Download PDFAT88SC1608 ATMEL
Document overview
- Manufacturer or author: Provided By digicamel.com
- PDF pages: 25
Technical content
Features
One 128 x 8 (1K bit) Configuration Zone Eight 256 x 8 (16K bits) User Zones Low Voltage Operation: 2.7V to 5.5V Two-wire Serial Interface 16-byte Page Write Mode Self-timed Write Cycle (10 ms max) Answer-to-Reset Register High Security Memory Including Anti-wiretapping – 64-bit Authentication Protocol (under exclusive patent license from EL VA) – Authentication Attempts Counter – Eight Sets of Two 24-bit Passwords – Specific Passwords for Read and Write – Sixteen Password Attempts Counters – Selectable Access Rights by Zone ISO Compliant Packaging High Reliability – Endurance: 100,000 Cycles – Data Retention: 100 Years – ESD Protection: 4,000V (min) Low-power CMOS Card Module Contact 8-pin SOIC, PDIP, or LAP Table 1. Pin Configuration
2 AT88SC1608
each part. When both agree on the same result, the access to the memory is permitted. Figure 1. Security Methodology
ISO 7816-10 synchronous answer-to-reset. Figure 2. Block Diagram Supply Voltage (VCC) The VCC input is a 2.7V-to-5.5V positive voltage, supplied by the host. clock data out of the device. 32-bit answer-to-reset register. All password and authentication access will be reset. presented to re-establish user access.
4 AT88SC1608
Memory Mapping The first 16K bits of the memory are divided into eight user zones of 256 bytes each. Table 1. Memory Map
rights, and read/write commands; it is divided into six subzones. blown, these EEPROM fuses can not be reset. The FAB fuse is blown by Atmel prior to shipping wafers to the card manufacturer. The PER fuse is blown by the issuer prior to shipping cards to the end user. The fuses are read and written in the configuration zone using the address $80. Table 2. Configuration Zone Table 3. Fuse Byte
00000 P E R C M A F A B $ 8 0
6 AT88SC1608
Figure 3. Access Rights
each user zone will specify the privileges and requirements for access to that zone. allowed but is not recommended. If enabled (MDF = “0”), no write access is allowed in the zone at any time. Table 4. Access Registers
8 AT88SC1608
0971G –SMEM –04/04 Cryptogram (Ci) The 64-bit cryptogram is generated by the internal random generator and modified after each successful verification of the cryptogram by the chip, on host request. The initial value, defined by the issuer, is diversified as a function of the identification number. Secret Seed (Gc) The 64-bit secret seed, defined by the issuer, is diversified as a function of the identifica- tion number. Memory Test Zone The memory test zone is a 64-bit free access zone for memory test. Password Sets The password sets are eight sets of two 24-bit passwords for read and write operations, defined by the issuer. The write password allows the user to modify the read and write passwords of the same set. By default, the eighth set of passwords (Write 7/Read 7) is active for all user zones. Secure Code A 24-bit password, defined by Atmel, that is different for each card manufacturer. The Write Password 7 is used as the secure code until the personalization is over (PER = 0). Attempts Counters There are 16 8-bit password attempts counters (PACs), one for each password, and one other 8-bit attempts counter for the authentication protocol (AAC). The attempts counters limit the number of consecutive incorrect code presentations allowed (currently eight). User Zones These zones are dedicated to user data. The access rights of each zone are program- mable separately via the access registers. If several zones share the same password set, the set will be entered only once (after the part is powered up). Therefore, several zones can be combined into one larger zone. The user zone address should be changed each time a new zone is being reached. Security Operations Password Verification Compare the operation password presented with the stored one and write a new bit in the corresponding attempts counter for each wrong attempt. A valid attempt before the limit erases the attempts counter, and allows the operation to be carried out as long as the chip is powered. Only one password is active at a time. When a new password is presented, access priv- ileges defined by the previous password become invalid. If the trials limit has been reached (i.e., the 8 bits of the attempts counter have been writ- ten), the password verification process will not be taken into account. Authentication ProtocolThe access to a user zone may be protected by an authentication protocol in addition to password-dependent rights. The authentication success is memorized and active as long as the chip is powered, unless a new authentication is initialized or RST becomes active. If the new authentica- tion request is not validated, the card has lost its previous authentication and it should be presented again. Only the last request is memorized. The authentication verification protocol requires the host to perform an Initialize Authen- tication command, followed by a Verify Authentication command.
