CN1716221A - Method and IC card for controlling access authority of memory logical partition - Google Patents

Abstract

A method for controlling the access authority of logical partitions of memory, comprising: (1) setting a memory access authority control area in the memory, in which the access authority of each logical partition is set; (2) according to the value in the memory access authority control area , judge the current working state of the chip, and complete the access control of each logical partition; (3) When the access permission of the logical partition needs to be modified, after the password verification is passed, the value in the memory access control area can be rewritten, Thereby changing the access rights of each logical partition. The invention also provides an IC card with the function of controlling the access authority of the memory logic partition.

Description

Method and IC card for controlling access authority of memory logical partition

technical field

The invention relates to the field of IC cards (integrated circuit cards), in particular to a method for controlling the access authority of memory logic partitions and an IC card with the function of controlling the access authority of memory logic partitions.

Background technique

In the existing society, people put forward high requirements on the safety and reliability of information carriers. The IC card provides a convenient means for the processing and dissemination of modern information with its strict data security, wide application flexibility and powerful function expansion.

The applicant filed a patent application document with the application number 200310100411.X on October 15, 2003. In this application document, a non-CPU integrated circuit card with an optimized memory logical partition structure is disclosed. Please refer to FIG. 1 , which is a schematic structural diagram of the integrated circuit card of the above patent application. It is composed of address counter, controller, I/O interface and memory. CLK, RST and IO are external clock input signal, reset signal and input and output signal respectively.

Please refer to FIG. 2 , which is a schematic diagram of memory logical partitions in the 200310100411.X patent. It is divided into several logical partitions: manufacturer code, issue data area, memory access control area, and user data area. The access rights of manufacturer code, issue data area and memory access control area are all fixed as read-only. Among them, the issuer can write the access control words for each user data area in the memory access control area, and the user data area The access authority is determined by an independent one or two-digit control word, which can be set as one of the access authority of inaccessible, read-only, readable and writable, readable and rewritable.

Please refer to Fig. 3, which is a structural schematic diagram of the controller disclosed in the 200310100411.X patent application document. It includes an address decoder 31 , a logical partition selector 32 , a memory access authority controller 33 , a memory access authority register 34 and a memory access type determiner 35 .

The address decoder 31 decodes the ADDR signal to generate the row address and the column address of the memory, and simultaneously sends the decoded result signal to the logic partition selector 32;

Logical partition selector 32: judge the logical partition to which it belongs according to the decoding structure signal, make the indication signal of the logical partition pointed to by the address valid, and send it to the memory access authority controller 33;

Memory access type determiner 35: according to different combinations of CLK and RST, different operation indication signals are generated and output to the memory access authority controller 33;

Memory access authority register 34: used to read the control word of the memory access authority control area and latch it, that is, this register inherits the value of the memory access authority control area, and a certain bit or two bits in the register specify the corresponding Access permissions for logical partitions;

Memory access authority controller 33: perform logic operations on partition indication signal, operation indication signal and memory access authority register value, and control the generation of corresponding write enable signal WE, erase enable signal ER and read enable signal RE.

The controller performs logical operations according to the partition indication signal, the operation indication signal and the value of the corresponding control bit in the register, and controls the generation of the operation enable signal for each user data area. In the above invention, user data areas with different access rights can be obtained by dividing the user data area into multiple areas and setting access rights.

However, there is still room for improvement in the above non-CPU integrated circuit card with an optimized memory logic partition structure. Taking the telephone IC card as an example, if the operator allows the control word to be modified at will during the issuance and use of the card, and then modify the access authority of the user data area, the security of the card will not be guaranteed, and it is easy to cause the card to be damaged during the use process. invalidated. If the control word is not allowed to be modified, whenever the access authority of the user data area needs to be modified, chip design and chip manufacturing need to be performed again, which not only increases the cost of the operator, but also affects the rapid launch of services.

