DE19738990A1 - Misuse protection device for chip card security system - Google Patents

Abstract

The misuse protection device uses a capacitive device (4) incorporated in the protective dielectric covering (3) for the semiconductor chip (2) incorporated in the chip card (1). The capacitance value of the capacitance in which is incorporated within the chip, for releasing the card function only when the capacitance value is correct.

Description

The use of chip cards, particularly in the security sector chen is growing rapidly, and the features that these cards transmitted are more and more a risk for the patient Abuse can cause great damage and must therefore be switched off if possible.

The invention has for its object to show how a chip card can be effectively protected against misuse can.

This object is achieved by a device for protection against misuse of a chip card, which has the features specified in the characterizing part of claim 1, ie

• - A chip provided on the card by an Abdec protection from a dielectric against external influences is
• - A capacitance arrangement formed in the cover, the has a chip specific capacity value, and
• - A trained in the chip and to the capacity arrangement coupled circuit device for repeatable sampling the capacity value of the capacity arrangement and generation at least one signal to release a function of the card only if the scanned capacity value with the chip specific capacity value.

In the device according to the invention there is an abuse through chip manipulation through a sensitive capacity scan on the capacitance arrangement in the covering the chip Cover made of dielectric switched off.

Capacity arrangement means in the A according to the invention direction any electrical conductor arrangement that has a capacitance  with a certain fixed capacitance value C = Q / U, where Q is the electrical charge and U is the electrical Are tension.

The capacitance arrangement preferably and advantageously has one formed in the cover of dielectric and in electrically conductive arranged at a distance from the chip Layer on (claim 2), which is preferably over the gan Zen chip extends (claim 3).

In an advantageous embodiment of the invention The capacity arrangement has at least one device the cover made of dielectric further elek trically conductive layer that is at a distance from the chip arranged and electrically insulated from one layer (Claim 4), and which are preferably all over the chip extends (claim 5). These layers form a whole in the cover trained capacitance arrangement, which in the In the event that the layers extend over the entire chip, is distributed over the entire chip. With a simple Ausge Setting the device according to the invention is the capaci order, the capacity value of which is to be sampled, only from such electrically conductive layers in the cover Dielectric.

It is with a view to strengthening protection against Chip manipulation cheap, if at least one electrically lei layer in the cover is irregularly structured (Claim 6) to an irregular capacity arrangement in of the cover.

The device according to the invention can also be designed in this way be that at least one electrically conductive layer is provided hen that is on a surface covered by the cover che of the chip is formed (claim 7).  

A preferred and advantageous embodiment of a Direction according to claim 7 is designed so that on the Surface of the chip a layer arrangement of at least two electrically conductive layers is formed between de NEN there is a dielectric (claim 8). The layer arrangement forms its own capacity arrangement. One on the surface of the chip formed electrically conductive Layer or layer arrangement according to claim 7 or 8 can of that of one or more of the electrically conductive layers ten existing capacity according to one of claims 2 to 6 arrangement be electrically isolated, which in this case the the only capacity arrangement is to deduct its capacity value is most. On the other hand, the layer arrangement can be the only one Capacitance arrangement of the invented trained in the cover according to the invention, the capacity value of which is to be deducted is most. However, it is preferred and advantageous electrically conductive layer or layer arrangement according to An say 7 or 8 with the layer or layers according to one of the An sayings 2 to 6 interconnected so that they together the Form the capacity order to deduct its capacity value stenist. In any case, it is useful if the capacity is order, the capacity value of which is to be sampled, at least one electrically conductive formed on the surface of the chip Has layer (claim 9).

A preferred and advantageous embodiment of the device device according to one of claims 7 to 9 is designed such that an electrically formed on the surface of the chip conductive layer is irregularly structured and at least an output terminal of the circuit device for delivery a signal to release a function of the card (Claim 10). This is advantageously a flat Covering one or more output connections of the scarf device for the respective delivery of a signal for Enable a function of the card with the irregular structure tured layer on the surface of the chip and thus to Allows securing of these output connections.  

Irregularly structured generally means irregular Longitudinal and / or transverse dimensions and / or irregular dic ke of the layer concerned.

In a particularly preferred and advantageous fiction modern facility are the measures according to claim 8, 9 and 10 combined with each other such that the layer arrangement at least two adjacent electrically conductive layers points, which are structured interlocking, the Layer arrangement at least one outlet connection of the scarf device for emitting a signal to release a Function of the card covers (claim 11).

That two neighboring but electrically isolated from each other Interlocking layers of electrically conductive material are structured means that each of these two Layers has at least one indentation into which one Bulge of the other layer intervenes.

