Data exchange system comprising portable data processing units

• US 20020111987A1
• Filed: 04/16/2002
• Published: 08/15/2002
• Est. Priority Date: 08/04/1995
• Status: Active Grant

• Current Assignee: Belle Gate Investment BV
• Original Assignee: Belle Gate Investment BV
• Inventors: De Jong, Eduard Karel
• Granted Patent: US 7,185,110 B2
• Time in Patent Office: Days
• US Class Current: 709/201
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06K 19/07 with integrated circuit chips
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3576 Multiple memory zones on card
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Data exchange system includes at least one portable data processing unit with data communication processing and memory units, the latter including an executive program and one or more application descriptors, each application description including at least one interaction context comprising commands, data elements, data references, procedures, access conditions, and external references; the structure of the data elements and the data references as well as other references is chosen in such a way that a very efficient use of the restricted memory space of e.g. smart cards is obtained.

Claims

1. A memory comprised of memories (9, 16) located in multiple data processing units (4, 5), the multiple data processing units (4, 5) comprising multiple portable data processing units and multiple non-mobile data processing units, the portable data processing units being arranged to establish a temporary communication link (6) with at least one other data processing unit and the non-mobile data processing units being arranged to establish a permanent communication link (6), communications along the communication links being synchronous, each of the data processing units (4, 5) comprising data communication means (7, 14), processing means (8, 15) and, said memory having stored therein an executive program (12, 17) and descriptions of the possible modes of communication between the data processing units as interaction contexts (11(1) . . . 11(m), 19(1) . . . 19(m)) in accordance with the following data structure:

a. a set of basic distinct communication primitives (A(1) . . . ) which are distinct values and are accepted as commands upon receipt thereof by any of the data processing units (4, 5) during communications with at least one other of the data processing units (5, 4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by any of the data processing units (4, 5) in response to accepted communication primitives (A(l) . . . )

c. a set of data elements (H(l) . . . ) distributed over the multiple processing units (4, 5), which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a first set of references (r(1), r(2), r(3)) to the data elements (H(1) . . . ), the references of the first set (r(1) , r(2) , r(3)) being associated to the procedural descriptions (C(l) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(l) . . . ) are performed;

e. a possible second set of references (r(4), r(5), r(6)) to the data elements (H(1) . . . ), the references of the second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1). . . ) to the data elements (H(1) . . . ), the third set of references (u(1) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ), the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(l) . . . ), which data elements are to be used by the procedural descriptions (C(1) . . . ) associated with the communication primitives (A(l) . . . );

g. first set of access conditions associated to the data elements (H(l) . . . ) which conditions are consulted in association to the first set (r(1), r(2), r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to the third set of references (u(1) . . . ) in the first data list (B(1) . . . ).

2. The memory of claim 1, in which at least one of the memories (9, 16) reside in a portable ones of the multiple data processing units (4, 5) and comprises descriptions of the possible modes of communication between the data processing units as interaction contexts (19(1) . . . 19(m)) in accordance with the following data structure:

a. a set of basic distinct communication primitives (A(l) . . . ) which are distinct values and are accepted as commands upon receipt thereof by the data processing unit (5) during communications with at least one other of the data processing units (4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by the data processing unit (5) in response to accepted communication primitives (A(l) . . . );

c. a, possibly empty, set of data elements (H(l) . . . ) which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a, possibly empty, first set of references (r(l), r(2), r(3)) to the data elements (H(l) . . . ), the references of the first set (r(l) , r(2) , r(3)) being associated to the procedural descriptions (C(1) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(1) . . . ) are performed;

e. a, possibly empty, second set of references (r(4), r(5), r(6)) to the data elements (H(l) . . . ), the references of the second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1) . . . ) to the data elements (H(1) . . . ), the third set of references (u(1) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ) , the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(1) . . . ), which data elements are to be used by the procedural descriptions (C(1) . . . ) associated with the communication primitives (A(l) . . . );

g. a first set of access conditions associated to the data elements (H(l) . . . ), which conditions are consulted in association to the first set (r(l), r(2) ,r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to the third set of references (u(1) . . . ) in the first data list (B(1) . . . );

wherein the memory contains more than one interaction context, and wherein at least one of the communication primitives accepted by the memory will be to selectively indicate one of the interaction contexts (19(l) . . . ) for further referral in the memory.