Contents of the invention

The purpose of the present invention is to provide a method and IC card for controlling the access authority of the logical partition of the memory, so as to solve the problem in the prior art when the operator is in the process of issuing and using the card, if the operator is allowed to directly modify the access authority of the user data area , the security of the card cannot be guaranteed. If the access authority of the user data area is not allowed to be modified, then every time the access authority of the user data area needs to be modified, the chip design and chip manufacturing must be re-designed, which not only increases the cost of the operator , but also the rapid rollout of technical issues that affect the business.

In order to solve the above problems, the present invention discloses a method for controlling the access authority of logical partitions of memory, including: (1) setting a memory access authority control area in the memory, and setting the access authority of each logical partition therein; (2) According to the value in the access control area of the memory, the current working state of the chip is judged, and the access control of each logical partition is completed; (3) When the access permission of the logical partition needs to be modified, after the password verification is passed, it can be rewritten The value in the memory access authority control area, thereby changing the access authority of each logical partition.

The present invention also includes: setting one of the user data areas of the logical partition as a password area for storing passwords.

The password verification described in step (3) is specifically: a1: Under the action of an external input signal, the address counter generates an operation address pointing to the password area; a2: Input the password bit by bit at the password storage address, and the controller compares the input password with The passwords stored in the password area are compared, and the password verification is passed only when the input password is exactly the same as the password stored in the password area.

Step (3) between a1 and a2 also includes: judging whether the preset password comparison trigger condition is met, if yes, proceed to step a2, otherwise exit. In step (3), rewrite the value in the memory access control area specifically as follows: b1: under the action of an external input signal, the address counter generates an address signal ADDR pointing to the memory access control area; b2: the decoder performs an address signal ADDR Decoding; b3: select the memory access authority control area according to the address generated after decoding; b4: use the operation type selected by the external input signal to read, write and erase the value in the memory access authority control area; b5: according to the external input information Modify the value corresponding to the memory access control area.

The password area can be used as a data area for reading, writing, and erasing operations, and the value of the control bit corresponding to the area can be used to set whether the area is used as a data area or as a password area. Moreover, the operation address of the set password verification is not continuous with the address of the data area adjacent to the password area, and there is an address jump between them.

Step (2) is specifically:

c1: Under the action of an external input signal, the address counter generates an address signal ADDR;

c2: The decoder decodes the address signal ADDR;

c3: Select the logical partition to access according to the address generated after decoding;

c4: According to the combination type of external input signals, determine the operation type;

c5: According to the setting value of the memory access control area, determine whether the selected logical partition can be read, written and erased.

An IC card has the function of controlling the access authority of logical partitions of memory, including an address counter, a memory divided into multiple logical partitions, an I/O interface and a controller, and the logical partition of the memory contains a write-accessible The memory access authority control area of the authority control word and several user data areas whose access authority is respectively determined by different control bits of the control word,

The user data area includes a password area;

The controller is used to complete the access control of each logical partition according to the value of the control bit in the memory access control area and the controller's judgment on the current working state of the chip, and when the access permission of the logical partition needs to be modified , after the password verification is passed, the value of each control bit can be modified, thereby changing the access rights of each logical partition.

The controller includes an address decoder, a logical partition selector, a memory access authority controller, a memory access authority register, and a memory access type determiner, wherein the memory access authority controller is used for partition indication signals, operation indication signals, and memory access The value of the authority register performs logical operations to control the generation of the corresponding write enable signal, erase enable signal and read enable signal: if the logical partition prohibits the access operation, the corresponding enable signal will not be generated, otherwise the corresponding Enable signal, the read enable signal is invalid during the password verification process, the password in the password area can only be used for internal comparison, if the input password is the same as it, the value of the logical partition access control area can be rewritten, thereby changing Access permissions for logical partitions. The IC card also includes an address converter. The address converter is connected to the address counter through the controller, jumps the address under the instructions of the controller, and sends the jumped address to the address decoder.