An electrically conductive layer in the cover and one single electrically conductive layer on the surface of the Chips form when there is a dielectric between them finds, together, a single capacity arrangement that is at least part of the capacity arrangement, the capacity of which is groping. If as in the case of claims 8 or 11 electrically conduct two or more of the surface of the chip de layers are formed, each forms electrically conductive de layer on the surface of the substrate together with the trained in the cover and at a distance from the chip arranged electrically conductive layer one each Capacity arrangement. These two or more individual kapa quantity arrangements are connected in series and form together the capacity order, its capacity value decrease groping and is based on the capacity values of the individual Capacity orders determined.  

Particularly advantageous in terms of reinforcing the Protection against chip manipulation is the electrical conductive layers according to one of claims 4 to 6 with egg ner or more electrically conductive layers according to An to combine 10 or 11. With such a combination tion is advantageously a double protection of the Protection against abusive chip access or chip manipulation tion enables.

With this configuration, the protection is protected once through the capacity arrangement, its capacity value is to be scanned, and additionally through the flat cover one or more outputs of the circuit device for each issue a signal to enable a function the card with the irregularly structured layer on the Surface of the chip and therefore given twice.

The dielectric cover that covers the chip is made preferably made of epoxy resin (claim 12).

According to a preferred and advantageous embodiment of the device according to the invention, the circuit device coupled to the capacitance arrangement

• - A signal generator coupled to the capacitance arrangement supply device for the optional sampling of the capacitance value tes the capacity arrangement and respective generation of a Signals with a signal parameter that one for the measured constant capacity value characteristic parameter value points out
• a coding device for coding the parameter value tes the signal parameter of each generated signal after one specifiable code and generation of a for this parameter value characteristic code word,
• - A storage device for inaccessible storage Save a selected generated code word as an identifier the chip-specific capacity value and  
• - A comparator device for comparing one after the Storage of the selected code word by scanning the Capacity value of the newly generated code word with the saved selected code word and generate a signal to release a function of the card only if he newly generated code word with the saved selected Code word matches, on (claim 13).

That the parameter value is characteristic of the capacity value and the parameter value is characteristic of the code word means that each capacity value has exactly one parameter value and exactly one code word is assigned to each parameter value and that the parameter value ver for different capacitance values and the code word for different parameter values is different, so that each one is clearly reversible Assignment between parameter value and capacity value and between code word and parameter value is given.

The signal generating device preferably consists of egg an oscillator connected to the capacitance arrangement, the signal of a frequency forming the signal parameter generated whose value for the sampled capacity value cha is characteristic (claim 14). The oscillator is preferred an SC oscillator circuit (SC stands for Switched Ca pacity).

The coding device preferably has a frequency counter fixed counting period, which each time the Capacity value of the capacity arrangement the frequency of the Oscillator generated signal for the duration of a count period counts and after this period the value of Fre number characterizing the sequence as a code word for forming the provides generating code word (claim 15).

The coding device preferably generates a code word, in which each next to the parameter value of the signal parameter  generated signal contain a person-specific code word is (claim 16). In combination with the measure of the To claim 15 has the coding device according to claim 16 preferably a linking device, each number provided by the meter according to a predefinable ver linking algorithm with a person-specific code word-forming number linked by the with each linked numbers formed as the number to be generated provides code word (claim 17).

The storage device is preferably associated with the storage direction through a transmission line to transmit the selected code word generated by the coding device connected to the storage device, and that a Einrich device for irreversible interruption of the transmission line from outside after saving the generated selected Codeword as the identifier of the chip-specific capacity worth is provided (claim 18).

The release signal is preferably different Release points arranged on the surface of the chip courses of the chip distributed (claim 19).

The device according to the invention is advantageous at Hochsi security systems can be used.

The invention is described in the following description of the figures explained in more detail by way of example. Show it:

Fig. 1 shows a cross section through a chip card with a first embodiment of a device according to the invention;

Fig. 2 shows the embodiment of Figure 1 in simplified ter representation.

3 shows a cross section through a chip card with a second embodiment of a device according to the invention.

Fig. 4 shows the second embodiment of Figure 2 in a simple representation ver.

Figure 5 is a simplified representation of a second embodiment based on the exemplary contemporary OF INVENTION dung device with an arrangement of two adjacent but mutually electrically iso profiled interlocking electrically conductive layers on the surface of the chip.

Fig. 6 in a simplified representation another arrangement of five adjacent but electrically insulated interlocking electrically conductive layers on the surface of the chip, which can be used instead of the arrangement of FIG. 5; and

Fig. 7 is a block diagram of an embodiment of a circuit device for repeatable sampling of the capacitance value of the capacitance arrangement and generating at least one signal for releasing a function of the card of the device according to the invention.

