Method for managing access rights in a smart card
View Patent ↗A method of managing access rights in a smart card, to subordinating execution of a command (Cmd 1 , Cmd k ) such as reading or writing to an event (Evt 1 ′, Evt k ′) being valid, such as authentication by verifying a code. The state of validation events is stored in a register, and the access rights are stored in a command list (List_Cmd) made up of couples (Cpl 1 , Cpl k ), each associating a command with an event. On receiving a request to execute a command, a search is made in the command list (List_Cmd) for the couple (Cpl 1 , Cpl k ) that includes the requested command, and execution is refused if the search is unsuccessful. If the search is successful, then it is determined from the register (referred to as the card security state register) whether the event associated with the command is or is not valid, in order to authorize or refuse execution thereof. The invention is for use in any smart card application that involves access rights.
1. A method of managing access rights associated with smart card data so as to subordinate execution of a command (Cmd 1 , . . . , Cmd k ) such as a command to read said data, to a logical combination of a plurality of events (Evt 1 ′, . . . , Evt k ′) detected by the card being valid, such as authentication by verifying a code;
wherein the validation state of each event (Evt 1 , . . . , Evt N ) is kept up to date in a security state register of the card ({Evt a , Evt b , . . . , Evt x });
wherein the access rights to a data set are stored in a command list (List_Cmd) that is associated with an event list (List_Evt) that gives, for each event it includes, an identifier for that event;
the command list being made up of couples (Cpl 1 , . . . , Cpl k ), each associating a command (Cmd 1 , . . . , Cmd k ) with a logical combination of events that must be valid, which combination is defined by the rank in the event list (List_Evt) of each of the events making up said combination;
wherein on receiving a request to execute a command (C) on a data set, the authorization or refusal to execute said command is established:
by searching in the command list (List_Cmd) associated with said data for the couple (Cpl 1 , . . . , Cpl k ) including the requested command (C), and refusing execution if the search is unsuccessful; and
if the search is successful, by determining from a security state register of the card whether the combination of events (Evt 1 ′, . . . , Evt k ′) associated with the command (C) is or is not valid in order to authorize or refuse execution of the command (C).
2. The method according to claim 1 , wherein each command (Cmd 1 , . . . , Cmd k ) stored in the command list (List_Cmd) is coded in the form of a binary word representative of an identifier of the command (Cmd 1 , . . . , Cmd k ).
3. The method according to claim 1 , wherein the event list (List_Evt) also includes one or more event combinations, each combination being defined therein by the rank in the event list (List_Evt) of each of the events making up said combination, said list being ordered in such a manner that each logical combination of events is situated after the events that make it up.
4. The method according to claim 1 , wherein the event list (List_Evt) begins by a binary word representative of the number (N DAC ) of events and combinations of events contained in said list.
5. The method according to claim 1 , wherein each event or event combination (Evt 1 , . . . , Evt k ) stored in a list is coded in the form of a binary word beginning with a first binary flag (Spl/Cps) indicating whether it relates to an event or a logical combination of events.
6. The method according to claim 5 , wherein each binary word corresponding to an event (Wd_Evt_Spl) includes the identifier of said event coded at the end of the word (S-P 2 ).
7. The method according to claim 5 , wherein each word corresponding to a logical combination of events (Wd_Evt_Cps) comprises a series of binary flags situated at the end of the word (S-Rg), in which each binary flag of value “ONE” indicates that the event having, in the event list (List_Evt), the same rank as said flag in the series (S-Rg) forms part of said logical combination of events.
8. The method according to claim 5 , wherein the second binary flag (OR/AND) of each word corresponding to a logical combination of events (Wd_Evt_Cps) indicates whether it relates to a conjunctive or to a disjunctive logical combination.
9. The smart card including means for implementing the method according to claim 1 .