3. The memory of claim 1, wherein the set of the procedural descriptions (C(l) . . . ) at least comprises a first procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(1) . . . ) for further referral in the processing unit accepting the communication primitives, such performance resulting in a proper activation of the indicated interaction context.

4. The memory of claim 1, wherein the memory further comprises at least two interaction contexts (19(l) . . . ) and the set of the procedural descriptions (C(l) . . . ) at least comprises a last procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(l) . . . ) for further referral in the processing unit accepting the communication primitive, such performance resulting in a proper deactivation of the interaction context which was indicated while the communication primitive was received.

5. The memory of claim 1, wherein the memory (16) further comprises at least two interaction contexts (19(1) . . . 19(m)), at least one application description (18(1) . . . ) and a memory element (20) storing a reference to the interaction context currently being in force, each application description comprising:

a. a data list comprising references (E(l) . . . ) to data elements, which references may be accessible to two or more interaction contexts (19(l) . . . ) and may be extended by additional data elements; and

b. a further set of access conditions associated to the references (E(l) . . . ) or to the additional data elements and defining restrictions of use.

6. The memory of claim 5, wherein each application description (18(1) . . . ) also comprises a procedure library comprising codes (F(l) . . . ) which can be used by procedural descriptions (C(l) . . . ) of each interaction context associated to each of the application descriptions (18(1) . . . ).

7. The memory of claim 5, wherein the memory further comprises at least two application descriptions (18(l) . . . ) and units of executable code (G(l) . . . ) which can be used by procedural descriptions (C(l) . . . ) of each interaction context (19(1) . . . ) within each application description (18(1) . . . ) or by each unit of executable code (F(l) . . . ) of each procedure library within each application description (18(1) . . . ).

8. The memory of claim 6, wherein the units of executable code in the procedure library are enhanced by including a specification of the use of their operational parameters into classes relating to attributes pertaining to data elements which can be passed as actual value in a computation, which computation only proceeds if the data attributes and parameter classes match.

9. The memory of claim 5, wherein the executive program (17) comprises a reference to a default interaction context which is used to initialize the memory element (20) storing a reference to the interaction context currently being in force, in order to carry out a final action after a detection of an internal inconsistency in a recovery to a normal state of operation or whenever the executive program (17) is active and no explicit interaction context has been specified by a communication primitive received from a similar data processing unit (4).

10. The memory of claim 1, wherein the executive program (17) comprises routines constituting an interpreter for coded instructions for an abstract processor, such that the majority of procedural descriptions (C(l) . . . ) and some of the units of executable code (F(1), G(1) . . . ) are coded in numeric values for interpretation by the interpreter routines.

11. The memory of claim 6, wherein the procedural descriptions (C(l) . . . ) are encoded as indexes in a list over a sub set of procedures contained in the library of procedures comprising units of executable code.

12. The memory of claim 11, wherein the encoding of the procedural descriptions (C(l) . . . ) is in such small values that more than one description can be held in a basic unit of access for the memory means (16) or that the description can be combined with other relevant information in the same basic unit of memory access.

13. The memory of claim 12, wherein at least one of the encoding values of the procedural descriptions (C(l) . . . ) refers to a special function of the executive program (17) that is designed to select by indirection the actual function to perform for the encoded procedural description possibly by incorporating additional coding information stored in association with the procedural description encoded with the special values.

14. The memory of claim 1, wherein the memory (16) further comprises an interaction context dedicated to comprise Personal Identification Numbers and that the executive program (17) is arranged to verify Personal Identification Numbers supplied by a user of the data exchange system.

15. The memory of claim 1, wherein the memory (16) further comprises at least one interaction context dedicated to manage the number and content of other interaction contexts (19(1) . . . ) also contained in the memory.

16. The memory of claim 5, wherein each application description (18(1) . . . ) comprises a list of numeric values which is constructed to provide identifiers for all interaction contexts (19(1) . . . ) and comprises at least one of the following numeric values, a first indicating an application type, a second numeric value indicating a unique identification of the entity providing the application, a third numeric value indicating the nature of the application description (18(1) . . . ) and further numbers each uniquely referring to one interaction context (19(1) . . . ) associated with the application description.