In the exemplary embodiments according to FIGS. 1 and 3, a chip 2 with a surface 20 facing away from the upper surface 10 of the card 1 is arranged on a flat surface 10 of a chip card 1 shown in detail. For example, the surface 10 can be the bottom of a recess formed on a flat side of the chip card 1 , which does not extend down to the flat side of the card 1 on its flat side.

The chip 2 is covered by a cover 3 made of a dielectric, for example epoxy resin, for protection against external influences on the chip 2 , which is brought onto the bonded chip 2 . The cover 3 has a convex surface 30 facing away from the surface 10 of the card 1 and surface 20 of the chip 2 , which spans the entire chip 2 and ended on the surface 10 of the card 1 . One of the type of cover 3 is also called a "globe top".

In the cover 3 , an electrically conductive, for example, metallic layer 40 is formed at a distance d from the chip 2 , which spans the chip 2 similar to the surface 30 of the cover 3 and ends on the surface 10 of the card 1 .

In the example of Fig. 1, the layer 40 can be prepared, for example, that first the chip 2 with a cover 31 is covered from of dielectric having a surface 30 similar convex surface 30 has'. The electrically conductive, for example metallic layer 40 is applied to this surface 30 ', e.g. B. by vapor deposition. Then an additional layer 32 of dielectric is applied to the electrically conductive layer 40 , which together with the previous cover and the electrically conductive layer 40 forms the cover 3 . The surface of the additional layer 32 made of dielectric which faces away from the surface 10 of the card 1 , from the surface 20 of the chip 2 and the electrically conductive layer 40 forms the surface 30 of the cover 3 .

On the surface 20 of the chip 2 in the example of FIG. 1, mutually insulated electrically conductive, for example metal layers 20 _{1 are} formed, which are connected by bond wires 22 to lines 1 formed on the card 1 electrical lines 11 , for example layers of metal .

The layers 20 ₁ form counter electrodes to the layer 40 in the cover 3 and the layer 40 and the layers 20 ₁ together form the capacitance arrangement 4 formed in the cover 3 , which has a chip-specific capacitance value C.

Specifically, in the example according to FIG. 1, the capacitance arrangement 4 consists of several, for example two individual capacitance arrangements connected in series, each of which consists of the layer 40 and one of the plurality of layers 20 ₁ and each has a dielectric constant ε _{r1 of} the dielectric the cover 3 has a certain capacity value C ₁ , which can be the same or different from layer 20 ₁ to layer 20 ₁ . The capacitance value C to be scanned of the capacitance arrangement 4 is determined in a known manner from the capacitance values C _{1 of} all individual capacitance arrangements.

In FIG. 2, the essence of the structure 1 of the capacitor array 4 is shown in FIG. Relative shown in simplified form.

Preferably form or are the layers 20 ₁ to inputs 50 'and 50' 'a groove formed in the chip 2 and tätsanordnung to the capaci 4 coupled circuit device 5 such as derholbaren scanning of the capacitance value C of the capacitance arrangement 4 and generating at least one S signal for free gift a function of the card 1 only if the scanned te capacitance value C of the capacitance arrangement 4 matches a chip-specific capacitance value C _ref .

In the example according to FIGS. 1 and 2, there are two or more capacitance arrangements connected in series, each with a capacitance value C ₁ and in each case a direct tap on the electrically conductive layers 20 ₁ on the chip 2 . No additional bonding is required for this tap, but the area required for the layers 20 ₁ chip 2 can be large under certain circumstances.

Electrically conductive layers 20 ₁ on the chip 2 that contribute to the capacitance arrangement 4 are not required in the exemplary embodiment according to FIG. 3. In this embodiment, the capacitance arrangement 4 is composed of the electrically conductive layer 40 formed in the cover 3 and at a distance d from the chip 2 and a further electrically conductive, for example metal, formed in this cover 3 and at a distance d 'from the chip 2 Layer 40 'is formed, which is separated from the one layer 40 by a dielectric. In this case, the capacitance arrangement 4 , the capacitance value C of which is to be sampled, is completely moved into the "globe top".

Layer 40 'can be produced similarly to layer 40 in the example according to FIGS. 1 and 2. On the surface 10 of the card 1 , from the surface 20 of the chip 2 and from the electrically conductive layer 40 surface 30 "of the additional layer 32 made of dielectric, the further electrically conductive layer 40 'is applied. Then after an additional wide re layer 33 made of dielectric is applied to the further layer 40 ', which together with the previous cover 31 , the electrically conductive layer 40 , the additional layer 32 made of dielectric and the white further electrically conductive layer 40 ' the cover 3 pictures. The surface of the additional further layer 33 made of dielectric forms the surface 30 of the cover 3 from the surface 10 of the card 1 , the surface 20 of the chip 2 , the electrically conductive layer 40 and the further electrically conductive layer 40 '.

