(12) United States Patent
`Conner et al.
`
`(10) Patent No.:
`(45) Date of Patent:
`
`US 7,350,717 B2
`Apr. 1, 2008
`
`US007350717B2
`
`(54)
`
`(75)
`
`(73)
`
`(*)
`
`(21)
`(22)
`(65)
`
`(60)
`
`(51)
`
`(52)
`(58)
`
`HIGH SPEED SMART CARD WITH FLASH
`MEMORY
`
`Inventors: Finis Conner, Carmel, CA (US);
`Robert Couse, Los Gatos, CA (US);
`An Van Le, San Jose, CA (US); Anil
`Nigam, Saratoga, CA (US)
`
`Assignee:
`
`Notice:
`
`Conner Investments, LLC, Carmel,
`CA (US)
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 35
`U.S.C. 154(b) by 0 days.
`Appl. No.: 11/400,578
`Filed:
`Apr. 7, 2006
`
`Prior Publication Data
`US 2007/O158439 A1
`Jul. 12, 2007
`
`Related U.S. Application Data
`Provisional application No. 60/741,614, filed on Dec.
`1, 2005.
`
`Int. C.
`(2006.01)
`G6K 9/06
`U.S. Cl. ....................... 235/492; 235/375; 235/451
`Field of Classification Search ................ 235/375,
`235/492, 451; 761/1
`See application file for complete search history.
`
`(56)
`
`References Cited
`
`U.S. PATENT DOCUMENTS
`6,168,077 B1 *
`1/2001 Gray et al. ................. 235,375
`6,439,464 B1* 8/2002 Fruhauf et al. ...
`... 235/492
`6,883,715 B1*
`4, 2005
`Fruhauf et al. ...
`... 235,492
`6,913,196 B2*
`... 235,451
`7/2005
`Morrow et al. .......
`6,988,250 B1* 1/2006 Proudler et al. ......
`... 439,630
`2006/0O25020 A1
`2/2006 Yu et al. ...............
`2006/0057974 A1
`3/2006 Ziarno et al. ................. 455.98
`
`- - - - - - T16.1
`
`
`
`* cited by examiner
`Primary Examiner Michael G. Lee
`Assistant Examiner Allyson N Trail
`(74) Attorney, Agent, or Firm Townsend and Townsend
`and Crew LLP
`
`(57)
`
`ABSTRACT
`
`A card and reader system is provided enabling larger storage
`capacity and faster data transmission. The card is configured
`in a Smart Card or SIM card format and communicates with
`either standard Smart Card readers or specially configured
`readers capable of higher data transmission speeds. Elimi
`nating the processor from the card and including it in the
`reader allows the cost of the card to be reduced. A software
`driver installed in existing Smart Card readers enables the
`additional storage capability of the card to be concealed
`from the reader, thereby eliminating a need to replace
`readers already deployed.
`
`16 Claims, 6 Drawing Sheets
`
`
`
`1, 2 - A
`
`Smart Card
`
`Reader () ISO7816
`
`Connector
`
`SO7816
`Interface
`Controller
`
`High speed
`Interface
`Controller
`
`Interface
`switch
`
`Flash Memory
`(NOR or
`NAND)
`
`Flash
`Memory
`Controller
`
`Command
`Controller
`
`Authentication
`controller
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 1 of 13
`
`

`

`U.S. Patent
`
`Apr. 1, 2008
`
`Sheet 1 of 6
`
`US 7,350,717 B2
`
`
`
`FIG. 1
`
`FIG. 2
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 2 of 13
`
`

`

`U.S. Patent
`
`Apr. 1, 2008
`
`Sheet 2 of 6
`
`US 7,350,717 B2
`
`
`
`
`
`
`
`©SRS,SRS,SR
`
`<X><XXX<><><><><><><×××××××××××××××××××××××××××××××××××
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 3 of 13
`
`

`

`U.S. Patent
`
`Apr. 1, 2008
`
`Sheet 3 of 6
`
`US 7,350,717 B2
`
`
`
`(CINVN
`JO YJON)
`ÁJOUue W use|-
`
`:: -
`
`(-)
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 4 of 13
`
`

