VPP 5-25 C 70 C ESD > 4K

Size: px

Start display at page:

Download "VPP 5-25 C 70 C ESD > 4K"

Lily Morton
5 years ago
Views:

Features K x Serial POM With Security Logic Available in Two Memory Organizations: AT88SCK x Memory Zone AT88SC5 x Memory Zone Supports ISO/IC 786-3 Synchronous Protocol Stores and Validates Security

1 Features K x Serial POM With Security Logic Available in Two Memory Organizations: AT88SCK x Memory Zone AT88SC5 x Memory Zone Supports ISO/IC Synchronous Protocol Stores and Validates Security Codes Counts Incorrect Security Code Attempts Provides Transport Code Security Manufactured Using Low Power CMOS Technology VPP Internally Generated µs ead Access Time; 5 ms Write Cycle Time Temperature ange From -5 C to 7 C SD Immunity > 4K Volts High eliability:, Write/rase Cycles Years Data etention Block Diagram Smart Card ICs K POM with Security Logic AT88SC AT88SC Description The AT88SC/ family provides 4 bits of serial POM (lectrically rasable and Programmable ead Only Memory) with additional security logic for use in secure smart card applications. The AT88SC is available in one 4 x bit memory zones, and the AT88SC is available in two 5 x bit memory zones. ISO Card Configuration ISO Contact Pad # Pad Name Description C 8 V CC Operating Voltage C 7 ST eset C3 6 CLK Clock and Address Control C4 5 FUS Identification Fuses C5 V SS Ground C6 NC No Connect C7 3 I/O Bi-directional Data Port C8 4 PGM Programming Control Card Module Contacts V cc ST CLK FUS C C5 C C6 C3 C7 C4 C8 V ss N/C I/O PGM

2 The security features of Atmel s AT88SC/ include: data access only after validation of the security code permanent invalidation of device upon four consecutive false security code presentations read/write protection of certain memory zones device reset if power drops secure transport of devices using transport code compare sequence The AT88SC/ is manufactured using low-power CMOS technology and features its own internal high-voltage pump for single voltage supply operation. The devices are guaranteed to, erase/write cycles and year data retention. ndurance up to one-million AT88SC and AT88SC Memory Map AT88SC AT88SC Memory Partitions Address Bits Address Bits Fabrication Zone (FZ) Issuer Zone (IZ) Security Code (SC) Security Code Attempts Counter (SCAC) Code Protected Zone (CPZ) Application Zone (AZ) Application Zone rase Key (Z) Application Zone (AZ) Application Zone rase Key (Z) rase Counter (C) Memory Test Zone (MTZ) TOTAL BITS Definition of AT88SC/ Memory Partitions FABICATION ZON (6 bits): Programmed by the manufacturer with a specific identifier for each customer. FUS is blown by the manufacturer after programming the fabrication code, which makes the fabrication zone unalterable. ISSU ZON (64 bits): Programmed by the issuer before finalizing personalization. The data stored in the issuer zone is unalterable after FUS is blown. SCUITY COD (6 bits): Must be presented by the issuer to access circuit memory and personalize device before blowing FUS. This secures transportation between the manufacturer and the issuer. After the device is personalized and FUS is blown, this code protects the access to the application zone(s) of the card. SCUITY COD ATTMPTS COUNT (6 bits): Counts the number of incorrect security code attempts. The device is locked after 4 false presentations. US POTCTD ZON (64 bits): Writing and erasing this zone is protected. The number of program/erase cycles is guaranteed up to,. APPLICATION ZON(S) (4 or 5 bits): eading and programming the application zone(s) are controlled by the first bits of the zone (P, D) and by the security code (Tables and ). The erasure of each zone is protected by an erase key specific to each zone. APPLICATION ZON AS KY (3 or 48 bits): Must be presented to authorize the erasure of the application zone(s). The key(s) must be programmed during the personalization of the circuit. AS COUNT (8 bits): Limits the number of erasures of the last zone to 8 or less. MMOY TST ZON (6 bits): Allows pattern testing at this memory location. AT88SC/