Compared with the prior art, the present invention has the following advantages:

The control bits used to control each area are stored in the memory access control area. They can only be read but not erased under normal circumstances. Only after passing the password verification can their values be erased and modified. Changing the read/write status of each control bit corresponding to the user data area increases the security of the card, and also provides an efficient and flexible hardware platform for the upgrade and expansion of value-added services based on the account IC card.

Considering other factors such as the upgrade and expansion of the card, the applicant also made a more flexible setting for the password area: the password area can also be used as a data area, and when it is used as a data area, it can be used as the same as other data areas. It can perform read, write and erase operations.

Moreover, the operation address of the set password verification is not continuous with the address of the data area adjacent to the password area, and there is an address jump between them, so as to improve the security of the card.

Description of drawings

Fig. 1 is a structural schematic diagram of the integrated circuit card of the 200310100411.X patent application;

Fig. 2 is a schematic diagram of the memory logic partition of the 200310100411.X patent application;

Figure 3 is a structural schematic diagram of the controller disclosed in the 200310100411.X patent application;

FIG. 4 is a flow chart of a method for controlling the access authority of a memory logical partition provided by the present invention;

FIG. 5 is a schematic diagram of dividing the user data area into five partitions;

Fig. 6 is the circuit block diagram that adopts IC card chip of the present invention;

7 is a logical schematic diagram of a memory access authority controller generating a control signal WE or ER;

FIG. 8 is a schematic structural diagram of a controller including an address translator according to the present invention.

Detailed ways

The present invention will be described in detail below in conjunction with the accompanying drawings.

The memory structure contains three different states of ROM, PROM and EEPROM. ROM is used to store manufacturer's code. PROM is used to store distribution data. EEPROM is used to store user password and user data when the control bit FG=0. When FG=1, the memory is divided into several areas, and each area is controlled by a control bit to read, write and erase the area. One of the areas is set as a password area, and its operation address is not continuous with the address of the adjacent data area, and there is a jump between them to facilitate the security of the password. FG and the control bits used to control each area are stored in the memory access control area. They can only be read but not erased under normal circumstances. Only after passing the password verification can their values be erased and modified. This is to change the read, write and erase status of each control bit corresponding to the user data area.

Please refer to Fig. 4, which is a flow chart of a method for controlling the access authority of memory logical partitions provided by the present invention, which includes:

S110: setting a memory access authority control area in the memory, and setting the access authority of each logical partition therein;

S120: According to the value in the memory access control area, judge the current working state of the chip, and complete the access control of each logical partition;

S130: When the access authority of the logical partition needs to be modified, after the password verification is passed, the value in the memory access authority control area can be rewritten, thereby changing the access authority of each logical partition.

In the present invention, one of the user data areas can be set as a password area, and in order to improve the safety factor, the operation address of the password verification is not continuous with the address of the data area adjacent to the password area, and there is an address jump between them.

The value corresponding to the access authority of each logical partition (such as the control bit mentioned above) is set in the memory access authority control area; according to the value in the memory access authority control area, the controller judges the current working state of the chip, and then completes the operation of the chip. Access control for each logical partition. When the access authority of the logical partition needs to be modified, after the password verification is passed, the value of the access authority of the logical partition can be rewritten, thereby changing the access authority of each logical partition.

After modifying the value of the logical partition in step S130, the controller performs subsequent access control of each logical partition according to the new value in the memory access control area. The controller can check the password entered by the user and the password in the password area. If they are the same, the access authority of each logical partition is allowed to be modified, including not only the control value of the data area, but also the control value of the password area: According to Specifically, it needs to be changed to the data area.