18. The memory of claim 17, wherein the executive program (17) is arranged to perform, upon accepting a communication primitive to perform operations specified in the current interaction context (19(l) . . . ) , each operation as part of a predetermined and fixed sequence of actions each of which is specified separately as part of a procedural description associated to the accepted communication primitive, which procedural description at least comprises distinct descriptions, any of which may be void, for the following actions:

a. authorization of the use of the communication primitive;

b. decryption of operational data or any part of it;

c. performing a command with input data;

d. encryption of any operational data resulting from any operation performed; and

e. computation of a proof of completion of any performed action or of correctness of the resulting data to be used in security computations.

19. The memory of claim 17, wherein the data processing unit (5) generates a random transaction number upon initializing data transfer, which serves as basis for cryptographic computations.

20. The memory of claim 17, wherein one communica tion primitive is assigned a specified value which will always be interpreted as a request to enter a new interaction context (19(l) . . . ).

21. The memory of claim 17, further comprising a further memory element containing an application programmers interface (10) comprising program code designed to allow additional computer programs to be implemented to give users control over the sequence of exchanged communication primitives or to influence the data transferred in them or to learn or further process the data received in the exchange.

22. The memory of claim 21, wherein the primitive used to enter a specified interaction context (19(l) . . . ) comprises numeric values to be used in security calculations in subsequent communications, a first value generated randomly or of similarly unique nature by one of the processing units and possibly a second value serving to proof the authenticity of the one processing unit or to otherwise identify the one processing unit.

23. The memory of claim 21, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being composed of a fixed number of binary values each of which is interpreted by the executive program (12, 17) as a reference to a single data element.

24. The memory of claim 21, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being used to determine which of the data elements available for external reference in an active interaction context (19(l) . . . ) will be used while performing responding actions in such a way that any data element is selected if it contains a value that matches the second value or if it contains a value that is otherwise sufficient to indicate it.

25. The memory of claim 21, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being composed of a number of binary values which are assigned specific meanings by the executive program (12, 17) to be used in interpreting data formats in the communication primitive and in performing responding actions.

27. The method of claim 26, wherein in at least one of the portable data processing units (5) is provided with descriptions of the possible modes of communication between the data processing units as interaction contexts (19(l) . . . 19(m)) in accordance with the following data structure:

a. a set of basic distinct communication primitives (A(l) . . . ) which are distinct values and are accepted as commands upon receipt thereof by the data processing unit (5) during communications with at least one other of the data processing units (4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by the data processing unit (5) in response to accepted communication primitives (A(l) . . . );

c. a, possibly empty, set of data elements (H(l) . . . ) which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a, possibly empty, first set of references (r(l), r(2), r(3)) to the data elements (H(l) . . . ), the references of the first set (r(l), r(2), r(3)) being associated to the procedural descriptions (C(l) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(l) . . . ) are performed;

e. a, possibly empty, second set of references (r(4), r(5), r(6)) to the data elements (H(l) . . . ), the references of the second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1) . . . ) to the data elements (H(1) . . . ), the third set of references (u(i) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ), the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(1) . . . ), which data elements are to be used by the procedural descriptions (C(1) . . . ) associated with the communication primitives (A(l) . . . );

g. a first set of access conditions associated to the data elements (H(l) . . . ), which conditions are consulted in association to the first set (r(l), r(2) ,r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to the third set of references (u(1) . . . ) in the first data list (B(1) . . . );

wherein the portable data processing unit contains more than one interaction context, and wherein at least one of the communication primitives accepted by the memory will be to selectively indicate one of the interaction contexts (19(l) . . . ) for further referral in the memory.

28. The method of claim 26, wherein the set of the procedural descriptions (C(1) . . . ) at least comprises a first procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(1) . . . ) for further referral in the processing unit accepting the communication primitives, such performance resulting in a proper activation of the indicated interaction context.

29. The method of claim 26, wherein the memory of each data process unit is provided with at least two interac tion contexts (19(l) . . . ) and the set of the procedural descriptions (C(l) . . . ) at least comprises a last procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(l) . . . ) for further referral in the processing unit accepting the communication primitive, such performance resulting in a proper deactivation of the interaction context which was indicated while the communication primitive was received.

30. The method of claim 26, wherein the memory (16) of each data processing unit is further provided with at least two interaction contexts (19(1) . . . 19(m)), at least one application description (18(1) . . . ) and a memory element (20) storing a reference to the interaction context currently being in force, each application description comprising:

a. a data list comprising references (E(l) . . . ) to data elements, which references may be accessible to two or more interaction contexts (19(1) . . . ) and may be extended by additional data elements; and

b. a further set of access conditions associated to the references (E(l) . . . ) or to the additional data elements and defining restrictions of use.

