Download PDFAT88SC153 ATMEL
Document overview
- Manufacturer or author: Provided By digicamel.com
- PDF pages: 24
Technical content
Features
One 64 x 8 (512-bit) Configuration Zone Three 64 x 8 (512-bit) User Zones Programmable Chip Select Low-voltage Operation: 2.7V to 5.5V Two-wire Serial Interface 8-byte Page Write Mode Self-timed Write Cycle (10 ms max) Answer-to-reset Register High-security Memory Including Anti-wiretapping – 64-bit Authentication Protocol (under exclusive patent license from EL VA) – Secure Checksum – Configurable Authentication Attempts Counter – Two Sets of Two 24-bit Passwords – Specific Passwords for Read and Write – Four Password Attempts Counters – Selectable Access Rights by Zone ISO Compliant Packaging High Reliability – Endurance: 100,000 Cycles – Data Retention: 100 Years – ESD Protection: 4,000V min Low-power CMOS Table 1. Pin Configuration Figure 1. Card Module Contact Figure 2. 8-pin SOIC, PDIP, or LAP
Description
The AT88SC153 provides 2,048 bits of serial EEPROM memory organized as one configuration zone of 64 bytes and three user zones of 64 bytes each. This device is optimized as a “secure memory” for multiapplication smart card markets, secure iden- tification for electronic data transfer, or components in a system without the requirement of an internal microprocessor. Name Description ISO Module Contact Standard Package Pin VCC Supply Voltage C1 8 GND Ground C5 1 SCL Serial Clock Input C3 6 SDA Serial Data Input/Output C7 3 RST Reset Input C2 7 VCC RST GND NC SDA NC VCC RST SCL NC 3 x 64 x 8 Secure Memory with Authentication AT88SC153
2 AT88SC153
each part. When both agree on the same result, the access to the memory is permitted. Figure 2. Security Methodology to the ISO 7816-10 synchronous answer-to-reset.
Figure 3. Block Diagram Supply Voltage (VCC) The VCC input is a 2.7V-to-5.5V positive voltage supplied by the host. clock data out of the device. 32-bit answer-to-reset register. All password and authentication access will be reset. presented to re-establish user access.
4 AT88SC153
The 2,048 bits of the memory are divided in four zones of 64 bytes each. access rights, and read/write commands; it is divided into four subzones.
- Address $20 also serves as the virtual address of the Checksum Authentication Register (CAR) during checksum mode.
Table 2. Memory Map Table 3. Configuration Zone
blown, these EEPROM fuses can not be reset. The FAB fuse is blown by Atmel prior to shipping wafers to the card manufacturer. The PER fuse is blown by the issuer prior to shipping cards to the end user. The device responds to a read fuse command with fuse byte. Table 4. Fuse Byte tion subzone (except CMC and AR) and the secure code.
00000 P E R C M A F A B
Table 5. Access Rights
6 AT88SC153
Table 6. Access Registers allows the read and write passwords to be changed. either the read password or write password to allow read operations in the user zone. the user zone. If disabled (ATE = “1”), authentication is not required for access. zones into a single larger zone. zone at any time. The user zone must be written before the PER is blown.
from “1” to “0” but never from “0” to “1”. change Ci for the next authentication attempt. Memory Test Zone The memory test zone is an 8-bit free access zone for memory and protocol test. write passwords of the same set. By default, Password 1 is selected for all user zones. personalization is over (PER = 0). tions allowed (currently four). Table 7. Device Configuration Options “1”), the PAC and AAC will allow only four incorrect attempts.
8 AT88SC153
unlimited number of checksums without requiring a new authentication. address. The checksum mode can only be enabled once for a given authentication. responds as to a normal read comm and, from the address $28. zones might be combined in one larger zone. address byte of a page constitutes a write access byte for the bytes of that page. Table 8. Write Lock Example: The write lock byte (WLB) at $00 controls the bytes from $00 to $07. WLB can only be programmed, i.e., bits written to “0” cannot return to “1”.