The value (control value) mentioned in the present invention refers to the control unit that controls the access authority of the logical partition, and the control unit not only refers to the concept of "bit" in the strict sense: it can represent a logical partition by a "bit" The access rights of a logical partition can also be represented by several "bits" or a word or even a longer data unit, and the control unit can be a binary code that the controller can recognize, and it can also be a controller Other command codes that can be identified, as long as the controller can identify the access rights of the corresponding logical partitions according to the value. However, for the convenience of description, in the subsequent embodiments of the present invention, a "bit" is mainly used to control the access authority of a logical partition.

Step S120 can be accomplished through the following steps:

b1: Under the action of an external input signal, the address counter generates an address signal ADDR;

b2: The decoder decodes the address signal ADDR;

b3: Select the logical partition to access according to the address generated after decoding;

b4: Determine the operation type according to the combination type of the external input signal;

b5: According to the setting value of the memory access authority control area, determine whether the selected logical partition can be read, written and erased. If access to the selected logical partition is allowed, a corresponding write-erase enable signal or a chip read-out enable signal is generated; otherwise, the operation of the memory is prohibited, and the memory access authority controller shields the logical partition from reading, writing and erasing. .

Step S130 can be accomplished through the following steps:

a1: under the action of an external input signal, the address counter generates an operation address pointing to the password area;

a2: Enter the password bit by bit in the password storage address, and the controller will compare the input password with the password stored in the password area. Only when the input password is exactly the same as the password stored in the password area, the password verification will pass.

Moreover, in order to improve the safety factor, the password comparison trigger condition can also be set in advance, before entering the password each time, it is judged whether the preset password comparison trigger condition is met, if yes, go to step a2, otherwise exit. The password comparison trigger condition can be set according to specific situations. For example: look for a '1' bit in the error counter in the password area, and perform a write operation on this bit to effectively write it as '0', then the password comparison operation will be started inside the chip. And, if the error counters are all '0', the password verification mechanism will be disabled.

Based on the process disclosed above, the present invention provides an IC card, which has the function of controlling the access authority of logical partitions of memory, including address counters, memory divided into multiple logical partitions, I/O interfaces and controllers. The logical partition includes a memory access control area in which the access control word can be written and several user data areas whose access rights are respectively determined by different control bits of the control word. The user data area includes a password area; the controller , used to complete the access control of each logical partition according to the value of the control bit in the memory access control area and the controller's judgment on the current working state of the chip, and when the access permission of the logical partition needs to be modified, the password calibration After passing the verification, you can modify the value of each control bit, thereby changing the access rights of each logical partition.

The controller includes an address decoder, a logical partition selector, a memory access authority controller, a memory access authority register, and a memory access type determiner, wherein the memory access authority controller is used for partition indication signals, operation indication signals, and memory access The value of the authority register performs logical operations to control the generation of the corresponding write enable signal, erase enable signal and read enable signal: if the logical partition prohibits the access operation, the corresponding enable signal will not be generated, otherwise the corresponding Enable signal, the read enable signal is invalid during the password verification process, the password in the password area can only be used for internal comparison, if the input password is the same as it, the access authority of the logical partition can be rewritten, thereby changing the access permission.

After adjusting the access rights of the logical partitions, the requirements of different applications on the storage area size and access rights can be met. It does not need to re-design and manufacture chips due to different applications, thereby saving development time and costs, and providing an efficient and flexible hardware platform for upgrading and expanding value-added services based on account IC cards.

The present invention is described below with an embodiment.

Please refer to Figure 5, which is a schematic diagram of dividing the user data area into five partitions. The user data area is divided into data area 1, data area 2, data area 3, data area 4 and data area 5 respectively. Description of the situation when data area 5 is used as a data area.