17. A memory comprised of memories (9, 16) of multiple data processing units (4, 5), some of the multiple data processing units which are portable data processing units established in a temporary communication link (6) and others, which are not mobile having a permanent communication link (6), the data processing units comprising data communication means (7, 14) processing means (8, 15), said memories comprising an executive program (12, 17) operative to have the communication means (14) arranged to structure data exchange in blocks of data comprising at least two parts, a first part being data qualified as operational in that it is used to influence the nature of the operations performed by a command as indicated by a communication primitive or data resulting from operations carried out, a second part being qualified as security in that it is used to determine the appropriateness of performing an operation or of the acceptability of data within the operational part, to be used in the operation or to prove completion of the operation or correctness of the resulting data.

26. A method of exchanging data between multiple data processing units (4, 5), the multiple data processing units (4, 5) comprising multiple portable data processing units and multiple non-mobile data processing units, compris ing the steps of:

establishing with at least one portable data processing unit a temporary communication link (6) with at least one other data processing unit;

establishing with at least one non-mobile data processing unit a permanent communication link (6) with another of the data processing units, communications along the communication links being synchronous, each of the data processing units (4, 5) comprising data communication means (7, 14), processing means (8, 15) and memory (9, 16);

storing in the memory of the data processing units an executive program (12, 17); and

storing in the memory of the totality of the processing units descriptions of the possible modes of communication between the data processing units as interaction contexts (11(1) . . . 11(m) , 19(1) . . . 19(m)) in accordance with the following data structure;

a. a set of basic distinct communication primitives (A(1) . . . ) which are distinct values and are accepted as commands upon receipt thereof by any of the data processing units (4, 5) during communications with at least one other of the data processing units (5, 4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by any of the data processing units (4, 5) in response to accepted communication primitives (A(l) . . . );

c. a set of data elements (H(l) . . . ) distributed over the multiple processing units (4, 5), which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a first set of references (r(1), r(2), r(3)) to the data elements (H(1) . . . ), the references of the first set (r(1), r(2), r(3)) being associated to the procedural descriptions (C(1) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(l) . . . ) are performed;

e. a possible second set of references (r(4), r(5), r(6)) to the data elements (H(1) . . . ), the references of the 4S second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1) . . . ) to the data elements (H(1) . . . ) the third set of references (u(1) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ), the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(l) . . . ), which data elements are to be used by the procedural descriptions (C(1) . . . ) associated with the communication primitives (A(l) . . . );

g. first set of access conditions associated to the data elements (H(l) . . . ) which conditions are consulted in association to the first set (r(1), r(2), r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to 65 the third set of references (u(1) . . . ) in the first data list (B(1) . . . ).

31. A method of data exchange between multiple data processing units (4, 5) comprising the steps of:

establishing in some of the multiple data processing units, which are portable data processing units, a temporary communication link (6);

establishing in other data processing units, which are not mobile, a permanent communication link (6), the data processing units comprising data communication means (7, 14) processing means (8, 15), and memories;

providing the memories with an executive program (12, 17) operative to have the communication means (14) arranged to structure data exchange in blocks of data comprising at least two parts, a first part being data qualified as operational in that it is used to influence the nature of the operations performed by a command as indicated by a communication primitive or data resulting from operations carried out, a second part being qualified as security in that it is used to determine the appropriateness of performing an operation or of the acceptability of data within the operational part, to be used in the operation or to prove completion of the operation or correctness of the resulting data.

32. The method of claim 31, wherein the executive program (17) is arranged to perform, upon accepting a communication primitive to perform operations specified in the current interaction context (19(1) . . . ), each operation as part of a predetermined and fixed sequence of actions each of which is specified separately as part of a procedural description associated to the accepted communication primitive, which procedural description at least comprises distinct descriptions, any of which may be void, for the following actions:

a. authorization of the use of the communication primitive;

b. decryption of operational data or any part of it;

c. performing a command with input data;

d. encryption of any operational data resulting from any operation performed; and

e. computation of a proof of completion of any performed action or of correctness of the resulting data to be used in security computations.

33. The method of claim 31, wherein the data processing unit (5) generates a random transaction number upon initializing data transfer, which serves as basis for crypto graphic computations.

34. The method of claim 31, wherein one communication primitive is assigned a specified value which will always be interpreted as a request to enter a new interaction context (19(1) . . . ).