`

`U.S. Patent
`
`r.
`
`pA
`
`Mm1,
`
`M4mhS
`
`2B71709
`
`28055283025SE6:92808:m.GE
`
`
`
`
`Loyowccoo5:95:00_m_l_mm._o9.5On_pmc‘E0~mnt
`
`
`
`0036:“mo:
`
`«(om
`
`
`
`6.003025“mo:
`
`momtEEmvwwH._>_00:90:00I“mo:
`00:05:00.5:0E0089A030mmDV
`
`
`4.»
`
`“0000007,030I00mo$50.5E20?:m.mEl
`
`_>_<mw20m
`
`(“N
`
`GOOGLE LLC V. RFCYBER CORP. / Page 5 of 13
`
`GOOG-1021
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 5 of 13
`
`
`

`

`U.S. Patent
`
`Apr. 1, 2008
`
`Sheet 5 of 6
`
`US 7,350,717 B2
`
`mrmnOQ
`
`0900580
`
`
`
`00000:91
`
`momtBE
`
`00:20:00
`
`900I250052020
`
`Lowwwoogl
`
`
`
`womtEE“mo:
`
`00:90:00
`
`02018m30%
`
`28AHV
`09,005.00
`orwnofl
`
`
`
`00000:9:
`
`momtBE
`
`00:03:00
`
`
`
`ESgEooEoS00:20:00
`
`025508003
`
`
`
`000:03“00:
`
`030058030
`
`8000020
`
`2,.GE
`
`GOOGLE LLC V. RFCYBER CORP. / Page 6 of 13
`
`GOOG-1021
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 6 of 13
`
`
`
`
`
`
`
`

`

`U.S. Patent
`
`Apr. 1, 2008
`
`Sheet 6 of 6
`
`US 7,350,717 B2
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Host Application
`
`Operating System (OS)
`
`Device Driver
`
`Existing Smart
`Card Reader
`
`32
`
`33
`
`34
`
`2O
`
`FIG 11
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 7 of 13
`
`