1016D –SMEM –04/04 In the write lock configuration, only one byte of the page can be written at a time. Even if several bytes are received, only the first byte will be taken into account by the device. Password Verification Compare the operation password presented with the stored one, and write a new bit in the corresponding attempts counter for each wrong attempt. A valid attempt erases the attempts counter and allows the operation to be carried out as long as the chip is powered. The current password is memorized and active until power is turned off, unless a new password is presented or RST becomes active. Only one password is active at a time. The AT88SC153 requires that the Verify Password command be transmitted twice in sequence to successfully verify a write or read password. (This two-pass method of password verification was implemented in the AT88SC153 to protect the device from attacks on the password security system.) The first Verify Password command can be considered an initialization command. It will write a new bit (“0”) in the corresponding PAC. The data bits in this initialization command are ignored. The second Verify Pass- word command will compare the 3-byte password data presented with the corresponding password value stored in memory. If the comparison is valid, the PAC will be cleared. A successful password verification will allow authorized operations to be carried out as long as the chip is powered. The current password is memorized and active until power is turned off, a new password is presented, or RST becomes active. Only one password is active at a time. If a new user zone is selected that points to a dif- ferent password set, the new password must be verified and the old password becomes invalid. Authentication ProtocolThe access to an user zone may be protected by an authentication protocol in addition to password-dependent rights. The authentication success is memorized and active as long as the chip is powered, unless a new authentication is initialized or RST becomes active. If the new authentica- tion request is not validated, the card has lost its previous authentication and it should be presented again. Only the last request is memorized. The authentication verification protocol requires the host to perform an Initialize Authen- tication command, followed by a Verify Authentication command. The password and authentication may be presented at any time and in any order. If the trials limit has been reached, i.e., the 8 bits of the attempts counter have been written, the password verification or authentication process will not be taken into account.
10 AT88SC153
1016D –SMEM –04/04 Command Definitions and Protocols The communications protocol is based on the popular two-wire serial interface. Note that the most significant bit is transmitted first. Note: r : Read/write password p : Password set Read EEPROM Figure 4. Read EEPROM Note: *don ’t care bit zz: Zone number The data byte address is internally incremented following the transmission of each data byte. During a read operation, the address “roll over” is from the last byte of the current zone to the first byte of the same zone. If the host is not allowed to read at the specified address, the device will transmit the corresponding data byte with all bits equal to “0”. Write EEPROM Figure 5. Write EEPROM Note: *don ’t care bit zz: Zone number Table 9. Device Commands Write EEPROM CS3 CS2 CS1 CS0 z z 0 0 Read EEPROM CS3 CS2 CS1 CS0 z z 0 1 Verify Password CS3 CS2 CS1 CS0 r p 1 1 Initialize Authentication CS3 CS2 CS1 CS0 0 0 1 0 Verify Authentication CS3 CS2 CS1 CS0 0 1 1 0 Write Fuse CS3 CS2 CS1 CS0 1 0 1 0 Read Fuse CS3 CS2 CS1 CS0 1 1 1 0
1016D –SMEM –04/04 The data byte address lower three bits are internally incremented following the receipt of each data byte. The higher data byte address bits are not incremented, retaining the 8- byte write page address. Each data byte within a page must only be loaded once. Once a stop condition is issued to indicate the end of the host’s write operation, the device ini- tiates the internal nonvolatile write cycle. An ACK polling sequence can be initiated immediately. After a write command, if the host is not allowed to write at some address locations, a nonvolatile write cycle will still be initiated, but the device will only modify data at the allowed addresses. When write lock mode is enabled (WLM = “0”), the write cycle is initiated automatically after the first data byte has been transmitted. Read Fuses Figure 6. Read Fuses Note: F x = 1: fuse is not blown Fx = 0: fuse is blown The Read Fuses operation is always allowed. The AT88SC153 will continuously trans- mit the fuse byte if the host continues to transmit an ACK. The command is terminated when the host transmits a NACK and STOP bit. Write Fuses Figure 7. Write Fuses Note: nnn = 001 : Blow FAB nnn = 010 : Blow CMA nnn = 100 : Blow PER The Write Fuses operation is only allowed under secure code control; no data byte is transmitted by the host. The fuses are blown sequentially: CMA is blown if FAB is equal to “0”, and PER is blown if CMA is equal to “0”. If the fuses are all “0”s, the operation is canceled and the device waits for a new command. Once a stop condition is issued to indicate the end of the host’s write operation, the device initiates the internal nonvolatile write cycle. An ACK polling sequence can be ini- tiated immediately. S T O P S T A R T
12 AT88SC153
are transmitted least significant bit first, on the 32 clock pulses provided on SCL. The values programmed by Atmel are shown in Figure 8 below. Figure 8. Answer-to-reset Values Figure 9. Verify Password Notes: Pw: Password, 3 bytes. command. It will write a new bit (“0”) in the PAC corresponding to the “r” and “p” bits. password value stored in memory. If the comparison is valid, the PAC will be cleared. issued, a nonvolatile write cycle is initiated to update the associated attempts counter.
