The NFC Forum specification "NFC Controller Interface (NCI)" defines an interface protocol for implementing wired communication between the host controller circuit and the NFC controller circuit. The host controller circuit uses a software stack called a host driver to implement this NCI interface, and this software stack communicates with a software stack called a controller driver processed in the NFC controller circuit based on the NCI interface.

[0005] Figure 1 A typical setup of a host controller circuit 1 and an NFC controller circuit 2 showing the standard NFC architecture of a prior art device. Figure 2 A more detailed block diagram showing the functions processed within these two integrated circuits and within a smart card (UICC) connected to the NFC controller circuit 2 via a Single Wire Protocol. The device host of the host controller circuit processes device applications, and these device applications use near field communication applications that are processed partly in the device host and partly in the NCI-FW (stack) of the NFC controller circuit 2. The NCI-FW (stack) in this standard NFC architecture is capable of communicating with the host controller circuit 1 via the NCI interface that serves as a controller driver.

[0006] The disadvantage of this standard NFC architecture is the limited ability to update the part of the near field communication application processed in the NFC controller circuit 2. The NCI interface does not enable a simple and fast way for such wireless updates. In particular, in most cases, the NFC controller circuit 2 of a mobile phone manufacturer is a third-party integrated circuit, and the impact on the update of the firmware processed on the NFC controller circuit 2 is very limited. In addition, compared with the host controller circuit 1, the NFC controller circuit 2 only has limited storage space and processing power, which limits the possibility of enabling a large number of new payment applications from different credit card companies, for example.

[0007] The prior art document EP 3 160 165 B1 discloses a "split stack" architecture that moves non-time-critical and / or memory-consuming tasks or portions of near-field communication type applications from the NFC controller circuit to the host controller circuit. The time-critical and performance-critical tasks or portions of near-field communication type applications remain within the NFC controller circuit to ensure proper communication with the near-field communication contactless interface. In addition, the NFC controller circuit can also handle very limited other tasks, such as repetitive processes. Therefore, almost all of the software stack of near-field communication type applications resides within the host processor circuit, which is a fast processor with a large amount of storage resources and is directly connected to the device applications of the mobile phone through its telephone or WLAN data transmission functions to enable wireless updates of near-field communication type applications.

[0008] This "split stack" architecture is achieved by splitting the controller firmware of the standard NFC architecture into a split portion of the firmware that still resides in the NFC controller circuit, which is referred to as the controller firmware and has a greater hardware association with the hardware of the NFC controller circuit compared to the other split portion of the controller firmware of the standard NFC architecture that is moved to the host controller circuit. Compared with the NFC standard architecture, it is easier to update the firmware moved to the host controller circuit using the "split stack" NFC architecture because the update of the split portion of the firmware moved to the host controller circuit is completely controlled by the host controller circuit and can therefore be updated and checked independently of the NFC controller circuit.

[0009] The disadvantages of this known "split stack" architecture and this known NFC standard architecture are that the controller firmware stored in the NFC controller circuit is highly relevant to the secure transmission of payment or key information, such as opening a door or a safe. Hackers will attempt to manipulate this controller firmware to open this secure transmission through a so-called "man in the middle attack" and obtain information about secret payments or key information transmitted within a secure channel through the NFC interface. This results in a reduction in the security of such payment or key information during transmission from the mobile device via the NFC interface and the payment terminal to the server of the credit card company within the secure channel. Summary of the Invention

[0010] The object of the present invention is to provide a device and a chipset for such a device, as well as a method for processing wireless interface communication type applications, which has improved security against hacking attacks.

[0011] This object is achieved by the device according to claim 1, the chipset according to claim 7, and the method according to claim 8.

[0012] The claimed device or mobile device includes a secure element circuit for storing secure payment or key information, enabling for example an NFC payment application to make payments with the mobile device at a payment terminal in a store. To ensure improved security against hacking attempts to change the controller firmware / software stack to obtain the secure information, the claimed device includes a boot loader circuit as part of the wireless interface controller circuit, which at all times observes the integrity of the controller firmware stored in the memory of the wireless interface controller circuitry and processed by the wireless interface controller circuit. To achieve this, several related features of the present invention must be combined. First, there must be a direct hardware connection between the secure element circuit storing the controller firmware and the wireless interface controller circuit to ensure the preservation of information transfer through a direct wired interface. Second, the secure element circuit must store the approved correct controller firmware stack to prevent hackers from accessing the approved correct version of the controller firmware. Third, the boot loader circuit is configured to request the transfer of the controller firmware stack from the secure element circuit to the memory of the wireless interface controller circuit. This memory can be FLASH, RAM, ROM, or any other type of memory to enable the wireless interface controller circuit to process the stored controller firmware. During a startup routine immediately following the power-on of the wireless interface controller circuit, the boot loader circuit of the wireless interface controller circuit can send the request to transfer the controller firmware stack so that the wireless interface controller circuit can start its operation. The combination of all these features ensures that the powered-on wireless interface controller circuit always processes the approved and unmodified controller firmware to avoid any security issues during the transfer of other secure information stored in the secure element circuit.