`

`1.
`HIGH SPEED SMART CARD WITH FLASH
`MEMORY
`
`US 7,350,717 B2
`
`CROSS REFERENCE TO RELATED
`APPLICATION(S)
`
`This application claims priority from U.S. Provisional
`Application No. 60/741,614, filed Dec. 1, 2005, and entitled
`“High Speed Smart Card with Flash Memory.”
`
`10
`
`BACKGROUND OF THE INVENTION
`
`15
`
`25
`
`30
`
`This invention relates to credit card size devices which
`include microprocessors and memory, often referred to as
`Smart Cards. In particular this invention relates to those
`cards required for secure transactions, and which require a
`large local data storage capability. Smart Cards are widely
`used in Europe as bank cards, health insurance cards, debit
`cards, and phone cards. They are also used to provide access
`to corporate networks and for other similar applications. The
`Smart Card architecture is conventionally based upon the
`ISO 7816 standard and requires a reader mechanism, in
`which the Card must be placed, for operation. This reader
`mechanism has minimal functionality, with all of the data
`processing and storage being performed by the micropro
`cessor and memory in the Smart Card. The ISO 7816
`interface utilizes six (6) contacts which are arranged on the
`Surface of a the plastic card and allow data to be exchanged,
`usually at a maximum speed of about 116 kilobits per
`second.
`Smart Cards are commercially available as memory only
`cards with 1 kilobyte (KB) to 256 KB of read/write storage;
`or with a microcontroller usually based on the 8051 or ARM
`35
`architecture. The microcontroller based Smart Cards cost
`more and provide on-card data processing to achieve high
`security. The computing power, storage capacity and the
`speed at which data can be exchanged is limited by the
`electronic in the card, all of which must be contained within
`a thin plastic structure. The relatively high cost of these
`cards has limited their popularity in the United States, with
`the result that cheap magnetic stripe credits cards with 140
`bytes of read only storage remain the dominant instrument
`for consumer credit/debit transactions, driver licenses, and
`access controls to facilities and networks.
`A Smart Card with both a USB and ISO 7816 interface
`has been developed. For example, see the e-gate Smart
`Cards sold by Axalto. Another Smart Card sold by Sharp Inc
`has a microcontroller additional digital logic to support a
`USB interface and 1 MB of Flash memory storage. USB
`data transfer is implemented utilizing the remaining two
`contacts in the eight pad Smart Card connector with a
`maximum data transfer speeds of about 1.5 Mbits/second
`because of power and heat limitations. Such performance is
`considered slow for a content download device in which
`entertainment or other information is stored on the device
`for presentation to a user. Although the microcontroller for
`these newer cards is more powerful than in prior genera
`tions, the throughput is poor for emerging applications such
`as digital right management.
`The growth of the Internet as a delivery medium has
`created a need for a local data storing card with large
`capacity, and which is secure, rugged and as convenient as
`a Smart Card, but has fast data transfer speed for quick
`transaction times and "off-line' debit/credit transaction
`capability.
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`2
`BRIEF SUMMARY OF THE INVENTION
`
`We have developed a small portable card that is as secure,
`rugged and convenient as a Smart Card, but which has large
`storage capacity for storage of Substantial quantities of
`information, fast data transfer speed for quick transaction
`times, and “off-line' debit/credit transaction capability. The
`card enables the use of available Internet based services such
`as "pay-per-view' programs for downloaded content, books,
`games, songs and movies. Additionally, government Ser
`vices can be enhanced utilizing the card as a driver license
`or social security card, potentially with biometric informa
`tion securely stored thereon to authenticate a user of the
`card. Other uses for Such a card include storage of medical
`records that remain in the possession of the patient, and
`more Stringent access controls based upon multiple biomet
`ric verifications.
`This invention provides an architecture for a fully ISO
`7816 compliant card with an order of magnitude higher data
`transfer speed, computing power and data storage capacity.
`The cost of the card is small with minimal electronics
`installed, with the bulk of the electronics implemented in the
`reader mechanism, where a faster microprocessor with a
`Sophisticated operating system can be utilized, and replaced
`as Subsequent generations of microprocessors provide
`higher speed and additional features. The architecture of the
`card enables low cost of manufacture.
`Typical Smart Card applications include multiple cards,
`each of which operates in a specific reader mechanism,
`making it important to the customer to have a low cost card.
`An additional feature of the card described herein is that it
`is fully compatible with existing Smart Card readers. Hard
`ware authentication is implemented in the card with unique
`keys installed in the card and the reader during the person
`alization process. The combined system of card and reader
`is organized to achieve security at least equivalent to the
`Smart Card.
`In Summary, this invention provides a card in the same
`form factor as a Smart Card or a SIM Card, with a unique
`reader with the features enabling high data transfer speeds
`(e.g. 2500 megabits per second); on card secure read and
`write storage of large amounts of data (e.g. 8 megabytes),
`and 256 bit AES encryption and decryption at these transfer
`speeds. In some implementations, the reader also includes a
`high performance microprocessor Such as an ARM 11 or
`XScale. Data Zones in the card memory may be configured
`as unprotected, authenticated-access only, and/or authenti
`cated access with encryption. The card is functional in
`standard Smart Card readers, although at the reduced data
`speeds of Such readers. The card includes security and
`authenticated access suitable for “off-line' credit/debit func
`tionality, digital rights management, and other applications
`Such as for passports and storage of medical information.
`The card operates in environments including PCI, USB,
`Ethernet, Wi-Fi, and broadband.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`FIG. 1 is a plan view of a card of an embodiment of this
`invention conforming to ISO 7816 size and format;
`FIG. 2 is a plan view of a card of an embodiment of this
`invention conforming to SIM card size and format;
`FIG. 3 is a cross section of the electronic modules on the
`card when arranged side-by-side;
`FIG. 4 is a cross section of the electronic modules on the
`card when arranged one-atop-the-other,
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 8 of 13
`
`