14 AT88SC153
Acknowledge All addresses and data are serially transmitted to and from the device in 8-bit words. during the ninth clock cycle. and after the receipt of the stop bit and the completion of any internal operations. condition and after a stop condition. Figure 13. Data Validity
Figure 14. Output Acknowledge
16 AT88SC153
Table 10. DC Characteristics Notes: 1. This parameter is preliminary; Atmel may change the specifications upon further characterization. IL min and VIH max are reference only and are not tested. Applicable over recommended operating range from: VCC = +2.7V to 5.5V, TAC = 0°C to +70°C (unless otherwise noted).
Table 11. AC Characteristics Notes: 1. This parameter is characterized and is not 100% tested.
- Input rise and fall transitions must be monotonic.
Table 12. Pin Capacitance Notes: 1. This parameter is characterized and is not 100% tested.
5.0 Volt
Applicable at recommended operating conditions: TA = 25°C, f = 1.0 MHz, VCC = +2.7V.
18 AT88SC153
Figure 16. Synchronous Answer-to-reset Timing Figure 17. Write Cycle (SCL: Serial Clock; SDA: Serial Data I/O) end of the internal clear/write cycle.
1016D –SMEM –04/04
Ordering Information
Notes: 1. Formal drawings may be obtained from an Atmel Sales Office. Ordering Code Package Voltage Range Temperature Range A T88SC153-09ET -00 M2 – E Module 2.7V –5.5V Commerical (0 °C –70°C) A T88SC153-09PT -00 M2 – P Module 2.7V –5.5V Commerical (0 °C –70°C) AT88SC153-09GT -00 M2 – G Module 2.7V –5.5V Commerical (0 °C –70°C) AT88SC153-09HT-00 M3 – H Module 2.7V –5.5V Commerical (0 °C –70°C) AT88SC153-10PI-00 8P3 2.7V –5.5V Industrial (−40°C –85°C) AT88SC153-10SI-00 8SI 2.7V –5.5V Industrial (−40°C –85°C) AT88SC153-10CI-00 8C 2.7V –5.5V Industrial (−40°C –85°C) AT88SC153-10WI-00 7 mil Wafer 2.7V –5.5V Industrial (−40°C –85°C) Package Type(1) Description M2 – P Module M2 ISO 7816 Smart Card Module with Atmel Logo M2 – E Module M2 ISO 7816 Smart Card Module M3 – G Module M3 ISO 7816 Smart Card Module M3 – H Module M3 ISO 7816 Smart Card Module with Atmel Logo 8S1 8-lead, 0.150 ” Wide, Plastic Gull Wing Small Outline Package (JEDEC SOIC) 8P3 8-lead, 0.300 ” Wide, Plastic Dual Inline Package (PDIP) 8C 8-lead, 0.230 ” Wide, Leadless Array Package (LAP)
20 AT88SC153
1016D –SMEM –04/04 Smart Card Modules *Note: The module dimensions listed refer to the dimensions of the exposed metal contact area. The actual dimensions of the module after excise or punching from the carrier tape are generally 0.4 mm greater in both directions Module Size: M2-00 Dimension*: 12.6 x 11.4 [mm] Thickness: 0.58 [mm] max Pitch: 14.25 [mm] Glob Top: Clear, Round: 8.0 [mm] max/KC6 Ordering Code: 09ET-00 Module Size: M3 Dimension*: 10.6 x 8.0 [mm] Thickness: 0.58 [mm] max Pitch: 9.5 [mm] Glob Top: Clear, Round: 6.9 [mm] max/KC6 Ordering Code: 09GT-00 Module Size: M2 Dimension*: 12.6 x 11.4 [mm] Glob Top: Square: 8.8 x 8.8 [mm] Thickness: 0.58 [mm] Pitch: 14.25 [mm] Ordering Code: 09PT-00 Module Size: M3 Dimension*: 10.6 x 8.0 [mm] Thickness: 0.58 [mm] max Pitch: 9.5 [mm] Glob Top: Clear, Round: 6.9 [mm]/KC6 Ordering Code: 09HT-00
1016D –SMEM –04/04 Ordering Code: 10SI-00 8-lead SOIC