Please refer to Fig. 6, which is a circuit block diagram of the IC card chip of the present invention. The chip is composed of address counter 11 , controller 12 , I/O interface 13 and memory 14 . There are 5 input and output pins: RST, CLK, IO, power supply VCC and ground GND. Among them, RST, CLK and IO are external reset signal, external clock input signal and data input and output signal respectively. The power supply VCC and the ground GND are not marked in the figure. Address counter 11 generates address signal ADDR under the action of CLK and RST signals. According to the external input signal, ADDR signal and the access authority of each logical partition of the memory, the controller controls the generation of the address signal to the memory, the write enable signal WE, the erase enable signal ER, and the read enable signal RE to the I/O interface . The I/O interface outputs stored data to an external port when the RE signal is valid, or inputs data from the outside for password comparison.

FIG. 8 is a structural block diagram of the controller of the present invention, which includes an address decoder 31 , a memory logical partition selector 32 , a memory access authority controller 33 , a memory access authority register 34 , and a memory access type determiner 35 .

The address decoder 31 is used to decode the result of the address counter, that is, the ADDR signal, to generate the word line signal and the bit line signal of the memory, and send the decoded result signal to the logical partition selector 32 .

The logical partition selector 32 is used to determine the logical partition to which it belongs according to the decoding result signal, enable the indication signal of the logical partition pointed to by the address, and send it to the memory access authority controller 33 .

The memory access type determiner 35 is used to generate different operation indication signals according to different combinations of CLK and RST, such as read indication signal RE1, write indication signal WE1 or erase indication signal ER1, and output them to the memory access authority controller 33.

The memory access authority register 34 is used to read the control word of the memory access authority control area and latch it, that is, the register inherits the value of the memory access authority control area, and a certain bit in the register specifies the value of the corresponding logical partition. access permission.

The memory access authority controller 33 is used to perform logical operations on the value of the partition indication signal, the operation indication signal, and the memory access authority register, and control the generation of the corresponding write enable signal WE, erase enable signal ER, and read enable signal RE . Among them, the WE and ER signals are output to the memory to perform write and erase operations on the memory, and the RE signal is output to the I/O interface to control the data input and output circuit to output the memory data. Generate corresponding enable signals for legal access operations (ER and WE signals are directly used for erasing and writing data); if the logical partition prohibits this access operation, the enable signal for this operation cannot be generated, thereby realizing Control of access to memory by external devices. For the description of this part, please refer to the logical schematic diagram and description of the control signal WE or ER generated by the memory access authority controller below.

The logical partition selector 32 is used for judging which logical partition the address is in according to the result of address decoding, and enabling the logical partition indication signals (FQ1-FQ5). The indication signals from data area 1 to data area 5 are sent to the memory access authority controller 33 for access authority control. The hardware implementation scheme of the logical partition is: for each byte in the memory, the address decoder has a decoding result word line corresponding to it, and according to the size of the logical partition, the word lines corresponding to all addresses in each partition are " Or" operation, the operation result is output as the indication signal of the partition, so as to achieve the division of logical partitions and make the indication signal of the partition pointed to by the address effective.

In order to improve the security of the password, the present invention also includes an address converter 36, which is connected to the address counter through the controller, performs address jump under the instruction of the controller, and sends the jumped address to the address decoder (see Figure 8). Address jumping is realized through an address converter. When the fifth area is used as a password area, when the external address points to this area, it is increased beyond the maximum address of the memory through the address converter, so that the externally read data is empty. Address data to ensure that the data in the password area will not be read out. In addition, when the password verification reaches its operating address, the address converter converts the external address into the physical address of the password area in the memory, and compares the password read from this area with the password input from the outside. The verification passes, otherwise the verification fails.

Changing the access authority of the memory logical partition is realized by writing different values to the memory access authority control area. After the chip is powered on, the value in the memory access authority control area is sent to the memory access authority register 34 and latched by the memory access authority register 34 . The memory access right register 34 completely inherits the value of the memory access right control area, that is, a certain bit in the memory access right register defines the access right of the corresponding logical partition, and different values represent different access rights.

