Features
•
•
•
•
•
•
•
•
•
One 64 x 8 (512-bit) Configuration Zone
Three 64 x 8 (512-bit) User Zones
Programmable Chip Select
Low-voltage Operation: 2.7V to 5.5V
Two-wire Serial Interface
8-byte Page Write Mode
Self-timed Write Cycle (10 ms max)
Answer-to-reset Register
High-security Memory Including Anti-wiretapping
– 64-bit Authentication Protocol (under exclusive patent license from ELVA)
– Secure Checksum
– Configurable Authentication Attempts Counter
– Two Sets of Two 24-bit Passwords
– Specific Passwords for Read and Write
– Four Password Attempts Counters
– Selectable Access Rights by Zone
•
ISO Compliant Packaging
•
High Reliability
– Endurance: 100,000 Cycles
– Data Retention: 100 Years
– ESD Protection: 4,000V min
•
Low-power CMOS
3 x 64 x 8
Secure Memory
with
Authentication
AT88SC153
Table 1.
Pin Configuration
Name
VCC
GND
SCL
SDA
RST
Description
Supply Voltage
Ground
Serial Clock Input
Serial Data
Input/Output
Reset Input
ISO Module Contact
C1
C5
C3
C7
C2
Standard Package Pin
8
1
6
3
7
Figure 1.
Card Module Contact
Figure 2.
8-pin SOIC, PDIP, or LAP
VCC
RST
GND
NC
SDA
NC
1
2
3
4
8
7
6
5
VCC
RST
SCL
NC
Description
The AT88SC153 provides 2,048 bits of serial EEPROM memory organized as one
configuration zone of 64 bytes and three user zones of 64 bytes each. This device is
optimized as a “secure memory” for multiapplication smart card markets, secure iden-
tification for electronic data transfer, or components in a system without the
requirement of an internal microprocessor.
1016D–SMEM–04/04
1
The embedded authentication protocol allows the memory and the host to authenticate
each other. When this device is used with a host that incorporates a microcontroller
(e.g., AT89C51, AT89C2051, AT90S1200), the system provides an “anti-wiretapping”
configuration. The device and the host exchange “challenges” issued from a random
generator and verify their values through a specific cryptographic function included in
each part. When both agree on the same result, the access to the memory is permitted.
Figure 2.
Security Methodology
Memory Access
Depending on the device configuration, the host might carry out the authentication pro-
tocol and/or present different passwords for each operation, read or write. Each user
zone may be configured for free access for read and write or for password-restricted
access. To insure security between the different user zones (multiapplication card),
each zone can use a different set of passwords. A specific attempts counter for each
password and for the authentication provides protection against “systematic attacks.”
When the memory is unlocked, the two-wire serial protocol is effective, using SDA and
SCL. The memory includes a specific register providing a 32-bit data stream conforming
to the ISO 7816-10 synchronous answer-to-reset.
2
AT88SC153
1016D–SMEM–04/04
AT88SC153
Figure 3.
Block Diagram
VCC
GND
Power
Mgt.
Authentication
Unit
Random
Generator
SCL
SDA
ISO
Interface
Data
Transfer
Password
Verification
EEPROM
RST
Answer
To Reset
Pin Descriptions
Supply Voltage (VCC)
Serial Clock (SCL)
Serial Data (SDA)
The VCC input is a 2.7V-to-5.5V positive voltage supplied by the host.
The SCL input is used to positive edge clock data into the device and negative edge
clock data out of the device.
The SDA pin is bidirectional for serial data transfer. This pin is open-drain driven and
may be wire-ORed with any number of other open-drain or open-collector devices. An
external pull-up resistor should be connected between SDA and VCC. The value of this
resistor and the system capacitance loading the SDA bus will determine the rise time of
SDA. This rise time will determine the maximum frequency during read operations. Low
value pull-up resistors will allow higher frequency operations while drawing higher aver-
age power supply current.