`

`US 7,350,717 B2
`
`3
`FIG. 5 is a block diagram illustrating the internal archi
`tecture of the card;
`FIG. 6 is a diagram illustrating the ISO 7816 connector
`contact pad arrangement and in parentheses the pad assign
`ments of an embodiment of this invention;
`FIG. 7 is a block diagram of an embodiment of the
`architecture of a prior art reader for the card;
`FIG. 8 is a block diagram of a prior art reader for the card
`with a USB interface to the host;
`FIG. 9 is a block diagram of a first embodiment of an
`architecture for a high speed reader,
`FIG. 10 is a block diagram of a second embodiment of an
`architecture for a high speed reader,
`FIG. 11 is a diagram illustrating software and hardware
`modules of the card installed in a reader.
`
`DETAILED DESCRIPTION OF THE
`INVENTION
`
`4
`during execution of an authentication protocol stored in the
`command controller 8 and/or the authentication controller 7.
`This allows card 1 to be installed in an industry standard
`Smart Card reader, or in a special high speed reader, as
`described below. The two interfaces are managed by inter
`face switch 6 which directs the reader commands and data
`as appropriate to the command controller 7, the authentica
`tion controller 8, and the flash memory controller 9. Accord
`ing to the commands the controller 9 stores or retrieves the
`data from flash memory 10. Flash memory 10 can be
`arbitrarily large, for example, providing from multiple
`megabytes to multiple gigabytes of storage. This architec
`ture gives the card system minimal complexity, and it can be
`implemented at low cost with maximum compatibility, flex
`ibility, large storage, and high performance.
`As mentioned, the card interface Switch 6 automatically
`detects which type of reader (standard or high speed) is
`connected to card 1. This is accomplished by having the
`interface switch 6 check the presence of the ISO 7816 clock
`or the high speed interface data to determine which interface
`to use during a communication sequence. Initially high
`speed interface controller 12 uses the two contacts C4, 13,
`and C 8, 14 (shown in FIG. 6) on the standard ISO 7816
`interface connector 3 in a single-ended configuration at a
`reduced data rate to transfer initialization information. If the
`high speed mode is selected, then the clock contact C3, 15,
`and I/O contact C7, 16, are also used with the previously
`used contacts C4, 13, and C8, 14, to enable a high speed
`differential signal interface. The differential signal arrange
`ment is one in which the signals are transmitted by two lines,
`instead of a single ended arrangement where the single is
`usually referenced to ground potential. The differential con
`figuration provides better noise immunity and allows higher
`communication speeds.
`For low-cost implementations, interface switch 6, flash
`memory controller 9, command controller 7, and authenti
`cation controller 8 can be implemented in an ASIC or a
`custom IC. In applications where it is desirable to use an
`existing Smart Card IC Such as a Cryptomemory IC (manu
`factured by Atmel), however, the functions of command
`controller 7 and authentication controller 8 are replaced by
`the logic of the IC. In other embodiments the function of
`command controller 8 and the authentication controller 7
`can be implemented utilizing commercially available 8 bit
`Smart Card ICs such as the SmartMX family of ICs sold by
`Philips Semicondutor. Employing an available Smart Card
`IC can provide an advantage, particularly if desirable Secu
`rity protection features are already implemented within Such
`an IC. This eliminates the need for these functions in the
`digital logic of interface Switch 6, thereby simplifying its
`design.
`As previously described, card 1 can be used in both
