Secure sharing of resources between applications in independent execution environments in a retrievable token (e.g. smart card)

• US 8,321,923 B2
• Filed: 03/02/2005
• Issued: 11/27/2012
• Est. Priority Date: 03/04/2004
• Status: Expired due to Fees

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Mahalal, Ilan, Rhelimi, Alain
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): DOAN, TRANG T
• Application Number:
  US10/591,496
• Publication Number:
  US 20070180517A1
• Time in Patent Office: 2,827 Days
• Field of Search: 726/9, 726/20
• US Class Current: 726/9
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

The invention relates to an authentication and/or rights containing retrievable token such as an IC card comprising at least one physical channel of communication to at least one apparatus and at least two logical channels of communication with said at least one apparatus wherein each logical channel of communication is associated with a different execution environment.

Claims

1. A retrievable token comprising:

one or more physical channels of communication to at least one apparatus;

a first logical channel of communication to the at least one apparatus, wherein the first logical channel is associated with a physical channel of the one or more physical channels of communication, wherein the first logical channel is associated with a first protocol stack and a first execution environment on the retrievable token; and

a second logical channel of communication to the at least one apparatus, wherein the second logical channel is associated with the physical channel of the one or more physical channels of communication, wherein the second logical channel is associated with a second protocol stack and a second execution environment on the retrievable token,

wherein the retrievable token is configured to concurrently execute the first execution environment and the second execution environment, and

wherein executing the first execution environment comprises executing the first protocol stack and executing the second execution environment comprises executing the second protocol stack.

2. The retrievable token of claim 1, wherein the retrievable token is a Multi Media Memory card.

3. The retrievable token of claim 1, wherein the at least one apparatus is a mobile communication handset.

4. The retrievable token of claim 1, wherein the at least one apparatus is a personal computer.

5. The retrievable token of claim 1, wherein the physical channel of the one or more physical channels of communication is configured to use USB protocol.

6. The retrievable token of claim 1, wherein the physical channel of the one or more physical channels of communication is configured to use SPI protocol.

7. The retrievable token of claim 1, wherein physical channel of the one or more physical channels of communication is configured to use MMC protocol.

8. The retrievable token of claim 1, wherein the physical channel of the one or more physical channels of communication is configured to use a protocol for contactless smart card.

9. The retrievable token of claim 8, wherein the protocol of communication is defined in the ISO (FCD) 15693.

10. The retrievable token of claim 8, wherein the protocol is defined in the ISO 14443.

11. The retrievable token of claim 1, wherein the physical channel of the one or more physical channels of communication is configured to use at least one protocol defined in the TS 102.221 standard.

12. The retrievable token of claim 1, wherein the physical channel of the one or more physical channels of communication is configured to use at least one protocol defined in the ISO 7816 standard.

13. The retrievable token of claim 1, wherein said retrievable token includes at least two independent physical channels.

14. The retrievable token of claim 1, wherein said retrievable token comprises a first application and a second application, wherein the retrievable token is configured to execute the first application in the first execution environment and the second application in the second execution environment, and wherein said retrievable token comprises a resource that is shared between the first application and the second application.

15. The retrievable token of claim 14, wherein the retrievable token comprises an access condition list (ACL) and said resource is shared by the first application and the second application on the basis of said access condition list (ACL).

16. The retrievable token of claim 15, wherein the resource is a shared file, and wherein said access conditions of the access conditions list (ACL) associates respective applications with respective operations on the shared file thereby authorizing said respective applications to perform said respective operations on the shared file.

17. The retrievable token of claim 15, wherein the resource is a shared object on which data is written in a “

first in first out”

(FIFO) manner and wherein access conditions are defined in the access conditions list (ACL) associating respective applications with respective operations on the shared object thereby authorizing said respective applications to perform said respective operations on the shared object.

18. The retrievable token of claim 15, wherein the retrievable token stores and runs an operating system which is common to the first application and the second application and wherein the resource is a shared function that is implemented by the operating system and for which access conditions are defined in the access conditions list (ACL) which specify respective rights of the applications to invoke said shared function.

19. The retrievable token of claim 14, wherein the first application of the is configured to share a function with the second application by allowing the second application to invoke the function and where access conditions list (ACL) are defined in the retrievable token for the second application to access the shared function.

20. The retrievable token of claim 14, wherein the retrievable token is configured to execute the first application and the second application simultaneously.

21. The retrievable token of claim 14, wherein the retrievable token is configured to implement a communication protocol between the first application and the second application, wherein the communication protocol enables secure sharing of data and/or functions between the first application and the second application.