When the RST input is pulsed high, the device will output the data programmed into the
32-bit answer-to-reset register. All password and authentication access will be reset.
Following a reset, device authentication and password verification sequences must be
presented to re-establish user access.
Reset (RST)
3
1016D–SMEM–04/04
Memory Mapping
The 2,048 bits of the memory are divided in four zones of 64 bytes each.
Table 2.
Memory Map
Zone
$0
$1
$2
$3
$4
$5
$6
$7
@
$00
User 0
zz
(1)
= 00
64 bytes
-
-
$38
$00
User 1
zz = 01
64 bytes
-
$38
$00
User 2
zz = 10
64 bytes
-
-
$38
$00
Configuration
zz = 11
64 bytes
$38
Note:
1. zz = zone number
The last 64 bytes of the memory is a configuration zone with specific system data,
access rights, and read/write commands; it is divided into four subzones.
Table 3.
Configuration Zone
Configuration
Fabrication
Fab Code
CMC
AR0
Issuer Code
Identification
DCR
AAC
(1)
Secret
PAC
Passwords
PAC
Secure Code/Write 1
PAC
Read 1
$38
1. Address $20 also serves as the virtual address of the Checksum Authentication Register (CAR) during checksum mode.
Notes:
CMC: Card Manufacturer Code
AR0–2: Access Register for User Zone 0 to 2
MTZ: Memory Test Zone
DCR: Device Configuration Register
AAC: Authentication Attempts Counter
PAC: Password Attempts Counter
Write 0
Identification Number (Nc)
Cryptogram (Ci)
Secret Seed (Gc)
PAC
Read 0
AR1
AR2
MTZ
$08
$10
$18
$20
$28
$30
$0
$1
$2
$3
$4
$5
$6
$7
@
$00
Answer-to-Reset
Lot History Code
4
AT88SC153
1016D–SMEM–04/04
AT88SC153
Fuses
FAB, CMA, and PER are nonvolatile fuses blown at the end of each card life step. Once
blown, these EEPROM fuses can not be reset.
•
•
•
The FAB fuse is blown by Atmel prior to shipping wafers to the card manufacturer.
The CMA fuse is blown by the card manufacturer prior to shipping cards to the
issuer.
The PER fuse is blown by the issuer prior to shipping cards to the end user.
The device responds to a read fuse command with
fuse byte.
Table 4.
Fuse Byte
Bit 7
0
Bit 6
0
Bit 5
0
Bit 4
0
Bit 3
0
Bit 2
PER
Bit 1
CMA
Bit 0
FAB
When the fuses are all “1”s, read and write are allowed in the entire memory. Before
blowing the FAB fuse, Atmel writes the entire memory to “1” and programs the fabrica-
tion subzone (except CMC and AR) and the secure code.
Table 5.
Access Rights
Zone
Fabrication
(Except CMC, MTZ and AR)
Card Manufacturer
Code
Access Registers
Write
Read
Memory Test Zone
Write
Read
Identification
Write
Read
Secret
Write
Read
Passwords
Write
Read
PAC
Write
Read
User Zones
Write
Note:
CMC: Card Manufacturer Code
AR: Access Rights as defined by the access registers
PW: Password
AR
AR
AR
Secure Code
AR
Secure Code
AR
Write PW
AR
Secure Code
Free
Secure Code
Free
Write PW
Free
Secure Code
Secure Code
Secure Code
Secure Code
Forbidden
Write PW
Secure Code
Secure Code
Secure Code
Secure Code
Forbidden
Forbidden
Free
Free
Free
Free
Free
Free
Secure Code
Free
Secure Code
Free
Forbidden
Free
Access
Read
Write
Read
Write
Read
FAB = 0
Free
Forbidden
Free
Secure Code
Free
CMA = 0
Free
Forbidden
Free
Forbidden
Free
PER = 0
Free
Forbidden
Free
Forbidden
Free
5
1016D–SMEM–04/04
京公网安备 11010802033920号
EEWORLD