`industry standard and high speed readers, such as a reader
`described below. An industry standard Smart Card reader 20,
`shown in FIG. 7, interfaces to a host using any desired PC
`bus interface (PCI, ISA, serial port) via an interface con
`troller 17. It also includes an ISO 7816 interface controller
`18 which is used to send and receive the protocol packets to
`and from a typical Smart Card via connector 19. Connector
`19 interfaces with contact pads 3 located on the card when
`the card is inserted in the reader mechanism. The host
`manages the two controllers and the ISO 7816 protocol
`using a device driver, and the data and user information
`passes directly between these two interfaces. An industry
`standard USB interface Smart Card reader 21 is shown in
`FIG. 8. It consists of a microcomputer 22 that manages the
`ISO 7816 and USB protocols, the 7816 interface controller
`23, and USB interface controller 24. The legacy architec
`
`10
`
`15
`
`25
`
`30
`
`This invention provides a secure storage system config
`ured as a Smart Card or as a SIM Card. It provides a
`high-capacity storage capability on the card with interfaces
`for communicating with an external reader. These interfaces
`can include a conventional Smart Card interface according
`to the ISO 7816-3 standard, a high speed interface that
`allows an external reader to access the memory on the card,
`and an interface switch unit which multiplexes the ISO
`7816-3 contacts to enable both a high speed interface with
`dual differential signals and the standard ISO 7816-3 inter
`face.
`The invention also provides a reader mechanism that
`interfaces with the high capacity storage device Via the
`interfaces described above, and a software module running
`on a host PC. The software provides customizable security
`oriented applications that utilize the storage device and the
`35
`reader.
`FIG. 1 is a diagram illustrating a preferred embodiment of
`card 1 in a Smart Card format. FIG. 2 illustrates an imple
`mentation of the card 2 in a SIM card format. In each case
`the electrical contacts 3 to the card are arranged according
`to the appropriate standard. The physical dimensions of card
`1 shown in FIG. 1 are 85.6 mmX53.98 mmx0.8 mm. The
`dimensions for SIM card 2, shown in FIG. 2, are 25mmx15
`mmx0.8 mm.
`As shown in FIGS. 3 and 4 two integrated circuit (IC) die
`4 and 5 are arranged on card 1 below the contact pad
`structure 3, one providing CMOS logic 4 and the other
`providing flash memory 5. In one embodiment NOR flash is
`used as the storage, although other embodiments will
`employ NAND flash. It is also possible for flash memory 5
`to be integrated into the logic block 4, however, presently
`50
`most flash memory is manufactured with a different manu
`facturing process than logic 4, making the cost of Such a
`device higher than the two die arrangement shown in FIGS.
`3 and 4.
`Typically, NAND flash memory die are larger than NOR
`55
`flash die. Thus a configuration as shown in FIG. 4 with the
`die 4 and 5 in a stacked arrangement under the metal
`contacts 3 can help prevent handling damage. If desired, the
`IC die can be potted using security glue to attempt to
`preclude probing of individual contact pads on the die to
`reveal the stored information. The IC dies can be arranged
`in a side-by-side mounting as shown in FIG. 3 or atop each
`other as shown in FIG. 4.
`The hardware architecture of card 1 is shown in FIG. 5.
`As shown, a standard ISO 7816 connector couples the reader
`(not shown) to an interface controller 11 or 12. In the
`depicted embodiment card 1 has two interfaces—an ISO
`7816 and a high speed interface. The choice is selectable
`
`40
`
`45
`
`60
`
`65
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 9 of 13
`
`