[0013] The bootloader circuit can also take measures at any time after power-up during normal processing to ensure the integrity of the controller firmware being processed. These measures can include requesting from the secure element circuit a hash value or other similar integrity information regarding the controller firmware stack stored in the secure element circuit to compare it with the integrity information evaluated for the controller firmware actually processed by the wireless interface controller circuit. If the comparison of the received and evaluated integrity information provides a difference, the bootloader circuit can react in different ways. It can send a new request to transfer the controller firmware stack and replace the controller firmware actually processed and stored in the memory of the wireless interface controller circuit with the approved correct version received from the secure element circuit. The bootloader circuit in the same or another embodiment of the present invention can send information to the host controller via a wired interface or send information indicating a detected hack to another NFC device via an NFC wireless interface. In the same or other embodiments of the present invention, the device can be configured to implement other wireless interface communication type applications, such as ultra-wideband with a UWB controller or or other similar wireless technologies.

[0014] These and other aspects of the present invention will become apparent and be elucidated with reference to the embodiments described below. Those skilled in the art will understand that various embodiments can be combined. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 and Figure 2 show a standard NFC architecture in a device according to the prior art.

[0016] Figure 3 A block diagram is disclosed, Figure 4 showing a software module diagram of a "split-stack" NFC architecture in a device according to the prior art.

[0017] Figure 5 A detailed block diagram is disclosed of how a device with a "split-stack" NFC architecture according to the present invention processes near-field communication applications to simulate a smart card via a smart card as a secure element.

[0018] Figure 6 A more general block diagram is disclosed illustrating how a device with a "split-stack" NFC architecture and a bootloader circuit according to the present invention implements NFC and ultra-wideband interface communication type applications. DETAILED DESCRIPTION

[0019] Figure 1 and Figure 2 disclose the host controller circuit 1 and the NFC controller circuit 2 of a prior art mobile phone as described above. Figure 3A block diagram of a "split-stack" NFC architecture in a device according to the prior art is disclosed. The mobile phone 5 includes a host controller circuit 3 and an NFC controller circuit 2 having a non-contact interface 6. The mobile phone 5 includes various prior art modules (not shown in the figure) for processing device applications and implementing normal phone functions, such as making calls, sending text messages, or searching the Internet. The host controller circuit 3 is the main processor of the mobile phone 5, which masters all these tasks and interfaces with other integrated circuits of the mobile phone 5, such as the NFC controller circuit 2, to implement these other functions. Figure 4 A software module is disclosed Figure 4 , in which Figure 1 and Figure 2 the NFC standard architecture in the device disclosed in Figure 3 and the software module functions of the "split-stack" NFC architecture in the device 5 disclosed in

[0020] Figure 5 A mobile device 7 according to the present invention is disclosed, which is configured to process an NFC application as a wireless interface communication type application having a "split-stack" NFC architecture, and the mobile device 7 is configured to simulate a smart card having a secure element. To achieve this, the mobile device 7 includes a host controller circuit 8, which is configured to process device applications using the NFC application and is configured to process a host driver 9 for wired communication based on a first interface protocol, which is the NCI interface protocol defined by the NFC Forum.

[0021] The mobile device 7 further includes an NFC controller circuit 10, which is configured to process the wireless interface of the NFC application and is configured to process a controller soft driver 11 for wired communication with the host controller circuit 8. The NFC controller circuit 10 is an integrated circuit in the mobile device 7 for implementing the near field communication function, which is well known to those skilled in the art. The NFC technology is developed by an industry alliance named NFC Forum (http: / / www.nfc-forum.ofg) and is derived from RFID technology. The NFC controller circuit 10 is connected to an RFID antenna not shown in the figure and carries a non-contact interface to communicate with other NFC-enabled devices. The wireless NFC non-contact interface protocol is standardized in ISO 18.092, ISO14.443, ISO15.693, NFC Forum specifications, and EMVCo, and must be processed within a defined time frame. Other time-critical or performance-critical tasks include:

[0022] 1. Delay time / guard time, which means transmitting data neither too early nor too late.

[0023] 2. To reset the EMVCo timing of the operating field.