The five user data areas have their own independent access control methods, and each data area has multiple access rights, which are controlled by different bits in the memory access control area. Each data area corresponds to a different control bit, and the value of the control bit determines the access authority of the data area. Therefore, to change the access authority of the data area, it is only necessary to change the value of the corresponding control bit, so that the control method is very flexible. The corresponding relationship between control bits, user data area and access rights is shown in the following table: memory access control area data area access permission DF1 User Data Area 1 Read-only / read-write erase DF2 User Data Area 2 Read-only / read-write erase DF3 User Data Area 3 Read-only / read-write erase DF4 User Data Area 4 Read-only / read-write erase DF5 User Data Area 5 read/write/comparable

Inaccessible - the data in the memory cannot be read by external devices, nor can it be erased;

Read-only - the data in the memory can be read by external devices, but cannot be erased and modified;

Readable, writable and erasable - the storage unit can be repeatedly erased and written, and the written data can be read by external devices.

Comparable -- the data in the memory cannot be read by external devices, nor can it be modified. It can only be compared with externally input data inside the circuit.

The memory access authority controller 33 of the chip performs logic operations in combination with the value of the control bit in the memory access authority register in addition to performing logical operations on the logical partition indication signal and the operation indication signal when controlling access to the user data area.

Please refer to FIG. 7 , which is a schematic logic diagram of the memory access authority controller generating the control signal WE or ER. Now take the generation of the write signal WE as an example to illustrate. The indication signals FQ1~FQ5 of the user data area 1 to the user data area 5 first perform logic operations with the corresponding control bits in the memory access authority register, and the operation results CNTL1-CNTL5 are used to select Whether to allow the WE1 signal to pass through the memory access authority controller. As long as one signal in CNTL1-CNTL5 is valid, the WE1 signal is allowed to pass. That is, the WE signal is the same as the WE1 signal, and if the WE signal represents a write operation, then the corresponding unit of the memory can be written. If CNTL1-CNTL5 are all in an invalid state, the WE1 signal is not allowed to pass through, so that the WE signal remains in an invalid state all the time, and the memory cannot be written. The generation method of the erase signal ER is the same as that of the write signal WE.

When the 5th area is used as a password area, the values of FG and 5 control bits stored in the memory access control area can only be read but not rewritable under normal use, so write the control bit during the card issuance process The value cannot be modified at will, so as to ensure that the operation mode of the user data area corresponding to each control bit cannot be modified at will. For example, if a certain user data area is set as read-only during the issuance process, and a group of account numbers are stored in the user data area, then the chip will block all erasing and writing operations on the user data area during normal use to ensure that the The account number stored inside will not be accidentally modified, effectively inhibiting the invalidation of the card during use. However, the existence of the password provides a method for the operator to reliably rewrite the account number in the user data area. After the password verification is passed, the memory access control area can be read, written, and erased (that is, the value of the control bit is rewritten). Thereby changing the operation mode of its corresponding data area. When the operation mode of the user data area changes to read, write and erase, the account number stored inside can be modified.

The user data area disclosed above is divided into 5 areas, but it is not limited thereto. The user data area can be divided into several areas, such as 2-5 areas. One of the areas can be set as the password area. Considering that the addresses of the password area and other data areas are not continuous, the last area of the user data area can be used as the password area.

The password verification in the user mode has high security performance: 1. Before the password verification is passed, the password cannot be read, written and erased to ensure the confidentiality of the password; 2. The number of password verifications is limited (up to 8 times), To prevent the password from being exhaustively cracked; 3. The operation address of the password verification is not continuous with the address of the previous data area, and there is an address jump between them, which is conducive to the security of the password.

The above disclosure is only a specific embodiment of the present invention, but the present invention is not limited thereto. For those skilled in the art, various changes and modifications can be made to the above-mentioned embodiment without departing from the essence of the present invention , these should all be within the protection scope of the present invention.