`

`5
`tures for the Smart Card and the USB readers are designed
`to minimize the cost of the reader, and operate at low data
`transfer rates.
`Two preferred embodiments for high speed reader archi
`tectures are shown in FIGS. 9 and 10. A first high speed
`reader 25A (referred to herein as a type 1 reader) shown in
`FIG. 9 is connected directly to the host through either a PC
`bus or PCI-X bus interface 26. The host manages the host
`interface 26, the cryptographic processor 27, the ISO 7816
`controller 28, and the ISO 7816 communication protocol of
`the card, e.g. card 1, utilizing an appropriate device driver
`installed in the host. ISO 7816 protocol packets and data are
`sent to and from card 1 through high speed interface 28,
`cryptographic processor 27, and host interface 26. The data
`path allows for high speed transfers controlled by the PCI or
`PCI-X interface. Data encryption and decryption is imple
`mented in hardware module 27, for example using an AES
`engine.
`
`10
`
`15
`
`US 7,350,717 B2
`
`6
`is to have encrypted data for higher security (referred to as
`the “encrypted Zone'), cryptographic processor 27 will
`implement the encryption and decryption engine (e.g., AES
`engine) along with the authentication mechanism. Further
`more, if the authentication mechanism is based on public
`key cryptography (also known as asymmetric cryptogra
`phy), the cryptographic processor 27 may implement a
`public key accelerator to reduce time-intensive asymmetric
`cryptographic operations. Those skilled in the art will rec
`ognize that for the type 2 high speed reader 25B, there are
`various ways to divide the security features between the
`microcomputer 29 and the cryptographic processor 27.
`For large storage capacity cards, high speed data transfer
`is more important. The standard Smart Card reader 20, using
`the ISO 7816 interface 18, can access small amounts of data
`within a convenient time period, however, to load large data
`files a high speed interface is necessary to achieve conve
`nient transaction times, for example, as shown in Table 1.
`
`TABLE 1.
`
`Data Transfer Performance
`
`Card interface
`
`Data Transfer
`Rate (Mbit/sec)
`
`Transfer Time
`8 Mbytes
`
`256 Mbytes
`
`1 Gbyte
`
`ISO 7816
`rapid I/O
`SDI
`SPI
`
`1SO
`12SO & 2SOO
`52
`50
`
`557 sec (9.3 m)
`.05 & .03 sec
`1.23 sec
`1.28 sec
`
`17809 sec (297 m)
`1.6 & 82 sec
`39 Sec
`41 sec
`
`69565 sec (1159 m)
`6.4 & 3.2 sec
`154 sec
`169 sec
`
`Another high speed reader architecture (referred to as a
`type 2 reader) 25B is shown in FIG. 10. Instead of relying
`on the processing power of the host, it uses microcomputer
`29 to handle the ISO 7816 protocol, and to control the
`operations of cryptographic processor 27 and high speed
`controller 28. In this implementation microcomputer 29
`provides the setup for the logic modules 27, 28 and 31. Once
`the setup is complete microcomputer 29 is not in the data
`path, allowing this to be controlled by the host interface
`controller 31 to achieve very high data transfer speeds. One
`advantage of this architecture is that no device driver is
`required on the host system.
`In either of the implementations discussed above, the
`capability of cryptographic processor 27 can vary, depend
`ing on the nature of the security application. For example, if
`an application partitions the data Zones in the flash memory
`into just two Zones—(1) an unprotected Zone and (2) an
`authenticated access only Zone, then cryptographic proces
`sor 27 may only need to implement the authentication
`mechanisms. In this case, no encryption engine is required.
`This may be desirable if the cost of the type 1 reader 25A is
`to below. On the other hand, if the authenticated access Zone
`
`35
`
`40
`
`45
`
`50
`
`In one embodiment card 1 uses the ISO 7816 interface
`connector 3 as shown in FIG. 6 to implement a rapid I/O
`interface between the card and either of the high speed
`readers 25A or 25B. The rapid I/O interface is capable of at
`least a 2500 Mbit/sec data rate when implemented using
`CMOS 90 micron or smaller gate geometry digital logic in
`high speed controller 28 and the interface switch 6.
`Currently available NAND flash memory supports a
`maximum data transfer speed of about 800 megabits per
`second. which the rapid I/O can easily support. Slower data
`rate implementations for lower capacity embodiments of
`card 1 can use the industry standard serial flash memory
`interface SPI or the SDI interface, resulting in data transfer
`speeds of 50 megabits per second.
`Reader 25B has a high speed data path. The host interface
`controller 31 can use a USB 2.0, Ethernet, PCI, or PCI-X
`interface. USB 2.0 is a popular personal computer interface
`and can be used for data speeds up to about 480 Mbits/sec.
`Ethernet and 802.11g can be used in large area networks
`with the reader located at a distance from the host computer,
`while PCI and PCI-X can be used for internally mounted
`readers.
`
`TABLE 2
`
`Interface Performance
`
`Host interface
`
`USB 2.0
`USB 1.1
`
`Max. Transfer
`Rate
`(megabits per Transfer Time
`second)
`8 Mbytes
`
`256 Mbytes
`
`1 Gbyte
`
`480
`12 & 1.5
`
`16 sec
`4 sec
`0.13 sec
`5.3 sec (09 m) & 171 sec (2.8 m) 667 sec (11 m),
`43 sec (0.71 m)
`1365 sec (23 m) 5333 sec (89 m)
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 10 of 13
`
`