[0024] 3. NFC active mode collision avoidance.

[0025] 4. Timing for extended waiting time.

[0026] 5. Electromagnetic interference (EMD) handling.

[0027] In a "split-stack" NFC architecture, the NFC controller circuit 10 handles time-critical or performance-critical tasks to implement the NFC contactless interface protocol, which helps reduce the latency requirements of the host controller circuit 8.

[0028] The NFC Forum specification "NFC Controller Interface (NCI)" defines an interface protocol for implementing communication between the host controller circuit 8 and the NFC controller circuit 10. The host controller circuit 8 uses a software stack called the host driver 9 to implement the NCI interface, and this software stack communicates with a software stack called the controller driver 12 (NCI-FW (Stack)) based on the NCI interface, as Figure 5 shown, which is Figure 4 part of the Layer 4 protocol shown. The controller driver 12, which is part of the first transmission module 13, processes and implements the NCI interface. The controller driver 12 or other parts of the first transmission module 13 handle all non-time-critical and / or memory-consuming tasks of the near-field communication applications of the mobile phone 7. Typical near-field communication applications are, for example, card emulation applications or point-of-sale applications known to those skilled in the art.

[0029] The first transmission module 13 also includes a host soft driver 14 that communicates with the controller driver or the NFC controller soft driver 11 based on a second interface protocol. The NFC controller circuit 10 also includes a second transmission module 15 that handles all time-critical tasks of near-field communication type applications for the near-field communication type contactless interface. In addition to this, the second transmission module 15 can also handle repetitive tasks or tasks that affect the overall throughput time. As Figure 5 shown, the NFC controller circuit 10 also includes a logical link layer 16 for interfacing with the smart card 17 via a single-wire protocol.

[0030] As Figure 5As shown, compared with the NFC standard architecture, the advantage of the "split stack" NFC architecture of the host controller circuit 8 and the NFC controller circuit 10 is that the second transmission module 15 is only a relatively small software stack called controller firmware, which must be processed by the NFC controller circuit 10 to implement time-critical tasks or performance-critical tasks, thereby enabling near-field communication applications. All other non-time-critical tasks and memory- or data-consuming tasks of the near-field communication application are processed by the host controller 8 with high processing capabilities, sufficient memory space, and easy linkage with other functions of the mobile device 7 within the first transmission module 14.

[0031] Figure 5 One of the most important wireless interface communication type applications for the mobile device 7 is disclosed, which processes near-field communication applications to simulate a smart card through the UICC as a security element. Figure 5 The way to set up the UICC on the HCI is shown. To allow card emulation through the UICC, a connection through the HCI network needs to be established. This is accomplished through the HCI host implementation in the host controller circuit 8. The physical connection of the smart card 17 (usually a single-wire protocol SWP) and the logical link layer 18 are time-critical tasks of the near-field communication application and are thus processed on the NFC controller circuit 10.

[0032] The mobile device 7 includes a security element circuit 19 to store security applications or key information (only as a few examples). Those skilled in the art know the terms of the security element and the security measures for protecting the information stored therein, and this security information can cover all other types of information that the application wants to protect, such as Figure 5 and Figure 6 As shown. The security element circuit 19 includes a direct hardware connection 20 to the NFC controller circuit 10. Only as a few examples, this wired hardware connection 20 can be implemented through a single-wire protocol or a serial peripheral interface bus or an I2C bus or an I3C bus. The security element circuit 19 can be implemented as a separate integrated circuit as shown in Figure 5 and Figure 6 As shown, or can also be implemented as a part of the host controller circuit 8.

[0033] The NFC controller circuit 10 of the mobile device 7 further includes a bootloader circuit 21 configured to request transmission of a stack of controller firmware 22 stored in the secure element circuit 19. The stack of the controller firmware 22 has been stored in a secure and approved manner during the manufacturing process of the mobile device 7, or during the user's initial setup in a secure environment, or during any other process that ensures that the controller firmware 22 is the approved and correct software version to be processed in the controller soft driver 11. After receiving the request to transmit the controller firmware 22, the application processor 23 of the secure element circuit 19 transmits the controller firmware 22 to the memory of the controller soft driver 11 through the wired hardware connection 20 and the bootloader circuit 21, and the controller soft driver 11 processes the transmitted approved controller firmware 22 to implement the NFC contactless interface of the NFC controller circuit 10. These measures ensure that the NFC controller circuit 10 always processes the approved controller firmware 22, and prevent hackers from manipulating the controller firmware 22 processed by the controller soft driver 11, or using such manipulation as a door to enter the secure channel to steal secure information. Such man-in-the-middle attacks have been used, for example, to steal information about credit card accounts stored in the secure element circuit of the prior art during the processing of NFC applications for payment at a payment terminal while transmitting the information through a generally secure channel.