3 AT88SC/ Memory Access to AT88SC and AT88SC The access to the memory is controlled by the state of the internal fuses and by the voltage supply applied on the FUS pad: FUS Pad Voltage State of the FUSS FUS FUS Access Conditions See: V ither ither Table 5V Blown Not Blown Table 5V Blown Blown Table Table. AT88SC/ Access Conditions During Personalization (FUS Not Blown) Zones S C P D P D Z Z C AD WIT (rase) WIT (POG) Compare FZ IZ SC SCAC CPZ AZ Z AZ Z C MTZ Notes: SC:SC = after validation of security code D: nd bit of AZ (Bit 737) - AT88SC only P:st bit of AZ (Bit 76) Z: Z = after a valid presentation of erase key D:nd bit of AZ(Bit 77) Z: Z = after a valid presentation of erase key P:st bit of AZ (Bit 736) - AT88SC only C: C = when the counter is not empty. 3

4 Table. AT88SC/ Access Conditions After Personalization (FUS Blown) Zones S C P D P D Z Z C AD WIT (rase) WIT (POG) Compare FZ IZ SC SCAC CPZ AZ Z AZ Z C MTZ Notes: SC:SC = after validation of security code D: nd bit of AZ (Bit 737) - AT88SC only P:st bit of AZ (Bit 76) Z: Z = after a valid presentation of erase key D:nd bit of AZ(Bit 77) Z: Z = after a valid presentation of erase key P:st bit of AZ (Bit 736) - AT88SC only C: C = when the counter is not empty. 4 AT88SC/

5 AT88SC/ Modes of Operation The AT88SC/ has four operation modes selected by PGM, ST, CLK, and by the internal counter: Inputs Micro Instructions PGM ST CLK Definitions INC (INC/AD) CMP (INC/CMP) WIT VIFY The address counter is reset to and the first bit of the memory is available on I/O after the falling edge of ST and CLK hit. Note: The INC instruction is disabled when ST is high (Figure ). Address counter is reset on the falling edge of. The address counter is incremented and the first bit is available on I/O after the falling edge of the clock (unless reading is forbidden) (Figure ). Address increments on falling edge of CLK. Data is released after the falling edge of CLK. Comparison of the bit presented to the card to the internal bit of the memory (for secret codes only). The bit should stay stable on I/O during the time CLK is low. The address counter is incremented on the falling edge of the CLK (Figure 3). I/O must be positioned on for programming or on for erasure before the rising edge of CLK which must stay on for at least 5ms. The bit addressed (which will be written) is available on I/O after the falling edge of the CLK (Figure 4). Notes:.Output is disabled (Hi state) on addresses where read is disabled..if V DD falls between approximately 3V and 4V the chip will execute a power-on reset. 3.The instructions CMP and UP are coded (,) on CLK and PGM. The circuit will distinguish between the instructions by testing the internal address counter (CMP can only be done with the addresses corresponding to the security code or erase key). 4.The internal address counter counts up to 59 for and 567 for. An additional INC sets the counter to. 5

6 Table 5. AT88SC/ Micro Instructions Instruction Bit Word Application Zone Global (When Fuse = ) AD WIT ( WIT ) AS (WIT ) n INC;position counter on bit n INC; position counter on bit WIT INC; go to next bit WIT;... n INC;position counter on first bit in word WIT n INC;position counter on first bit in next word WIT... verify erase keys AT88SC Zone /88SC Zone : 3 CMP n INC; n = 3 (), n = 8 () VIFY ; verify in C WIT ; write in C WIT ; erase application zone n INC; n = 39 () n = 44 () WIT n INC; n = 39 () n = 44 () WIT AT88SC Zone : 48 CMP n INC; n = 736 WIT ; erase application zone CMP SCUITY COD 79 INC; position counter on bit preceding SC 6 CMP; verify security code n INC;If none of the st 4 bits of the SCAC is, then 4 unsuccessful attempts have been made to verify SC, and the device is inoperable. If any of the st 4 bits is a, then: WIT WIT ; eset the SCAC CMP AS KYS n INC;position counter on bit preceding access code or erase key n CMP;verify access code or erase key ; n = 3 or 48 bits 6 AT88SC/