2325 Orchard Parkway
San Jose, CA 95131 TITLE DRAWING NO. R REV. Note: 10/10/01 8S1, 8-lead (0.150" Wide Body), Plastic Gull Wing Small Outline (JEDEC SOIC) 8S1 A COMMON DIMENSIONS (Unit of Measure = mm) SYMBOL MIN NOM MAX NOTE These drawings are for general information only. Refer to JEDEC Drawing MS-012 for proper dimensions, tolerances, datums, etc. H N Top View C E End View A B L e D Side View A – – 1.75 B – – 0.51 C – – 0.25 D – – 5.00 E – – 4.00 e 1.27 BSC H – – 6.20 L – – 1.27
22 AT88SC153
1016D –SMEM –04/04 Ordering Code: 10PI-00 8-lead PDIP San Jose, CA 95131 TITLE DRAWING NO. R REV. 8P3, 8-lead, 0.300" Wide Body, Plastic Dual In-line Package (PDIP) 01/09/02 8P3 B Notes: 1. This drawing is for general information only; refer to JEDEC Drawing MS-001, Variation BA, for additional information. 2. Dimensions A and L are measured with the package seated in JEDEC seating plane Gauge GS-3. 3. D, D1 and E1 dimensions do not include mold Flash or protrusions. Mold Flash or protrusions shall not exceed 0.010 inch. 4. E and eA measured with the leads constrained to be perpendicular to datum. 5. Pointed or rounded lead tips are preferred to ease insertion. COMMON DIMENSIONS (Unit of Measure = inches) SYMBOL MIN NOM MAX NOTE D E e Lb2 b A2 A N eA c
4 PLCS
A –– 0.210 2 A2 0.115 0.130 0.195 b 0.014 0.018 0.022 5 b2 0.045 0.060 0.070 6 b3 0.030 0.039 0.045 6 c 0.008 0.010 0.014 D 0.355 0.365 0.400 3 D1 0.005 –– 3 E 0.300 0.310 0.325 4 E1 0.240 0.250 0.280 3 e 0.100 BSC eA 0.300 BSC 4 L 0.115 0.130 0.150 2 Top View Side View End View
1016D –SMEM –04/04 Ordering Code: 10CI-00 8-lead LAP San Jose, CA 95131 TITLE DRAWING NO. R REV. 8CN1 , 8-lead (8 x 5 x 1.04 mm Body), Lead Pitch 1.27 mm, Leadless Array Package (LAP) A8CN1 11/13/01 COMMON DIMENSIONS (Unit of Measure = mm) SYMBOL MIN NOM MAX NOTE A 0.94 1.04 1.14 A1 0.30 0.34 0.38 b 0.36 0.41 0.46 1 D 7.90 8.00 8.10 E 4.90 5.00 5.10 e 1.27 BSC e1 0.60 REF L 0.62 .0.67 0.72 1 L1 0.92 0.97 1.02 1 Note: 1. Metal Pad Dimensions. Pin1 Corner Marked Pin1 Indentifier 0.10 mm TYP Top View L b e Side View A Bottom View E D
Printed on recycled paper. Disclaimer: Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company ’s standard warranty which is detailed in Atmel’s T erms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. Atmel Corporation Atmel Operations San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza
77 Mody Road Tsimshatsui
Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Memory San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 Microcontrollers San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602
44306 Nantes Cedex 3, France
13106 Rousset Cedex, France
1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 RF/Automotive Theresienstrasse 2 Postfach 3535
74025 Heilbronn, Germany
1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123
38521 Saint-Egreve Cedex, France
literature@atmel.com Web Site http://www.atmel.com 1016D –SMEM –04/04 © Atmel Corporation 2004. All rights reserved. Atmel® and combinations thereof are trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be the trademarks of others.