Claims (11)

1. A method for controlling access rights to logical partitions of memory, comprising: (1) Setting a memory access control area in the memory, in which the access rights of each logical partition are set; (2) According to the value in the memory access control area, the judgment of the current working state of the chip is completed to control the access rights of each logical partition; (3) When the access authority of the logical partition needs to be modified, after the password verification is passed, the value in the memory access authority control area can be rewritten, thereby changing the access authority of each logical partition. 2. The method for controlling access authority of a logical partition of a memory according to claim 1, further comprising: setting one of the user data areas of the logical partition as a password area for storing passwords. 3. The method for controlling the access authority of the memory logical partition as claimed in claim 2, wherein the password verification in step (3) is specifically: a1: under the action of an external input signal, the address counter generates an operation address pointing to the password area; a2: Enter the password bit by bit in the password storage address, and the controller will compare the input password with the password stored in the password area. Only when the input password is exactly the same as the password stored in the password area, the password verification will pass. 4. The method for controlling the access authority of the memory logical partition as claimed in claim 3, characterized in that, between a1 and a2 of step (3), further comprising: judging whether a preset password comparison trigger condition is reached, if , proceed to step a2, otherwise exit. 5. The method for controlling the access authority of the memory logical partition as claimed in claim 1 or 2, wherein the value in the rewriting memory access authority control area in step (3) is specifically: b1: under the action of an external input signal, the address counter generates an address signal ADDR pointing to the memory access control area; b2: The decoder decodes the address signal ADDR; b3: select the memory access authority control area according to the address generated after decoding; b4: Use the operation type selected by the external input signal to read, write and erase the value in the memory access control area; b5: Modify the value corresponding to the memory access authority control area according to the external input information. 6. The method for controlling the access authority of the memory logic partition as claimed in claim 2, wherein the password area can be used as a data area for reading, writing, and erasing operations, and the value of the control bit corresponding to the area is used to set the The above area is used as a data area or as a password area. 7. The method for controlling the access authority of the memory logical partition according to claim 2 or 3, further comprising: the operation address of the set password verification is not continuous with the address of the data area adjacent to the password area, There are address jumps between them. 8. The method for controlling access rights of memory logical partitions according to claim 1 or 2, characterized in that step (2) is specifically: c1: Under the action of an external input signal, the address counter generates an address signal ADDR; c2: The decoder decodes the address signal ADDR; c3: Select the logical partition to access according to the address generated after decoding; c4: According to the combination type of external input signals, determine the operation type; c5: According to the setting value of the memory access control area, determine whether the selected logical partition can be read, written and erased. 9. An IC card, which has the function of controlling the access authority of the memory logical partition, including an address counter, a memory divided into a plurality of logical partitions, an I/O interface and a controller, and the logical partition of the memory contains a writable Enter the memory access control area of the access control word and several user data areas whose access rights are respectively determined by different control bits of the control word, it is characterized in that, The user data area includes a password area; The controller is used for judging the current working state of the chip according to the value in the access authority control area of the memory, completing the access authority control to each logical partition, and when the access authority of the logical partition needs to be modified, in the password verification After passing, the value of each control bit can be modified, thereby changing the access rights of each logical partition. 10. The IC card according to claim 9, wherein the controller comprises an address decoder, a logical partition selector, a memory access authority controller, a memory access authority register, and a memory access type determiner, wherein the memory The access authority controller is used to perform logical operations on the partition indication signal, operation indication signal and the value of the memory access authority register, and control the generation of the corresponding write enable signal, erase enable signal and read enable signal: if the logical partition prohibits the Access operation, the corresponding enable signal will not be generated, otherwise the corresponding enable signal will be generated, the read enable signal is invalid during the password verification process, the password in the password area can only be used for internal comparison, if the input password is the same as the The value of the access authority control area of the logical partition can be rewritten, thereby changing the access authority of each logical partition. 11. The IC card according to claim 9, further comprising an address changer, the address changer is connected to the address counter through the controller, performs address jump under the instruction of the controller, and sends the jumped address to address decoder.

Images