At least one of the two electrically conductive layers 40 and 40 'can also be irregularly structured in order to produce an irregular capacitance arrangement 4 . This also applies to the one electrically conductive layer 40 of the example according to FIGS. 1 and 2.

In the example according to FIG. 3, the electrically conductive layers 40 and 40 'can be interchanged.

The electrically conductive layer 40 and also the electrically conductive layer 40 'arch similarly convexly as the upper surface 30 of the cover 3 over the chip 2 and span it.

In the example of FIG. 3, the electrically conductive layers 40 and 40 on a chip carrier forming card 1 contacted by 'special connection pads 23 and 23' and connected with the chip 2 via two bonding wires 22 'and 22' 'which are advantageously used in the same operation with other pads can be bonded. An electrically conductive layer, for example layer 40 , is connected to an input, for example the input 50 'of the circuit device 5 , while the other layer, in the example the layer 40 ' with the other input, in the example the input 50 '' The circuit device 5 formed in the chip 2 and coupled to the capacitance arrangement 4 is connected to the repetitive sampling of the capacitance value C of the capacitance arrangement 4 and generation of at least one signal S for releasing a function of the card 1 only when the sampled capacitance value C of the capacitance arrangement 4 matches the chip-specific capacitance value C _ref .

In FIG. 4, the essence of the structure 3 of the capacitor array 4 is shown in FIG. Relative shown in simplified form.

If, in the described embodiments, on the upper surface 30 of the cover 3 tampered with, for example, to expose the chip 2, so the capacitance value C is the capaci tätsanordnung 4 changed or the capacitor array 4 interferes with cerium, wherein a change of the sampled capaci tätswerts C yields ie the capacitance value C sampled after such manipulation no longer corresponds to a chip-specific original capacitance value C _ref .

The examples according to FIGS. 1 and 2 and according to FIGS. 3 and 4 can be combined with one another. In this case, the capacitance value C of the capacitance arrangement 4 is formed from the capacitance value of the capacitance arrangement formed from the electrically conductive layers 40 and 40 'and the capacitance values of the capacitance arrangements formed from the layer 40 and the layers 20 ₁ on the chip 2 . If two or more layers 20 _{1 are arranged} on the surface 10 of the chip 2 in a layer arrangement which itself forms a capacitance arrangement with a capacitance value, then this capacitance value with all other capacitance values contributes to the capacitance value C to be scanned of the capacitance arrangement 4 .

In FIG. 5 is specifically shown a on the embodiment according to FIGS. 3 and 4 based embodiment, in addition to a 'formed in the cover 3 of the layers 40 and 40 captive capacity arrangement, a further protective structure in the form of an on the surface 20 of the chip 2 trained capacitance arrangement is realized.

The capacitance arrangement consisting of the layers 40 and 40 'is designated 4 ' and corresponds to the capacitance arrangement 4 of the example according to FIGS. 3 and 4 and is shown in simplified form as in FIG. 4. The capacitance arrangement formed on the surface 20 of the chip 2 is denoted by 4 ″ and consists of a layer arrangement 21 composed of at least two layers 201 that are electrically insulated from one another.

Both capacitance arrangements 4 'and 4 ''are switched together and together form the capacitance arrangement 4 , the capacitance value C of which can be sampled and, given the interconnection, in a known manner from the capacitance value C _{3 of} the capacitance arrangement 4 ' and the capacitance value C _{2 of} the capacitance arrangement 4 '' determined.

For example, the capacitance arrangements 4 ′ and 4 ″ are interconnected such that a layer of the capacitance arrangement 4 ′, for example the layer 40 , and a layer 20 i of the capacitance arrangement 4 ″ are connected to an input, for example the input 50 ′ of the circuit device 5 , and the other layer of the capacitance arrangement 4 ', in the example the layer 40 ', and the other layer 20 _{1 of} the capacitance arrangement 4 '' is connected to the other input, in the example the input 50 '' of the circuit device 5 .

The capacitance means 4 according to Fig. 5 may also be so out is possible that instead of the two layers 40 and 40 'as in the example of FIGS. 1 and 2 in the cover 3 is only one layer, for example, the layer 40 is provided.

Forming the rest on the surface 20 of the chip 2 from formed capacitor array 4 '' according to Fig. 5 al lein for already some protection against chip manipulation, but this capacitor array 4 '' is preferably not alone, but with a different protective measure in the form of egg ner additional capacitance arrangement such as the arrangement 4 'of FIG. 5 used.