[0034] The bootloader circuit 21 is configured to request transmission of the stack of the controller firmware 22 immediately after power-on during the boot routine, which ensures that after each power-on of the mobile device 7, the approved controller firmware 22 is loaded into the memory of the controller soft driver 11 and processed by the controller soft driver 11. Therefore, any operations that may have occurred before power-off are deleted each time the mobile device 7 is powered on. In addition, to improve security, the bootloader circuit 21 can request another transmission of the controller firmware 22 from the secure element circuit 19 at any time during normal processing to ensure the integrity of the processed controller firmware.

[0035] In another embodiment of the present invention, the bootloader circuit 21 is configured to process the integrity verification of the controller firmware stored in the memory of the controller soft driver 11 and processed by the controller soft driver 11 with the approved correct controller firmware 22 stored in the secure element circuit 19. This integrity verification may include requesting from the secure element circuit 19 a hash value or other similar integrity information of the stack of the controller firmware 22 stored in the secure element circuit 19 to compare it with the integrity information evaluated from the controller firmware actually processed by the controller soft driver 11. In the case where the comparison of the received and evaluated integrity information provides a difference, the bootloader circuit 21 may react in a different manner. It may send a new request to transfer the controller firmware stack 22 and replace the actually processed controller firmware stored in the memory of the controller soft driver 11 with the approved correct version received from the secure element circuit 19. In this or another embodiment of the present invention, the bootloader circuit 21 may send information to the host controller 8 through the wired hardware connection 20, or send information indicating an identified hack to another NFC device through the NFC wireless interface.

[0036] Figure 6 A more general block diagram is disclosed illustrating how a mobile device 24 having a "split-stack" NFC architecture and a bootloader circuit 21 according to the present invention can implement NFC wireless applications and ultra-wideband interface communication type applications. The same reference numerals have been added to the blocks described in detail. The memory 25 is used to store the stack of the controller firmware in the NFC controller circuit 10. In addition to the NFC wireless interface of the mobile device 7, as described with respect to Figure 5 the detailed block. Figure 5As described, the mobile device 24 also implements an ultra-wideband wireless interface and applications of the mobile device 24 using this wireless interface. To achieve this, the host controller 8 of the mobile device 24 includes a UWB controller driver 26, which processes and implements the UWB interface in the host controller 8. The first interface protocol processed for communication between the host driver 9 and the UWB controller driver 26 is the UCI defined by the FiRa Consortium, which is known to those skilled in the art. The UWB controller circuit 27 processes all time-critical tasks for UWB communication type applications of the UWB type non-contact interface. The secure element circuit 19 stores the stack of the UWB controller firmware 28, and the bootloader circuit 29 of the UWB controller circuit 27 is configured to request the transfer of the UWB controller firmware 28 to the memory 30 of the UWB controller circuit 27 for processing by the UWB controller soft driver 31. The secure element circuit 19 and the UWB controller circuit 27 are directly hardware-connected through a serial peripheral interface bus 32. All these measures ensure that the UWB controller circuit 27 always processes the approved UWB controller firmware 28 and prevent hackers from manipulating the UWB controller firmware 28 processed by the UWB controller soft driver 31 and using this manipulation as a door to enter the secure channel to steal security information.

[0037] In the above embodiments of the present invention, the mobile devices 7 and 24 process a method having the following operations:

[0038] · Process a first transmission module having a host controller circuit for wired communication with a host driver based on a first interface protocol and for wired communication with a controller driver based on a second interface protocol;

[0039] · Request the transfer of the stack of the controller firmware stored in the secure element circuit to the memory of the wireless interface controller circuit;

[0040] · Use the wireless interface controller circuit to process the transferred and stored controller firmware to implement a non-contact interface of the wireless interface communication type.

[0041] This method can achieve the advantages explained above regarding the embodiments of the present invention.

[0042] It can be said that the devices for processing near-field communication type applications can be not only mobile phones, but also other mobile devices, wearable devices, and IoT devices. The disclosed invention is advantageous for devices for processing near-field communication applications, but also for devices using wireless applications of a similar type.

[0043] Furthermore, it can be said that the NFC controller circuit can be implemented by a microprocessor or an application-specific integrated circuit.

[0044] In other embodiments of the present invention, a special method is implemented for loading controller firmware into the secure element circuit in a secure and approved manner.

