Smart Card Memory Partitioning and Dynamic Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smart-card devices face challenges in preventing unauthorized overwriting of data stored in integrated memory while allowing authorized updates, due to limited storage capacity and the need for secure protection of sensitive information.
Innovation Solution
A system comprising a smart-card device and a separate memory device connected through a controller, where the memory is partitioned into read-only and user-accessible sections, with authentication levels and a cryptography engine for secure data management and updates, allowing authorized access and protection against unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the smart-card device uses integrated memory with limited capacity, then the device remains compact and cost-effective, but the storage capacity is insufficient for larger applications and data
Solution Approach 1:
The memory storage function is segmented between the smart-card device's integrated memory and a separate external memory device. The external memory device is packaged with the smart-card device and coupled to it, allowing the smart-card device to access larger storage capacity without increasing its own integrated memory size. This segmentation resolves the contradiction by providing extended storage capacity while maintaining the compact integrated circuit structure of the smart-card device itself.
2Reliability
If the memory is made read-only to protect data from overwriting, then data protection is improved, but the ability to update critical data is lost
Solution Approach 1:
The memory protection mechanism is made dynamic through authentication levels. The system can transition between different access states: read-only mode for normal operation to protect data, and read-write mode when authentication succeeds to allow authorized updates. This dynamic access control resolves the contradiction by providing both data protection and update capability depending on the authentication state.
Solution Approach 2:
An authentication mechanism acts as an intermediary between data protection requirements and data update needs. The authentication system verifies user credentials and determines whether to grant read-only or read-write access to the memory. This intermediary layer enables the system to maintain data protection while allowing authorized updates when needed.
3Quantity of substance
If the smart-card device includes separate non-volatile memory device, then storage capacity is improved, but the device size and cost increase
Solution Approach 1:
The external memory device is packaged with the smart-card device, creating a nested configuration where the memory device is integrated into the same physical package. This nesting approach allows the smart-card device to access extended storage capacity through the coupled external memory device without significantly increasing the overall device footprint or weight, as both components share the same packaging envelope.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A storage device contains smart-card device and memory device, both connected to a controller. The storage device may be used in the same manner as a conventional smart-card device, or it may be used to store a relatively large amount of data in various partitions. One of these partitions may be a read-only partition that is normally accessible only for read accesses. However, it may sometimes be necessary to update or supplement the data stored in the read-only partition. This is accomplished by a host issuing an appropriate command to the storage device, which may be accompanied by an identifier for an appropriate level of authorization. The controller then changes the attribute of the read-only partition from "read-only" to "read/write" to allow data to be written to the partition. Upon completion, the controller changes the attribute of the partition back to read-only.