The electrically conductive layers 20 ₁ formed on the surface 20 of the chip 2 are each structured irregularly, for example, and cover at least one output 50 of the circuit device 5 for emitting a signal S for releasing a function of the card 1 .

In particular, in the example of Fig. 5, the layer arrangement 21 two adjacent electrically conductive layers 20 _1, which formed on the surface 20 of the chip 2 are isolated from each other and interlocking structure, wherein the layer structure 21 to at least an output terminal 50 of the circuit device 5 to deliver a signal S to enable a function of the card 1 covers.

Each of the two layers 201 ₁ , for example, each has a plurality of indentations 201 , in each of which one example finger-shaped bulge 202 of the other layer 20 ₁ engages, so that an interdigital structure is provided.

The layer arrangement 21 can also have more than two adjacent layers 20 _{1 which} are electrically insulated from one another, each of which has a plurality of indentations 201 , in each of which a bulge 202 of an adjacent layer 20 ₁ engages. In FIG. 6 is an embodiment ei ner such layer assembly 21 with five adjacent layers 20 to respective terminals _1, which are designated sequentially with I, II, III, IV and V represented. Each pair of adjacent layers 20 ₁ forms an individual capacitance arrangement each of a capacitance value, a total of four such individual capacitance arrangements 41 to 44 being given, which are shown once again in simplified form in FIG. 6 to the right of the layer arrangement 21 and together the capacitance arrangement 4 ''Form with the capacitance value C ₂ , which is determined from the capacitance values of the capacitance arrangements 41 to 45 .

The layer arrangement 21 according to FIG. 6 advantageously defines an interruption-sensitive capacitance arrangement 4 ″ with a meandering structure, interruptions in a layer 20 ₁ can lead to sensitively detectable fluctuations in the capacitance value C ₂ or even destroy the capacitance arrangement. There is also the possibility here to connect the different layers 20 ₁ via a switch arrangement and thus bring about a diversification of the capacitance arrangement.

The layer arrangement 21 according to FIG. 6 can be very large and an arbitrary interruption of some layers 20 ₁ can lead to different capacitance ratios.

In the examples according to FIGS . 5 and 6, protection against chip manipulation is doubly secured, once with the distributed capacitance arrangement 4 'in the "globe top" and additionally with the surface coverage of one or more outputs 50 of the circuit device 5 or one or more signals score 6 (see FIG. 5) through the layer arrangement 21 . A high level of security for chip 2 is thus ensured if these distributed capacitance arrangements 4 ′ and 4 ″ protect the critical points on chip 2 against unauthorized manipulation or chip 2 itself against non-destructive exposure. The undisturbed capacitance value relationships form a chip-specific identification that cannot be manipulated, since capacitance values in the order of magnitude of a few 100 fF, as are present in the capacitance arrangements according to the invention, cannot be connected from the outside without creating changed conditions through the wiring.

The circuit 5 formed in the chip 2 and coupled to the capacitance arrangement 4 of a device according to the invention has the function of repeating the capacitance value C of the capacitance arrangement 4 , for example each time the card 1 is used, and at least one signal S for releasing a function of the card 1 can only be generated if the sampled capacitance value C matches a previously sampled capacitance value of the capacitance arrangement 4 , which is defined as the chip-specific capacitance value C _ref , and does not release the function of the card 1 if the sampled capacitance value C does not match the chip-specific capacitance value C _ref matches.

In FIG. 7, a preferred embodiment of the circuit device 5 is shown in block diagram moderately. It has an oscillator 51 connected to the capacitance arrangement 4 , which generates a signal f of a frequency ω, the value ω _c of which is characteristic of the sampled capacitance value C and is specifically proportional to this capacitance value C. The oscillator 51 is preferably composed of an SC oscillator circuit and specifically forms the signal generating device coupled to the capacitance arrangement 4 for selectively sampling the capacitance value of the capacitance arrangement 4 and generating the signal in each case with a signal parameter which has a parameter value characteristic of the sampled capacitance value , wherein the signal f forms the signal of the signal generating device and the frequency ω the signal parameter of this signal.

As signal parameters, other signal quantities than a frequency, for example an electrical voltage tapped at the capacitance arrangement 4 , can be used if it is ensured that this other signal quantity is characteristic of the capacitance value C of the capacitance arrangement 4 . Correspondingly, the signal generator device 51 is then to be executed.

In the example according to FIG. 7 with the oscillator 51, a frequency counter 521 counts the frequency ω of the signal f and generates a number A _c which is as characteristic for the value ω _{c of} the frequency ω as the value ω _{c of} the frequency ω for the capacitance value C of the capacitance arrangement 4 . For this purpose, the frequency counter 521 is designed, for example, in such a way that it has a fixed counting period and with each sampling of the capacitance value C of the capacitance arrangement 4, the frequency ω of the signal f generated by the oscillator 51 counts the duration T of a counting period and after this duration has expired T as the number A _c that is characteristic of the value ω _{c of} the frequency ω.