the password verification or authentication process will not be taken into account. that the most significant bit is transmitted first. sends a new one and as long as the chip is powered. Table 5. Device Commands
10 AT88SC1608
0971G –SMEM –04/04 Read Zone Figure 5. Read Zone Note: z = 0: Read user zone z = 1: Read configuration zone The data byte address is internally incremented following the transmission of each data byte. As long as the AT88SC1608 receives an acknowledge from the host, it will con- tinue to increment the data byte address and serially clock out sequential data bytes. During a read operation, the address will “roll over” from the last byte of the current zone to the first byte of the same zone. If the host is not allowed to read at the specified address, the device will transmit the data byte with all bits equal to “0”. Write Zone Figure 6. Write Zone Note: z = 0: Write user zone z = 1: Write configuration zone The lower four bits of the data byte address are internally incremented following the receipt of each data byte. The higher data byte address bits are not incremented, retain- ing the 16-byte write-page address. Each data byte within a page must only be loaded once. Once a stop condition is issued to indicate the end of the host’s write command, the device initiates the internally timed nonvolatile write cycle. An ACK polling sequence can be initiated immediately. After a write command, if the host is not allowed to write to some address locations, a nonvolatile write cycle will still be initiated. However, the device will only modify data at the allowed addresses. Read Fuses Figure 7. Read Fuses Note: F x = 1: fuse is not blown Fx = 0: fuse is blown S T O P A C K A C K A C K S T A R T Command Byte Add (n) Data (n) Data (n+x) N A C K
0 A7 A0– D 7 D 0– D 7 D 0–
S T O P A C K A C K A C K S T A R T Command Byte Add (n) Data (n) Data (n+x) A7 A0– D 7 D 0– D 7 D 0–1 0 1 1 0 z 0 0 A C K A C K A C K S T A R T Command Fuses Add 1 0 1 1 0 1 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 F2 F1 F0 N A C K S T O P
0971G –SMEM –04/04 The read fuses operation is always allowed. The device only transmits one data byte and waits for a new command. Write Fuses Figure 8. Write Fuses The write fuses operation is only allowed under secure code control and no data byte is transmitted by the host. The fuses are blown sequentially: CMA is blown if FAB is equal to “0”, and PER is blown if CMA is equal to “0”. If the fuses are all “0”s, the operation is canceled and the device waits for a new command. Once a stop condition is issued to indicate the end of the host’s write operation, the device initiates the internal nonvolatile write cycle. An ACK polling sequence can be ini- tiated immediately. Once blown, these fuses cannot be reset. A C K A C K S T A R T Command Fuses Add 1 0 1 1 0 1 0 0 1 0 0 0 0 0 0 0 S T O P
12 AT88SC1608
are transmitted least significant bit (LSB) first on the 32 clock pulses provided on SCL. Following a RST assertion, all password and authentication access privileges are reset. The values programmed by Atmel are shown in Figure 9 below. Figure 9. Answer-to-reset Figure 10. Verify Password
- The four bits “rppp” indicate the password to compare:
valid, the PAC will have one additional bit written to “0”.
address of $B7, corresponding to the verify authentication command. Figure 12. Verify Authentication atile write cycle, but no clear operation will be performed on the AAC. high time periods will indicate a start or stop condition as defined below. any other command (see Figure 13).
14 AT88SC1608
the stop command will place the device in a standby power mode (see Figure 13). Acknowledge All addresses and data are serially transmitted to and from the device in 8-bit words. transmit this ACK bit will terminate the read operation. and after the receipt of the stop bit and the completion of any internal operations. Figure 13. Start and Stop Definition condition and after a stop condition. Figure 14. Data Validity
Figure 15. Output Acknowledge
16 AT88SC1608
Table 6. DC Characteristics Notes: 1. This parameter is preliminary; Atmel may change the specifications upon further characterization.
- VIL min and VIH max are reference only and are not tested.
Applicable over recommended operating range from: VCC = +2.7V to 5.5V, TAC = 0°C to +70°C. (unless otherwise noted).
Power Management If VCC falls below 1.9V, the chip stops working until it rises above 2.7V.
- This parameter is characterized and is not 100% tested.
- This parameter is characterized and is not 100% tested.
Table 7. AC Characteristics(1) Table 8. Pin Capacitance(1)
18 AT88SC1608
Figure 16. Bus Timing Figure 17. Synchronous Answer-to-reset Timing
Figure 18. Write Cycle Timing Note: The write cycle Time tWR is the time from valid stop condition of a write sequence to the end of the internal clear/write cycle.