Claims

1. A device (7; 24) configured to handle applications of a wireless interface communication type, the device (7; 24) comprising: A host controller circuit (8) configured to handle device applications using the wireless interface communication type and a host driver (9) configured to handle wired communication based on a first interface protocol (NCI, UCI); A wireless interface controller circuit (10; 27) configured to handle the wireless interface for the wireless interface communication type and a controller driver (11; 31) configured to handle wired communication with the host controller circuit (8); And wherein the host controller circuit (8) is configured to handle a first transmission module (13) that communicates wired with the host driver (9) based on the first interface protocol (NCI, UCI) and communicates wired with the controller driver (11; 31) based on a second interface protocol (I2C, SPI, I3C), characterized in that The device (7; 24) comprises a security element circuit (19) for storing security applications or key information, the security element circuit (19) comprising a direct hardware connection (20; 32) to the wireless interface controller circuit (10; 27), and wherein the wireless interface controller circuit (10; 27) comprises a bootloader circuit (21; 29) configured to request transfer of a stack of controller firmware (22; 28) stored in the security element circuit (19) to a memory (25; 30) of the wireless interface controller circuit (10; 27) for processing by the wireless interface controller circuit (10; 27) to enable a contactless interface of the wireless interface communication type.

2. The device (7; 24) according to claim 1, wherein the bootloader circuit (21; 29) is configured to request transfer of the stack of the controller firmware (22; 28) immediately after power-on during a boot routine or at any time during normal processing to ensure integrity of the processed controller firmware.

3. The device (7; 24) according to claim 1 or 2, wherein the bootloader circuit (21; 29) is configured to use the controller firmware (22; 28) stored in the security element circuit (19) to handle integrity verification of the controller firmware stored in and processed by the memory (25; 30) of the wireless interface controller circuit (10; 27).

4. The device (7; 24) according to any one of claims 1 to 3, wherein the wireless interface communication type application is implemented as a near field communication type application and wherein the first interface protocol (NCI) is the "NFC Controller Interface (NCI)" specified in the NFC Forum specification.

5. The device (24) according to any one of claims 1 to 4, wherein the wireless interface communication type application is implemented as an ultra-wideband type application, and wherein the first interface protocol is "UCI" specified by the FiRa Consortium.

6. The device according to any one of claims 1 to 5, wherein the first interface protocol is the "EMV Contactless Specification for Payment Systems" based on ISO / IEC 7816 and ISO / IEC 14.443 or another proprietary interface protocol.

7. A chipset for a device (7; 24) for handling applications of wireless interface communication types, characterized in that, The chipset includes the host controller circuit (8) and the wireless interface controller circuit (10; 27) as described in claims 1 to 6.

8. A method of processing a wireless interface communication type application using a device (7; 24), the device (7; 24) comprising: A host controller circuit (8) that processes device applications using the wireless interface communication type application and a host driver (9) that performs wired communication based on a first interface protocol (NCI, UCI); A wireless interface controller circuit (10; 27) that processes the wireless interface for the wireless interface communication type application and a controller driver (11; 31) that performs wired communication with the host controller circuit (8); and A secure element circuit (19) directly hardware-connected (20; 32) to the wireless interface controller circuit (10; 27) for storing secure applications or key information, which processes the following operations: · Processing a first transmission module (13) using the host controller circuit (8) to perform wired communication with the host driver (9) based on the first interface protocol (NCI, UCI) and perform wired communication with the controller driver (11; 31) based on a second interface protocol (I2C; SPI, I3C); · Requesting the transfer of the stack of controller firmware (22; 28) stored in the secure element circuit (19) to the memory (25; 30) of the wireless interface controller circuit (10; 27); · Processing the transmitted and stored controller firmware using the wireless interface controller circuit (10; 27) to implement a contactless interface of the wireless interface communication type.

9. The method according to claim 8, wherein the following operations are processed: · Requesting the transfer of the stack of controller firmware (22; 28) immediately after power-on during a startup routine or at any time during normal processing to ensure the integrity of the processed controller firmware.

10. The method according to claim 8 or 9, wherein the following operations are processed: · Processing the integrity verification of the controller firmware stored in the memory (25; 30) of the wireless interface controller circuit (10; 27) and processed by the wireless interface controller circuit (10; 27) using the controller firmware (22; 28) stored in the secure element circuit (19).

11. The method according to any one of claims 8 to 10, wherein the following operations are processed: · Treat the "NFC Controller Interface (NCI)" specified in the NFC Forum specification as the first interface protocol (NCI).

12. The method according to any one of claims 8 to 10, wherein the following operations are performed: · Treat the UCI specified by the RiFa Consortium as the first interface protocol (UCI).

Images