If the duration T of each counting period is, for example, m consecutive bits, where m is a predeterminable natural number, then 2 ^m +2 binary-coded numbers A _c , each with a value between 0 and 2 ^{m, are} possible, which have a corresponding number of values ω _{c of} the frequency ω characterize reversibly and underneath which must be the value ω _{ref of} the frequency ω which is characteristic of the chip-specific capacitance value C _ref . The value ω _ref allocated number A _ref among the numbers A _c as the value of ω _ref for the chip specific capacitance value C _ref characteristic.

A linking device 522 links each number A _c provided by the counter 521 according to a freely selectable linking algorithm (*) with a person-specific fixed number B and represents a number X = A _c (*) formed by the respectively linked numbers A _c and B B ready, which is as characteristic for the capacitance value _C as the number A _c or the value ω _c . Like the number A _{c, the} number B is preferably a binary-coded number with a width of m 'bits, and for the numbers X = A _c (*) B there is a width of n bits available, with m' and n each being natural numbers are and n is greater than m, for example equal to m + m ', if the linking algorithm (*) is a simple arithmetic addition of the numbers A _c and B.

The frequency counter 521 and the linking device 522 together form a coding device 52 for coding the value ω _{c of} the frequency ω of each generated signal f according to a predeterminable code and generating a code word X which is characteristic of this value ω _{c of} the frequency ω.

In principle, the coding device 52 can consist of the frequency counter 521 alone, so that the number A _c itself forms the code word X to be generated, but the combination of the number A _c with a person-specific number B is a further independent protection of the chip card 1 is advantageous in any case and should not be dispensed with.

Before the chip card 1 is released for use, the capacitance value C of the capacitance arrangement 4 is scanned and the code word X = A _c (*) B which is characteristic of this capacitance value C is generated. This capacitance value C is taken as the chip-specific capacitance value C _ref and this code word X as the selected code word X _ref = A _ref (*) B forming the identifier of this chip-specific capacitance value C _ref .

For the selected code word X _ref , which is to be regarded as a unique identification of the chip card 1 , there must be no possibility of a subsequent change through manipulation. To ensure this, a memory device 53 is provided for externally inaccessible storage of the selected generated code word X _ref which forms the identifier of the chip-specific capacitance value C _ref .

The externally inaccessible storage of the selected code word X _ref in the memory device 53 is preferably achieved in that the coding device 52 is connected by a transmission line 530 to the memory device 53 , which is preferably an EPROM. The selected code word X _ref = A _ref (*) B is transmitted to the input side of the memory device 53 via this transmission line and is read into the memory device 53 . The read-in code word X _ref is permanently stored in the memory device 53 . The stored code word X _ref can be read out on the output side of the memory device 53 , there being no possibility of changing the stored code word X _ref from the outside on this output side.

So that there is no possibility of changing the stored code word X _ref , a device 531 is provided for irreversibly interrupting the transmission line 530 from the outside after the selected code word X _ref generated has been stored. This device may be that the transmission line 530 leading from the coding device 52 to the storage device 53 is melted by applying a defined electrical voltage to an externally accessible contact by means of a "fuse blow".

After the selected code word X _{ref has been} stored, the card 1 can be released for use, and each time the card 1 is used, the capacitance value C of the capacitance device 4 is again sampled and the code word X characteristic of this sampled capacitance value C is generated.

Each resampled codeword X is not chereinrichtung in the SpeI saved 53, and can also be saved because of the non-directional in the spoke clean under rupted transmission line 530 53, but is a Kompara gate means 54 to the ge in the storage device 53 stored and selected code word X _ref compared, which is read out from the memory device 53 for this comparison, but remains unchanged in the memory unit 53 ge stores.

The comparator device 54 generates, depending on the result of the comparison, at least one signal S for releasing a function of the card 1 only when the newly generated code word X coincides with the stored selected code word X _ref , so that the function of the card 1 only in each case is then released if the newly generated code word X matches the stored selected code word X _ref and not if such a match does not exist.

The release signal S is emitted at an output 50 of the comparator device 54 , which can also form the output of the circuit device 5 and is preferably covered by an irregularly structured layer 20 ₁ or layer arrangement 21 composed of such layers 20 ₁ on the surface 20 of the chip 2 is.

A release signal S ′ is preferably generated from the release signal S, which is distributed to outputs arranged in different release points 6 on the surface 20 of the chip 2 . The distributed release signal S 'corresponds to a signal which is built into the logic of the card function and causes card 1 to be released . The distribution of the release points 6 is an important contribution to the protection of the map function, since they cannot be located immediately and do not only exist as a point that needs to be changed in the event of manipulation.