`

`US 7,350,717 B2
`
`7
`
`TABLE 2-continued
`
`Interface Performance
`
`Max. Transfer
`Rate
`(megabits per Transfer Time
`Second)
`8 Mbytes
`
`256 Mbytes
`
`1 Gbyte
`
`100, 1000,
`1OOOO
`2SOO
`533
`S4
`
`0.64, 0.06, 0.01 sec 20, 2, 0.2 sec
`
`80, 8, 0.8 sec
`
`.03 sec
`0.12 sec
`1.2 sec
`
`.82 sec
`3.8 sec
`38 sec
`
`3.2 sec
`15 sec
`148 sec
`
`Host interface
`
`Ethernet
`
`PCI-X
`PCI-66
`Wireless 802.11g
`
`15
`
`25
`
`30
`
`35
`
`The basic operations of the type 2 high speed reader 25B
`illustrated in FIG. 10 are described next. Assume card 1 has
`been inserted into reader 25B. Using firmware in the micro
`computer 29, it and card 1 establish a secure session during
`which (a) they mutually authenticate each other and (b) card
`1 transfers the secret and partial encryption and decryption
`parameters that it holds in its secure storage registers located
`in command controller 7. The microcomputer 29 combines
`the secret and partial encryption and decryption parameters
`it received from card 1 with the secret and partial encryption
`and decryption keys stored in a physically protected memory
`area of microcomputer 29 or in the cryptographic processor
`27. The derived information in one embodiment is the
`decryption key for the information stored in the secure
`memory of card 1, as well as user authentication data. This
`information is stored in the secure areas of these logic blocks
`during the first initialization sequence for both the reader
`and the card.
`After the reader and card have established a secure
`channel the user is authenticated by card 1 using a protocol
`implemented in authentication controller 8. Authentication
`of the user takes place by comparing a password phase
`previously established by the user and stored in the secure
`memory Zone of authentication controller 8 with a password
`entered by the user in the host. Then, the host application
`40
`issues commands to the reader via the host interface con
`troller 31 to read or write data to the card 1. The commands
`are encapsulated in the Application Protocol Data Unit
`(APDU) which is the structure of the communication data
`word defined by the ISO 7816-3 standard and transmitted to
`reader 25B via a transport layer. The information is trans
`mitted as commands. Microcomputer 29 determines if the
`data is being read from, or written to, the card and whether
`it needs to be decrypted or encrypted.
`Upon the Successful completion of the authentication
`sequence if a write operation request is received, the data is
`received from the host by the host interface controller 31.
`That controller 31 forwards the data to cryptographic pro
`cessor 27. If the data is to be stored in the encrypted Zone,
`based on the parameters that have been setup by microcom
`puter 29, cryptographic processor 27 encrypts the data that
`passes through it. The resulting encrypted data is then
`forwarded to high speed interface controller 28, for transfer
`to card 1. If the data is to be written to the unprotected Zone
`or the authenticated access only Zone of the memory on card
`1, no encryption of data will be performed, and the data will
`be routed to high speed interface controller 28 without being
`processed by the processor 27, and then transferred to card
`1.
`If the storage access request is for a read operation, the
`data retrieved from flash storage 10 on card 1 is directed by
`interface controller 28 to cryptographic processor 27. If the
`
`45
`
`50
`
`55
`
`60
`
`65
`
`data is retrieved from the encrypted Zone, cryptographic
`processor 27 will decrypt the data, using the decryption
`parameters previously setup by microcomputer 29. The
`resulting decrypted data is directed to host interface con
`troller 31 for transmission to the host. On the other hand, if
`the data is retrieved from the unprotected Zone or the
`authenticated access only Zone, no decryption of data is
`necessary, and the data is directed to host interface controller
`31 for transfer to the host.
`In addition to the ability to perform authentication, high
`speed encryption and decryption, and other Sophisticated
`cryptographic operations, high speed reader 25B allows a
`card issuer, third party developer, or users, to develop
`custom applications and load them into the code store of
`microcomputer 29 for subsequent execution to carry out the
`intended tasks.
`The operational features of the type 1 high speed reader
`25A are similar to those of the type 2 reader 25B. In the type
`1 reader 25A, however, the host computer performs the
`setup configuration of the logic blocks 26, 27 and 28 as
`described above. A type 1 reader is particularly useful in
`environments where card 1 operates with a secure host.
`The systems described above provide numerous advan
`tages over known storage devices such as conventional
`32-bit Smart Cards capable of performing encryption and
`decryption and USB storage devices with flash-based stor
`age and high speed encryption and decryption logic. In
`particular, in these prior art devices, the encryption engine
`that resides on the Smart Card or the USB storage device
`adds significantly to the cost of the removable-transportable
`medium. In contrast, the card provided herein need not
`include the cryptographic engine because it is provided in
`reader 25A or 25B. Thus, card 1 is less expensive to
`manufacture. Presently this price difference is significant for
`storage devices of medium capacity, for example, devices
`having on the order of 64 megabytes or less. In applications,
`such as health cards where the number of cards to be
`deployed is large, the system of this invention provides a
`significant cost benefit because a large number of cards can
`be purchased less expensively, and a significantly smaller
`number of high speed readers 25A or 25B need to be
`acquired.
`The security of the typical Smart Card or USB “dongle'
`is contained on the device. Thus, if a user loses the card or
`the dongle, an adversary need only attack this device to
`reach potentially sensitive data stored therein. In contrast,
`for the card and reader system described herein, security is
`distributed between the high speed reader 25A (or 25B) and
`card 1. To Successfully reach the data stored on card 1, an
`adversary must breach the security of both card 1 and high
`speed reader 25A (or 25B).
`
`GOOG-1021
`GOOGLE LLC v. RFCYBER CORP. / Page 11 of 13
`
`