20 AT88SC1608
0971G –SMEM –04/04
Ordering Information
Note: 1. Formal drawings may be obtained from an Atmel sales office. Ordering Code Package Voltage Range Temperature Range A T88SC1608-09ET -00 M2 – E Module 2.7V–5.5V Commerical (0°C –70°C) A T88SC1608-09PT -00 M2 – P Module 2.7V–5.5V Commerical (0°C –70°C) A T88SC1608-10PI-00 8P3 2.7V–5.5V Industrial (−40°C –85°C) A T88SC1608-10SI-00 8SI 2.7V–5.5V Industrial (−40°C –85°C) A T88SC1608-10CI-00 8C 2.7V–5.5V Industrial (−40°C –85°C) A T88SC1608-10WI-00 7 mil Wafer 2.7V–5.5V Industrial (−40°C –85°C) Package Type(1) Description M4 – E Module M4 ISO 7816 Smart Card Module M4 – P Module M4 ISO 7816 Smart Card Module with Atmel Logo 8S1 8-lead, 0.150 ” Wide, Plastic Gull Wing Small Outline Package (JEDEC SOIC) 8P3 8-lead, 0.300 ” Wide, Plastic Dual Inline Package (PDIP) 8C 8-lead, 0.230 ” Wide, Leadless Array Package (LAP)
0971G –SMEM –04/04 Smart Card Modules *Note: The module dimensions listed refer to the dimensions of the exposed metal contact area. The actual dimensions of the module after excise or punching from the carrier tape are generally 0.4 mm greater in both directions Module Size: M2 Dimension*: 12.6 x 11.4 [mm] Thickness: 0.58 [mm] max Pitch: 14.25 [mm] Glob Top: Round: 8.0 [mm] max/KC6 Ordering Code: 09ET-00 Module Size: M2 Dimension*: 12.6 x 11.4 [mm] Glob Top: Square: 8.8 x 8.8 [mm] Thickness: 0.58 [mm] Pitch: 14.25 [mm] Ordering Code: 09PT-00
22 AT88SC1608
0971G –SMEM –04/04 Packaging Information Ordering Code: 10SI-00 8-lead SOIC
2325 Orchard Parkway
San Jose, CA 95131 TITLE DRAWING NO. R REV. Note: 10/10/01 8S1, 8-lead (0.150" Wide Body), Plastic Gull Wing Small Outline (JEDEC SOIC) 8S1 A COMMON DIMENSIONS (Unit of Measure = mm) SYMBOL MIN NOM MAX NOTE These drawings are for general information only. Refer to JEDEC Drawing MS-012 for proper dimensions, tolerances, datums, etc. H N Top View C E End View A B L e D Side View A – – 1.75 B – – 0.51 C – – 0.25 D – – 5.00 E – – 4.00 e 1.27 BSC H – – 6.20 L – – 1.27
0971G –SMEM –04/04 Ordering Code: 10PI-00 8-lead PDIP San Jose, CA 95131 TITLE DRAWING NO. R REV. 8P3, 8-lead, 0.300" Wide Body, Plastic Dual In-line Package (PDIP) 01/09/02 8P3 B Notes: 1. This drawing is for general information only; refer to JEDEC Drawing MS-001, Variation BA, for additional information. 2. Dimensions A and L are measured with the package seated in JEDEC seating plane Gauge GS-3. 3. D, D1 and E1 dimensions do not include mold Flash or protrusions. Mold Flash or protrusions shall not exceed 0.010 inch. 4. E and eA measured with the leads constrained to be perpendicular to datum. 5. Pointed or rounded lead tips are preferred to ease insertion. COMMON DIMENSIONS (Unit of Measure = inches) SYMBOL MIN NOM MAX NOTE D E e Lb2 b A2 A N eA c
4 PLCS
A –– 0.210 2 A2 0.115 0.130 0.195 b 0.014 0.018 0.022 5 b2 0.045 0.060 0.070 6 b3 0.030 0.039 0.045 6 c 0.008 0.010 0.014 D 0.355 0.365 0.400 3 D1 0.005 –– 3 E 0.300 0.310 0.325 4 E1 0.240 0.250 0.280 3 e 0.100 BSC eA 0.300 BSC 4 L 0.115 0.130 0.150 2 Top View Side View End View
24 AT88SC1608
0971G –SMEM –04/04 Ordering Code: 10CI-00 8-lead LAP San Jose, CA 95131 TITLE DRAWING NO. R REV. 8CN1 , 8-lead (8 x 5 x 1.04 mm Body), Lead Pitch 1.27 mm, Leadless Array Package (LAP) A8CN1 11/13/01 COMMON DIMENSIONS (Unit of Measure = mm) SYMBOL MIN NOM MAX NOTE A 0.94 1.04 1.14 A1 0.30 0.34 0.38 b 0.36 0.41 0.46 1 D 7.90 8.00 8.10 E 4.90 5.00 5.10 e 1.27 BSC e1 0.60 REF L 0.62 .0.67 0.72 1 L1 0.92 0.97 1.02 1 Note: 1. Metal Pad Dimensions. Pin1 Corner Marked Pin1 Indentifier 0.10 mm TYP Top View L b e Side View A Bottom View E D
Printed on recycled paper. Disclaimer: Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company ’s standard warranty which is detailed in Atmel’s T erms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. Atmel Corporation Atmel Operations San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza
77 Mody Road Tsimshatsui
Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Memory San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 Microcontrollers San Jose, CA 95131 Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602
44306 Nantes Cedex 3, France
13106 Rousset Cedex, France
1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 RF/Automotive Theresienstrasse 2 Postfach 3535
74025 Heilbronn, Germany
1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906 Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123
38521 Saint-Egreve Cedex, France
literature@atmel.com Web Site http://www.atmel.com 0971G –SMEM –04/04 © Atmel Corporation 2004. All rights reserved. Atmel® and combinations thereof are registered trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be the trademarks of others.