It makes sense to cover at least one of these release points 6 from an irregularly structured layer 20 ₁ or layer arrangement 21 from such layers 20 ₁ on the surface 20 of the chip 2 in order to protect it. In FIG. 5, for example, three release points 6 are schematically Darge sets, one of which is arranged outside of the layer assembly 21 and not covered by this, the other, however, is the in the area of the layer arrangement 21 and are covered by this. Preferably, a release point 6 covered by the layer arrangement 21 does not lie next to the layers 20 ₁ , as shown in FIG. 5 for reasons of visualization, but under a layer 20 ₁ .

In the device according to the invention, the selected code word X _ref , which is characteristic of the chip-specific capacitance value C _ref , can advantageously not be used even in the case of a decoding of this word X _ref , since a scan of the capacitance value C always takes place for the commissioning or use of the card 1 Capacity arrangement 4 is presupposed and compared with the stored selected code word X _ref . The possibility of transferring a cracked selected code word X _{ref from} a card 1 to another card to have a duplicate of the one card 1 is completely ruled out, since the capacitance ratios arbitrarily derived from the process cannot be reproduced and the sampling of the capacitance value C of the capacitance arrangement 4 the other card is an essential part of gaining the individual chip-specific identifier.

In summary, misuse of the chip card 1 by chip manipulation by scanning the capacitance value C of a sensitive capaci ity arrangement 4 is switched off in the device according to the invention, the cover 2 in the cover 2 and / or the surface 20 covered by the cover 3 Chips 2 is formed. Specifically, the capacitance value C of the capacitance arrangement 4 is sampled with an SC oscillator circuit 51 , which generates a frequency ω from the sampled capacitance value C with a frequency value ω _c proportional to this capacitance value C. This frequency value ω _c is converted into a STIC for this value ω _c CHARACTERI binary coded number _c and A associated with a specific number per sonen B to a code word X. A generated such code word X is selected as a code word X _ref , which is used as a chip-specific identifier. This identifier is stored, for example, by a one-time initialization process on the card 1 . When using card 1 , the capacitance value C is again sampled and the code word X is generated. If this coincides with the stored code word X, for example in a one-time initialization process, the card function is released via distributed release points 6 . These release points 6 are protected by a layer arrangement 21 with interlocking electrically conductive layers 20 ₁ and the entire chip 2 is protected by the capacitance arrangement 4 against unauthorized access. A change in the capacitance arrangement 4 and thus its capacity value C from the outside, after storing the chip-specific identifier, has the consequence that the functions on the chip 2 are no longer released and the chip card 1 is therefore unusable. The chip-specific identifier itself is not reproducible and not transferable and cannot be used for misuse even when decrypted.

Claims (19)

1. Device for protection against misuse of a chip card ( 1 ), characterized by

• - A on the card ( 1 ) provided chip ( 2 ), which is protected by a cover ( 3 ) from a dielectric against external influences,
• - A capacitance arrangement ( 4 ) formed in the cover ( 3 ) and having a chip-specific capacitance value (C _ref ), and
• - A in the chip ( 2 ) and to the capacitance arrangement ( 4 ) coupled circuit device ( 5 ) for repeatable sampling of the capacitance value (C) of the capacitance arrangement ( 4 ) and generating at least one signal (S, S ') to release a Function of the card ( 1 ) only if the sampled capacitance value (C) matches the chip-specific capacitance value (C _ref ).