35. The method of claim 31, further comprising the step of providing a further data processing unit containing an application programmers interface (10) comprising program code designed to allow additional computer programs to be implemented to give users control over the sequence of exchanged communication primitives or to influence the data transferred in them or to learn or further process the data received in the exchange.

36. The memory of claim 35, wherein the primitive used to enter a specified interaction context (19(1) . . . ) comprises numeric values to be used in security calculations in subsequent communications, a first value generated randomly or of similarly unique nature by one of the processing units and possibly a second value serving to proof the authenticity of the one processing unit or to otherwise identify the one processing unit.

37. The method of claim 35, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being composed of a fixed number of binary values each of which is interpreted by the executive program (12, 17) as a reference to a single data element.

38. The method of claim 35, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being used to determine which of the data elements available for external reference in an active interaction context (19(1) . . . ) will be used while performing responding actions in such a way that any data element is selected if it contains a value that matches the second value or if it contains a value that is otherwise sufficient to indicate it.

39. The method of claim 35, wherein each communication primitive except a first one signaling a reset is composed of two or more numeric values, a first value being used to refer to a procedural description of an action associated to the communication primitive, a second value being composed of a number of binary values which are assigned specific meanings by the executive program (12, 17) to be used in interpreting data formats in the communication primitive and in performing responding actions.

40. A computer readable medium having stored therein a plurality of modules providing for the exchange of data between multiple data processing units (4, 5), the multiple data processing units (4, 5) having multiple portable data processing units and multiple non-mobile data processing units, comprising:

a module for arranging at least one portable data processing unit to establish a temporary communication link (6) with at least one other data processing unit;

a module for arranging a non-mobile data processing unit to establish a permanent communication link (6) with another of the data processing units, communications along the communication links being synchronous, each of the data processing units (4, 5) comprising data communication means (7, 14), processing means (8, 15) and memory (9, 16);

a module storing in the memory of the data processing units an executive program (12, 17); and

a module for storing in the memory of the totality of the processing units descriptions of the possible modes of communication between the data processing units as interaction contexts (11(1) . . . 11(m) , 19(1) . . . 19(m)) in accordance with the following data structure;

a. a set of basic distinct communication primitives (A(1) . . . ) which are distinct values and are accepted as commands upon receipt thereof by any of the data processing units (4, 5) during communications with at least one other of the data processing units (5, 4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by any of the data processing units (4, 5) in response to accepted communication primitives (A(1) . . . );

c. a set of data elements (H(l) . . . ) distributed over the multiple processing units (4, 5), which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a first set of references (r(1), r(2), r(3)) to the data elements (H(1) . . . ), the references of the first set (r(1), r(2), r(3)) being associated to the procedural descriptions (C(1) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(l) . . . ) are performed;

e. a possible second set of references (r(4), r(5), r(6)) to the data elements (H(l) . . . ), the references of the second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1) . . . ) to the data elements (H(1) . . . ), the third set of references (u(1) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ), the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(l) . . . ), which data elements are to be used by the procedural descriptions (C(1) . . . ) associated with the communication primitives (A(1) . . . );

g. first set of access conditions associated to the data elements (H(l) . . . ) which conditions are consulted in association to the first set (r(1), r(2), r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to the third set of references (u(1) . . . ) in the first data list (B(1) . . . ).

41. The computer readable medium of claim 40, wherein the set of the procedural descriptions (C(l) . . . ) at least comprises a first procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(1) . . . ) for further referral in the processing unit accepting the communication primitives, such performance resulting in a proper activation of the indicated interaction context.

42. The computer readable medium of claim 40 provides the memory of each data process unit with at least two interaction contexts (19(l) . . . ) and the set of the procedural descriptions (C(l) . . . ) at least comprises a last procedural description to be performed in response to the communication primitive, or primitives, which indicate one of the interaction contexts (19(l) . . . ) for further referral in the processing unit accepting the communication primitive, such performance resulting in a proper deactivation of the interaction context which was indicated while the communication primitive was received.

43. The computer readable medium method of claim 40 further providing the memory (16) of each data processing unit with at least two interaction contexts (9(1) . . . 19(m)), at least one application description (18(1) . . . ) and a memory element (20) storing a reference to the interaction context currently being in force, each application description comprising:

a. a data list comprising references (E(l) . . . ) to data elements, which references may be accessible to two or more interaction contexts (19(l) . . . ) and may be extended by additional data elements; and

b. a further set of access conditions associated to the references (E(l) . . . ) or to the additional data elements and defining restrictions of use.