`

`10
`
`15
`
`25
`
`30
`
`As described below, Support for legacy applications can
`be achieved with card 1. The operation of card 1 in con
`junction with an industry standard Smart Card reader 20 and
`a host application 32 is illustrated in FIG. 11. Device driver
`34 is a software module that resides under the operating
`system layer 33 of the host software, and interfaces with
`card 1 via reader 20. It establishes a handshake with inter
`face switch 6 of card 1. This operation includes performing
`the authentication protocol contained in logic blocks 7 and
`8. Then it translates operations that access typical Smart
`Card operations in APDUs (Application Protocol Data
`Units) based on the 7816-3 protocol. These translate opera
`tions access the high capacity flash module 10 of card 1
`using vendor unique Smart Card APDUs based on the
`7816-3 protocol.
`When interface switch 6 of card 1 establishes a handshake
`with device driver 34, the controller checks the communi
`cation protocol. If it finds an ISO 7816-3 serial protocol,
`then the card "knows” that the reader is a standard Smart
`Card reader 20. If it finds a different protocol then it can
`react accordingly. Once interface switch 6 determines the
`reader type, it then processes the 7816-3 APDUs in the
`manner below.
`If the APDU is a Smart Card command intended for a
`typical Smart Card function, interface switch 6 routes the
`command to command controller 7 and authentication con
`troller 8. It then forwards the result, and or the status of the
`command execution, back to the reader via the 7816-3
`protocol. If the APDU contains a storage request to access
`flash memory 10 of card 1, interface switch 6 translates the
`APDU into a storage command and forwards it to the flash
`memory controller 9. After the flash memory controller 9
`returns the result and/or status of the command execution,
`interface switch 6 formats the returned information into a
`valid APDU format and sends this information to the reader
`via the 7816-3 protocol.
`A software driver is a type of computer software that
`allows interaction with hardware devices. Typically the
`driver provides an interface for communicating with a
`device through a specific computer bus or communications
`subsystem to which the hardware is connected. The driver
`provides commands to and receives data from the device,
`and on the other end, provides an interface to the host
`operating system and Software applications