2. Device according to claim 1, characterized in that the capacitance arrangement ( 4 ) in the cover ( 3 ) made of dielectric and at a distance (d) from the chip ( 2 ) arranged electrically conductive layer ( 40 , 40 ') . 3. Device according to claim 2, characterized in that the electrically conductive layer ( 40 , 40 ') extends over the entire chip ( 2 ). 4. Device according to claim 2 or 3, characterized in that the capacitance arrangement ( 4 ) has a in the cover ( 3 ) made of dielectric further elec trically conductive layer ( 40 ', 40 ), which was in a From (d' ) arranged from the chip ( 2 ) and separated from the one layer ( 40 , 40 ') by a dielectric. 5. Device according to claim 4, characterized in that the further electrically conductive layer ( 40 ', 40 ) extends over the entire chip ( 2 ). 6. Device according to one of claims 2 to 5, characterized in that at least one electrically conductive layer ( 40 , 40 ') is irregularly structured. 7. Device according to one of the preceding claims, characterized in that at least one electrically conductive layer ( 20 ₁ ) is formed on a surface ( 20 ) of the chip ( 2 ) covered by the cover ( 3 ). 8. Device according to claim 7, characterized in that on the surface ( 20 ) of the chip ( 2 ) a layer arrangement ( 21 ) is formed from at least two electrically conductive layers ( 20 ₁ ), between which there is a dielectric. 9. Device according to claim 7 or 8, characterized in that the capacitance arrangement ( 4 ) has at least one on the surface ( 20 ) of the chip ( 2 ) formed electrically conductive layer ( 20 ₁ ). 10. Device according to one of claims 7 to 9, characterized in that an on the surface ( 20 ) of the chip ( 2 ) formed electrically conductive layer ( 20 ₁ ) is un regularly structured and at least one output ( 50 ) of the circuit device ( 5th ) for emitting a signal (S, S ') to enable a function of the card ( 1 ). 11. The device according to claim 8, 9 and 10, characterized in that the layer arrangement ( 21 ) has at least two adjacent electrically conductive layers ( 20 ₁ ), which are structured interlocking, the layer arrangement ( 21 ) at least one output ( 50 ) of the circuit device ( 5 ) for emitting a signal (S, S ') for releasing a function of the card ( 1 ). 12. Device according to one of the preceding claims, characterized in that the cover ( 3 ) consists of epoxy resin. 13. Device according to one of the preceding claims, characterized in that the circuit arrangement ( 5 ) coupled to the capacitance arrangement ( 4 )

• - A to the capacitance arrangement ( 4 ) coupled signal generation device ( 51 ) for optional sampling of the capaci titätswert (C) of the capacitance arrangement ( 4 ) and each generation of a signal (f) with a signal parameter (ω), which one for the sampled capacitance value (C) has characteristic parameter value (ω _c ),
• - A coding device ( 52 ) for coding the parameter value (ω _c , ω _ref ) of the signal parameter (ω) of each generated signal (f) according to a predefinable code and generating a code word characteristic of this parameter value (ω _c , ω _ref ) ( X, X _ref ),
• - A memory device ( 53 ) for storing a selected generated code word (X _ref ), which is inaccessible from the outside, as an identifier of the chip-specific capacitance value (C _ref ) and
• - A comparator device ( 54 ) for comparing a code word (X) generated again after the storage of the selected code word (X _ref ) by scanning the capacitance value (C) with the stored selected code word (X _ref ) and generating a signal (S) for Release of a function of the card ( 1 ) only if the newly generated code word (X) matches the stored selected code word (X _ref ).

14. The device according to claim 13, characterized in that the signal generating device ( 51 ) consists of a connected to the capacitance arrangement ( 4 ) Oszilla tor, which generates a signal (f) of a frequency forming the signal parameter (ω), the value (ω _c , ω _ref ) is characteristic of the sampled capacitance value (C, C _ref ). 15. The device according to claim 14, characterized in that the coding device ( 52 ) has a Fre quenzzähler ( 521 ) fixed counting period, with each sampling of the capacitance value (C, C _ref ) of the capacitance arrangement ( 4 ) the frequency (ω) of the signal (f) generated by the oscillator ( 51 ) counts the duration (T) for a counting period and after the expiration of this duration (T) as a number characterizing the value (ω _c , ω _ref ) of the frequency (ω) as a code word (A _c , A _ref ) to form the code word (X, X _ref ) to be generated. 16. Device according to one of claims 13 to 15, characterized in that the coding device ( 52 ) generates a code word (X, X _ref ), in which in addition to the parameter value (ω _c , ω _ref ) of the signal parameter (ω) each generated signal (f) contains a person-specific code word (B). 17. The device according to claim 15 and 16, characterized in that the coding device ( 52 ) has a linking device ( 522 ), which each provided by the counter ( 521 ) number (A _c , A _ref ) according to a predeterminable linking algorithm (( *)) with a number forming the person-specific code word (B) and the number formed by the respectively linked numbers (A _c , B; A _ref , B) (A _c (*) B, A _ref (*) B ) as the code word to be generated (X, X _ref ). 18. Device according to one of claims 13 to 17, characterized in that the coding device ( 52 ) with the memory device ( 53 ) through a transmission line ( 530 ) for transmission of the device from the Codiereinrich ( 52 ) generated selected code word (X _ref ) is connected to the memory device ( 53 ), and that a device ( 531 ) for irreversibly interrupting the transmission line ( 530 ) from the outside after storing the generated selected code word (X _ref ) as the identifier of the chip-specific capacitance value (C _ref ) is provided. 19. Device according to one of the preceding claims, characterized in that the release signal (S ') is distributed in different release points ( 6 ) on the surface ( 20 ) of the chip ( 2 ) arranged outputs ( 50 ) of the chip ( 2 ).