44. A computer readable medium having stored therein a plurality of modules providing for the exchange of data between multiple data processing units (4, 5), comprising:

a module for establishing in some of the multiple data processing units which are portable data processing units a temporary communication link (6);

a module for establishing in other data processing units which are not mobile a permanent communication link (6), the data processing units comprising data communication means (7, 14) processing means (8, 15), and memories;

a module for providing the memories with an executive program (12, 17) operative to have the communication means (14) arranged to structure data exchange in blocks of data comprising at least two parts, a first part being data qualified as operational in that it is used to influence the nature of the operations performed by a command as indicated by a communication primitive or data resulting from operations carried out, a second part being qualified as security in that it is used to determine the appropriateness of performing an operation or of the acceptability of data within the operational part, to be used in the operation or to prove completion of the operation or correctness of the resulting data.

45. The computer readable medium of claim 44, wherein the executive program (17) is arranged to perform, upon accepting a communication primitive to perform operations specified in the current interaction context (19(l) . . . );

each operation as part of a predetermined and fixed sequence of actions each of which is specified separately as part of a procedural description associated to the accepted communication primitive, which procedural description at least comprises distinct descriptions, any of which may be void, for the following actions;

a. authorization of the use of the communication primitive;

b. decryption of operational data or any part of it;

c. performing a command with input data;

d. encryption of any operational data resulting from any operation performed; and

e. computation of a proof of completion of any performed action or of correctness of the resulting data to be used in security computations.

46. A computer data signal embodied in a carrier wave describing possible modes of communication between data processing units (4, 5) as interaction contexts (11(1) . . . 11(m), 19(l), . . . 19(m)) in accordance with the following data structure:

a. a set of basic distinct communication primitives (A(1) . . . ) which are distinct values and are accepted as commands upon receipt thereof by any of the data processing units (4, 5) during communications with at least one other of the data processing units (5, 4);

b. a set of procedural descriptions (C(l) . . . ) defining procedures to be performed by any of the data processing units (4, 5) in response to accepted communication primitives (A(l) . . . );

c. a set of data elements (H(l) . . . ) distributed over the multiple processing units (4, 5), which are either permanently stored or computed and which are available for use when the procedures as defined in the procedural descriptions (C(l) . . . ) are performed, the use of and the access to the data elements being controlled;

d. a first set of references (r(1), r(2), r(3)) to the data elements (H(l) . . . ), the references of the first set (r(1), r(2), r(3)) being associated to the procedural descriptions (C(1) . . . ) such that the data elements are available for use when procedures as defined in the procedural descriptions (C(l) . . . ) are performed;

e. a possible second set of references (r(4), r(5) r(6)) to the data elements (H(l) . . . ), the references of the second set (r(4), r(5), r(6)) being associated to procedural descriptions (C(4) . . . ) of possibly further interaction contexts, such that the data elements are available for use when procedures as defined in procedural descriptions (C(l) . . . ) of the possibly further interaction contexts are performed;

f. a, possibly empty, first data list (B(1) . . . ) comprising a possibly ordered third set of references (u(1). . . ) to the data elements (H(1) . . . ), the third set of references (u(1) . . . ) being available as targets for references of a fourth set of references (w(l) . . . ), the references of the fourth set (w(l) . . . ) being part of the communication primitives (A(l) . . . ), which data elements are to be used by the procedural descriptions (c(1) . . . ) associated with the communication primitives (A(l) . . . );

g. first set of access conditions associated to the data elements (H(l) . . . ) which conditions are consulted in association to the first set (r(1), r(2), r(3)) and second set (r(4), r(5), r(6)) of references to the data elements; and

h. a second set of access conditions associated to the third set of references (u(1) . . . ) in the first data list (B(1) . . . ).

47. A computer data signal embodied in a carrier wave structuring data exchange, between plural data processing units, in blocks of data comprising:

a first part of data qualified as operational in that it is used to influence the nature of the operations performed by a command as indicated by a communication primitive or data resulting from operations carried out; and

a second part of data qualified as security in that it is used to determine the appropriateness of performing an operation or of the acceptability of data within the operational part, to be used in the operation or to prove completion of the operation or correctness of the resulting data.