7 AT88SC/ Figure. eset Figure. ead Timing 7

8 Figure 3. Compare Timing Figure 4. Program Timing 8 AT88SC/

9 AT88SC/ Figure 5. SC and Z/Z Validation for AT88SC/ A) Compare sequence of the security code or the application zone erase key. B) First bit which is at a logic, in the false attempts counter to validate SC, or in the recharge counter to validate Z. C) Program sequence attempts to write a over the currently at this address. D) The chip outputs the new state of the bit. If a has been successfully programmed, SC or Z is set on the rising edge of PGM. (Note: If CLK rises when PGM is low, the validation is aborted.) ) This program sequence will erase either the false attempts counter or the application zone. F) Chip outputs state of the current bit. If the erase was successful, the chip will output a if the current bit is in the false attempts counter. The chip will output a if the current bit is in the recharge counter. G) On the falling edge of clock, the address is incremented and the state of the next bit is output. Note:. The address does not change from operations B to F. 9

10 Absolute Maximum atings* Operating Temperature C to +5 C Storage Temperature C to +5 C Voltage on Any Pin with espect to Ground V to +7. V Maximum Operating Voltage V DC Output Current ma *TIC: Stresses beyond those listed under "Absolute Maximum atings may cause permanent damage to the device. This is a stress rating only, and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of this specification is not implied. xposure to absolute maximum rating conditions for extended periods may affect device reliability. DC Characteristics Die T AMB = 5 C to 7 C, V CC = 5V ± %, V SS = V (unless otherwise specified) Symbol Characteristics Min Typ Max Unit I CC Supply Current on V CC out of Program (t AMB = + 5 C) 3. ma I CCP Supply Current on V CC during Program (t AMB = + 5 C) 4. ma V IL Input Low Level.8 V V IH Input High Level. V CC V V OL Output Low Level (I OL = ma).4 V I Leak I/O Leakage Current -5 5 µa Notes:. There is a pullup on pin ST.. There are pulldowns on pins FUS, CLK and PGM. Packaging All Atmel smart card secure ICs are available in wafer or standard packaging. Standard packages include plastic DIPs, SOICs, PLCCs. AT88SC/

11 AT88SC/ AC Characteristics Die TAMB = 5 C to 7 C, VCC = 5V ± %, VSS = V (unless otherwise specified). Symbol Characteristics Min Typ Max Unit f CLK Clock Frequency 3 KHz t CLK Clock Cycle Time 3.3 µs t H ST Hold Time µs t DV Data Valid eset to Address. µs t CH CLK Pulse Width (High). µs t CL CLK Pulse Width (Low). µs t DV Data Access. µs t OH Data Hold µs t SC Data In Setup (CMP Instruction) µs t HC Data In Hold (CMP Instruction). µs t CHP CLK Pulse Width (High in Programming) 5. ms tds Data In Setup. µs tdh Data In Hold µs t SP PGM Setup. µs t HP PGM Hold. µs t DH Data Hold from CLK µs Conditions of Dynamic Tests The circuit has an output with open drain. An external resistance is thus necessary between VCC and I/O in order to load the output. Pulse Levels of the Input:V SS to 3.V eference Levels in Output:.5V ising and Falling Time of Signals:< 5ns V CC 4.7K CHIP TST POINT I/O pf Test Circuit Included

1K EEPROM Security Logic with Two Application Zones AT88SC102

1K EEPROM Security Logic with Two Application Zones AT88SC102 . Features K X Serial EEPROM with Security Logic Two Application Zones Stores and Validates Security Codes Maimum of Four Incorrect Security Code Attempts Provides Transport Code Security Low Voltage Operation: