Title of Invention

UPDATE MANAGEMENT FOR ENCODED DATA IN MEMORY

Abstract

This invention concerns a system to update encoded data stored in a memory of a data processing device such as a smartcard. In this system, the data is represented by a tree structure in directories and files according to an object representation. According to the invention, the update system comprises a specific referencing object able to reference all or some of the attributes of the encoded data in memory. A microcontroller is then programmed to extract from the referencing object the information required to locate the memory block occupied by this attribute, and update this block, replacing it by the new previously encoded data.

Full Text

Update management for encoded data in memory. Technical field This invention concerns update management for encoded data stored in memory. The invention applies especially to the management of security data stored in a memory of a token. The example chosen to illustrate the invention is that of the smartcard. The invention applies especially to portable devices including a WIM (WAP Identity Module) application. This WIM application generally included in a smartcard performs, when requested by a data processing device such as a cellular telephone, operations using public keys such as electronic signatures or data encryption, etc. In this WIM application, the data is stored in memory in compliance with standard PKCS#15 (P K C S: Public-Key Cryptography Standards) defined and published by the RSA incorporation laboratories for the implementation of Public Key Cryptography. As a reminder, note that Public Key Cryptography uses a pair of keys, a public key which can be disclosed to everyone and a private key which must be kept in a safe place and never disclosed. This standard uses an object-oriented data structure, i.e. a hierarchic structure of object classes sorted by category. Note that the RSA laboratory defines a set of standards PKCS #n (n is the identifier of the standard; RSA uses an integer to identify the various PKCS standards) designed to ensure data interoperability in heterogeneous computer systems. These various standards (PKCS#1. ..., PKCS#15) define the data types and the algorithms used in public key cryptography. In particular, the standard PKCS#15 concerns the cryptology information stored on tokens capable of staring permanent data. Refer to the RSA documentation describing these various standards. This document is available at the following web site: http://www.rsasecurlty.com. State of the art technoloqv Generally, cryptography uses a private key accessed only by a user and a public key which can be published or distributed upon request for use by those people wanting to communicate with the user. A person wanting to communicate with the user will first obtain a certificate which can be obtained from a certification authority, bearing the user's public key. Data concerning the keys and certificates is represented by a tree structure in directories and files. Two file types are generally found in this structure: - the DF type files containing file control information (and pointers to EF files or other files), - and the EF (elementary files) type files . In this application, we will not detail the access conditions defined at each level of the card file structure and for function groups acting on the files. More precisely, format PKCS#15 defines four object classes attached to the root. These classes are: the Key class, the certificate class, the authentication class, and the data class. These classes themselves include subclasses. For example, the "Key" class includes three classes called: private key class secret key class public key class Each object belonging to a class includes attributes. A tree therefore generally includes several objects distributed thraughout the tree. These objects and directories are represented according to the standard ASN.1 (ASN.I Abstract Syntax Notation) ISO/IEC 8824 published by ANSI (American National Standards Institute). This standard specifies the syntax to be used to describe complex data objects. These objects are then encoded according to Distinguished Encoding Rules (DER) defined in the same standard ASN.1. These encoding rules define the encoding of objects as byte sequences. There is no need to describe this standard ASN.1 any further since it is not the subject of the invention. Once encoding has been carried out, an application external to the card, for example a card reader, can read the encoded data stored on the card from a directory PKCS#15 (the root) and find from the tree structure described above how to use the keys, the certificates and applications stored on the card. Encoding is generally carried out during the card personalisation. After personalisation, some tree attributes may have to be updated. This updating is extremely complicated. Updating from a reader consists, in fact, of two main steps: - Firstly, all encoded data must be decoded, - Secondly, once updating has bee carried out, this data must be encoded again. These two steps must be repeated whenever at least one attribute of an object has to be updated. The invention One purpose of the invention is to simplify the procedure used to update the encoded data on the card. The card therefore includes in memory a specific referencing object able to reference all or some of the attributes of the encoded data in memory. According to the invention, updating comprises the following steps: - a step to extract from the referencing object the information required to locate the memory block occupied by this attribute, - a step to update this block, replacing it by the new data, previously encoded. Unlike the previous method, it is no longer necessary to decode all the encoded data then re-encode all this data after the update. Now, by using the referencing object, it is possible to update only some of the encoded data. The location information is extracted from the referencing object in order to locate the encoded data which must be updated. The new data is now simply encoded and stored in place of the previous data. The update procedure is considerably simplified. I ■■ It will be easier to understand the invention on reading the description 'oetov-i, given as an example and referring to the attached drawings. In the drawings Figure 1 is a view of a computer system on which the invention can be applied. Figure 2 is a diagrammatic view of an example of the card file tree structure. Figure 3 is a diagrammatic view' of the aata organisation in memory. Figure 4 shows an example of realisation of a referencing object. Figure 5 is an algorithm illustrating the various steps of an example of realisation. Description of an example of realisation To simplify the description, the same elements illustrated in the drawings have the same references. Figure 1 is a simplified view of a computer system on which the invention can be implemented. This system includes a smartcard CAR and a smartcard reader RDR. This reader can be incorporated in a computer such as a cellular telephone, an electronic assistant, etc. Note that a computer is a programmable machine capable of data processing. In our example of realisation, the smartcard reader is incorporated in a cellular telephone. Note that a smartcard includes an electronic module (not shown). The module includes a microcontroller and contacts to communicate with the exterior. The microcontroller generally includes: - a microprocessor to execute the commands, - non volatile memories ROM (Read Only Memory), whose content is burnt in in the factory and therefore cannot be modified. An encryption algorithm, the operating system, application programming interfaces (API), etc. can therefore be written in the ROM; non volatile memories, 'or example EEPROM {electrically erasable programmable read only memory. This memory is generally used to store data specific to each card, for example the cardholder identity, the access rights to the services, the file systems of the card application programs, etc. - volatile memories RAM, work space to execute the card commands, - security units, taking into consideration the power supply voltage, clock speed, etc., - a data bus connecting everything, - an input-output bus BUS to communicate, in our example of realisation, with the reader RDR. The card stores various items of information in memory. An application WIM stored in this memory performs operations when requested by the cellular telephone. For example, when the cellular telephone requires a signature, it transmits a command to the application WIM, instructing it to produce the signature and return the requested signature to the telephone. Note that the private key which is used to produce the signature is never disclosed. This application WIM generally uses several private keys stored in the card. When the telephone requests a signature from the application, it must therefore indicate the key to be selected for the cryptography operation. The telephone first reads the tree from the root PKCS#15 up to the nodes associated with the private keys to find the number of private keys available in the application W/M and the identifier of each key. This data is stored in memery as a tree structure. Figure 2 is a diagranrs illustrating this structure, in our example, this tree includes files cf type DF and EF (elementary files) in its nodes. The DF file is called PKCS#15 and represents the tree root. File PKCS#15 has sub-nodes, including a node called EF(ODF) which is an elementary file containing pointers lo other elementary files, especially pointers to - an elementary file called EF(PrKDF) containing full information concerning the private keys in the application WIM, - an elementary file called EF(PuKDF) dedicated to the public keys, - an elementary file called EF(CDF) dedicated to the certificates, - etc. Each file EF(PrKDF), EF(PuKDF) and EF(CDF) generally contains an object directory PKCS#15 of a special class. The content of file EF(ODF) complies with ASN.1 syntax. An object can be written in the elementary file EF(PrKDF), corresponding to a private key, as follows: value PKCS15PrivateKey ::= privateRSAKey : { commonObjectAttributes { label "AUT-KEY", flags {private}, authld'01 H classAttributes ( iD'6754C890FD57453289AB9076E54245BC6D709FE7'H, usage { encrypt, decrypt, sign, verify }, keyReference 1 } typeAttributes { value indirect; path : { path'0012'H }. modulusLength 1024 } } On reading this file, we see that each object includes several attributes. This file includes the following attributes: - The "Label" attribute whose value is AUT-KEY - The "Flag" attribute whose value is {private}. The value {private} indicates that this attribute is protected against unauthorised access. On an integrated circuit card, the accesses (read, write, in use, etc.) to so-called private objects are defined by authentication objects. An access condition could be entry of a PIN code known by the user. - The attribute "AuthId" which includes the value '01'H designating the identifier of the PIN code which protects the use of this key. - The attribute "ClassAttibute.iD" is the key identifier. In our example, it is a binary value which is the value obtained by a cryptographic hashing function such as the SHA-1 function of the public key. For further details on this function, refer to standard FIPS 180- 1. The hashing function is not essential in this application. - The attribute "Usage' which has four values { encrypt, decrypt, sign, verify } indicating that this key is only used for encryption, decryption, document signature and signature verification. - Attributes which provide information abcut the key access path. In our example this key, of length 1024 bytes, is accessed via an access path given by'0012'H. In our example of realisation, this file is created during the smartcard personalisation phase. When all files have been written, the data is encoded according to the DER standard. After encoding, the result is stored in memory. As seen in the introduction, the problem is that once the encoding has been carried out, updating one or more attributes is very costly in terms of computation time and the level of difficulty of the update algorithm. According to the invention, referencing objects are created, whose attribute values provide information on the referencing in memory of all or some of the object attributes PKCS#15,These referencing objects will then be used by programs running in the device (smartcard in this example) or in the card reader. In our example of realis'ation, this referencing object is created during the smartcard personalisation phase. Figure 3 is a diagrammatic and general view of the data organisation in a file Er(PrKDF) after encoding. Generally, all data items in the memory are concatenated, i.e. stored one after the other. In this file, each attribute has length L, i.e. a number of bytes. The position of each attribute in a file EF can also be determined using a counter OFF which represents in number of bytes the offset between the start of the file EF(PrKDF) and the 1st byte of the attribute. For example, in this file EF(PrKDF), a first attribute ATT1 has a length L12 bytes. This attribute is the first attribute referenced in the file EF(PrKDF); its counter OFF1 is therefore equal to 0. The next attribute ATT2 has a length L23 bytes and its counter 0FF2 is equal to L12. Similarly, attribute ATT3 has length L34 bytes and a counter of L12+L23, and so on. Referencing can be carried out in several ways. In our example of realisaticn, we have chosen to use the following attributes: - an object type attribute (e.g. privateRSAKey) - an attribute designating the instance concerned for this object type, - an attribute to designate the attribute name, - a counter OFF attribute used to locate in the file (e.g. EF(PrKDF)) the data block associated with this attribute - a Length attribute used to indicate the length of the attribute concerned. Obviously, there are different ways to locate data in a file. For example, instead of the "Counter" and "Length" attributes, the start and end addresses of the data block occupied by this attribute can be used. Figure 4 is an example of a referencing object. On this figure, the attributes are represented as a table. The above five attributes are stored in this table. In our example of realisation, we want to update the attributes Label and ClassAttributes.iD stored in .file EF(PrKDF) defined above. We will assume that the object to be modified is the first instance stored with type "privateRSAKey" in file EF(PrKDF). Obviously, the tree PKGS#15 can store other instances of the same type and other files including objects with attributes. The principle of the invention also applies to all these instances and all these files. The first row concerns the attribute ClassAttributes.iD. For this attribute, - The first column in the table identifies the object type. In our example, the object type is "privateRSAkey". - The second column indicates that the instance concerned is the first instance of type "pnVateRSAkey". Obviously, this column is only required if there is more than one instance of this type in the tree. - The third column indicates its name "Labef. - The fourth column indicates the file concerned ~F(PrKDF) storing the attribute ClassAttributes.iD. - The fifth attribute gives the counter which is 15 bytes in cur exarnple. - The sixth attribute gives the attribute length in bytes. In our example, this attribute is set to 20 bytes. In our example illustrated, for security reasons, this table must be write protected. Preferably, the attributes Counter and Length are set independently from the length of the values of the attributes to be updated. In other words, for each attribute referenced in the table, a specific length is set which cannot be modified. This specific length includes enough bytes to store attributes of varying length. Figure 5 is an algorithm illustrating the main steps of the method applied to our example of realisation. Assume that the updating concerns the attribute "Label" in file EF(PrKDF) of type privateRSAKey and that the new value of this attribute is "AUT-KEY2". The steps are as follows: Step 1: A first step ET1 consists of obtaining the new value to be updated in file EF(PrKDF). Step 2: A second step ET2 consists of transmitting the new value of the attribute "Label" to the card for updating, using a command included in the cellular telephone. (n order to identify the attribute in the table, since it could be in several flies in the tree at the same time, the command also includes, in our example, the attributes ClassAttributes.iD and the instance concerned "privateRSAkey". A computer program stored in the cellular telephone transmits an update command to the card. Step 3 During a third step ET3, the card receives and processes the command. A computer program stored in the card is activated upon reception of rhe update command sent from the cellular telephone. This program then points io the referencing object to locate the attribute "Label" in memory. Step 4 During a fourth step ET4, the referencing object supplies the counter with 110 and the length with 20. Step 5 A fifth step ET5 consists of encoding this new value "AUT-KEY2" and writing it at the position indicated. Another example could be the generation of a new public key pair in the smartcard. In our example, the hash of the public key is used as the key identifier in the objects PKCS#15. After generating the key pair, the corresponding objects PKCS#15 must be updated by the new hashed value of the public key. Since the hashed value of the public key has a fixed length, the application stored in the card which generates the new public key pair only needs to find all instances of the hashed public key to be replaced amongst the objects PKCS#15; the application uses the specific referencing object to find these instances. Once the instances have been found, they are updated by the new values. In this case, the procedure is the same with an additional step ET4bis. The encoding of step 4 is therefore preceded by a hashing step on the value of the attribute "ClassAttribute.iD". A synonym for "public key pair" is "asymmetric key pair". Generally, the invention concerns a data processing device, in particular a smartcard, storing in memory encoded data represented by a tree structure in directories and files according to an object representation, characterised in that it comprises - a specific referencing object able to reference all or some of the attributes of the encoded data in memory, - and in that the update of the encoded data is managed by a microcontroller programmed to - extract from the referencing object the information required to locate the memory block occupied by this attribute. - and update this block, replacing it by the new data, previously encoded. This referencing object is stored in memory in the data processing device. We have seen in our example of realisation that this referencing object is write protected for obvious security reasons. Write protection ensures that the referencing data stored in this memory will not be modified. The microcontroller programmed for the update may either be located on the data processing device or on an external tool connected to the data processing device. In our example of realisation, said referencing object comprises permanent data, i.e. the data remains unchanged even in case of power failure. In our example, even when the card is withdrawn from its reader, i.e. when it is no longer powered up, this object is stored in memory and cannot be changed. Also, we have seen that said referencing object includes attributes. In our example of realisation, five attributes were defined. We can see that three attributes are sufficient to identify - the file, for example file EF(PrKDF), - the attribute, for example attribute ClassAttributes.iD to be updated in this file, and the location, for example by the pair of values (counter, Length), of this attribute in the file in question. We obtain a method to update encoded data stored in a memon/ of a data processing device such as a smartcard, characterised in that it comprises; - a preliminary step to create a specific referencing object able to reference all or some of the attributes of the encoded data in memory, and in that updating comprises the following steps: - a step to extract from the referencing object the information required to locate the memory block occupied by this attribute, - a step to update this block, replacing it by the new data, previously encoded. Preferably, this specific referencing object is created during the smartcard personalisation phase. The invention also concerns a computer program to update encoded data stored in a memory of a data processing device such as a smartcard, said program comprising program code instructions to execute update steps as previously defined, said program being executed using a microcontroller of the update system as previously defined. We have also seen that this program carries out updating which can either be carried out by a microcontroller located on the card or on an external tool connected to the card. This external tool could be, for example, a mobile telephone reader to which the smartcard is connected. The invention offers significant savings in terms of computation time, storage size as well as considerably simplifying the update algorithm. APPENDIX 1) writing file EF(PrKDF') according to standard PKCS#15 and ASN1 value PKCS15PrivateKey ::= privateRSAKey : { commonObjectAttributes { label "AUT-KEY", flags { private }, authld'01'H }. classAttributes { iD '00111111111111111111111111111111111111 OO'H, usage { encrypt, decrypt, sign, verify }, keyReference 1 }. typeAttributes { value indirect: path : { path'0012'H }. modulusLength 1024 } } value PKCS15PrivateKey ::= privateRSAKey : { commonObjectAttributes { label "NR-KEY", flags {private}, authld *02'H }. classAttributes { iD'0022222222222222222222222222222222222200'H, usage {nonRepudiation}, keyReference 2 }. typeAttributes { value indirect: path : { path'0012'H rnodulusLength 1024 } } After encoding this file, we obtain: Record length (hexa): 41 303F3010 0C074155 542D4B45 59030207 80040101 301D0414 00111111 11111111 11111111 11111111 11111100 030201 E2 020101A1 OC300A30 04040200 12020204 00 Record length (hexa): 41 303F300F 0C064E52 2D4B4559 03020780 04010230 1 E041400 22222222 22222222 22222222 22222222 22220003 03060040 020102A1 0C300A30 04040200 12020204 00 EF(PrKDF) fiie length: 82 ll) Writing file EF(UnusedSpace) according to standard PKCS#15 and ASN1 value PKCS15UnusedSpace ::= { path { path '6200'H, index 0, length 1500 authld'OVH After encoding this fiie, we obtain: Record length (hexa): 12 3010300B 04026200 02010080 0205DC04 0101 EF(UnusedSpace) file length; 12 HI) Writing file EF(DQDF) according to standard PKCS#15 and ASN1 value PKCS15Data ::= opaqueDO : { commonObjectAttributes { flags { private, modifiable }, authld'OVH }, classAttributes { appIicationOID { 2 23 43 1 2 1 } }. typeAtthbutes indirect: path : { path'5108'H. index 0, length 176 } } value PKCS15Data ::= opaqueDO : { commonObjectAttributes { flags { private, modifiable }, authld'OI'H ciassAttributes { appliGationOID{2 23 43 122} typeAttributes indirect: path : { path'5109'H, index 0, length 176 } After encoding this file, we obtain: Record length (hexa): 23 30213007 030206CO 04010130 07060567 2B010201 A10D300B 04025103 02010080 0200B0 Record length (hexa): 23 30213007 030206C0 04010130 07060567 2B010202 A10D300B 04025109 02010080 0200B0 EF(DODF) file length: 46 IV) Writing file EF(CDn according to standard PKCS#15 and ASN1 value PKCS15Certificate ;:= x509Certificate : { commonObjectAttributes { label "User Auth Certificate File", flags {modifiable} }, ciassAttributes { iD '00111111111111111111111111111111111111 OO'H, authority FALSE, requestld { idType 5, idValue PKCS15identifier: '492C1 FF42D87C375789444E8EC309C67C97B8D25'H } typeAttributes { value indirect: path : { path'6001'H. index 0, length 704 } } } value PKCS15Certificate ::= x509Certificate : { commonObjectAttributes 1 label "User NR Certificate File", flags { modifiable} }. class Attributes { iD '0022222222222222222222222222222222222200'H. authority FALSE, requestld { idType 5, idValue PKCS15ldentifler: '492C1 FF42D87C376789444E8EC309C57C97B8D25'H } }, typeAttributes { value indirect: path : ( path'6002'H. index 0, length 704 } } } value PKCS15Certificate ::= x509Certificate ; { commonObjectAttributes { label "User Auth Certificate URL", flags { modifiable} }. classAttributes { ID '00111111111111111111111111111111111111OO'H, authority FALSE, requestld { IdType 5, idValue PKCS151dentifier: '492C1 FF42D87C376789444E8EC309C67C97B8D25'H } }-typeAttributes { value indirect: uri: "http://baseAddress/certs?ih=:OI+06/g ..." } } value PKCS15Certifioate ::= x509Certificate : { commonObjectAttributes { label "User NR Certificate URL", flags {modifiable} ci ass Attributes { lD'00222222222222222222222222222222222222C0 H, authority FALSE, requestld { idType 5, idVaiue PKCS15Identifier: '492C1FF42D87C376789444E3EC3G9C57C97B3D25'M } }, typeAttributes I. value indirect: url: "http://baseAddress/cert3?ih=Oi-f05/g ..." i After encoding this file, we obtain; Record length (hexa): 68 30663020 0C1A5573 65722041 75746820 43657274 69666963 61746520 45696C65 03020640 30310414 00111111 11111111 11111111 11111111 11111100 30190201 05041449 2C1FF42D 87C37678 9444E8EC 309C67C9 7B8D25A1 OF300D30 0B04C260. 01020100 800202C0 Record length (hexa): 66 3064301E 0C185573 6572204E 52204365 72746966 69636174 65204669 6C650302 06403031 04140022 22222222 22222222 22222222 22222222 22003019 02010504 14492C1F F42D87C3 76789444 E8EC309C 67C97B8D 25A10F30 0D300B04 02600202 01008002 02C0 Record length (hexa): AO 30819030 1F0C1955 73657220 41757468 20436572 74696669 63617465 2055524C 03020640 30310414 00111111 11111111 11111111 11111111 11111100 30190201 05041449 2C1FF42D 87C37678 9444E8EC 309C67C9 7B8D25A1 47304516 43687474 703A2F2F 62617365 41646472 6573732F 63657274 733F6968 3D4F692B 30362F67 3975574E 66777977 42344343 6D343147 79523845 3D736E3D 4F6F7230 36673D3D Record length (hexa): 9E 30819B30 1D0C1755 73657220 4E522043 65727469 66696361 74652055 524C0302 06403031 04140022 22222222 22222222 22222222 22222222 22003019 02010504 14492C1F F42D87C3 76789444 E8EC3C9C 37C97B8D 25A14730 45164368 7474703A 2F2F6261 73654164 64726573 732F6365 7274733F 69683D4F 692B3036 2F673975 574E6677 79774234 43436D34 31477952 38453D73 6E3D4F6F 72303741 3D3D EF(CDF) file length: 20C V) Writing file EF(ODF) according to standard PKCS#15 and ASN1 value PKCS150bjects ::= privateKeys : path : { path'5101'H } value PKCS150bjects ;:= certificates : path : { path'5103'H ) value PKCSISObjects ::= trustedCertificates : path : { path'5104'H } value PKCS150bjects = usefulCertificates : path : { path'5105H } value PKCSISObjects ::= dataObjects ; path : { path'5106'H } value PKCS150bjects ::= authObjects : path : { path'5107'H } Record length (hexa): 8 A0063004 04025101 Record length (hexa): 8 A4063004 04025103 Record length (hexa): 8 A5063004 04025104- Record length (hexa): 8 A6063004 04025105 Record length (hexa): 8 A7063004 04025106 Record length (hexa): 8 A8063004 04025107 EF(ODF) tile length: 30 Vl) Writing file EF(CDR according to standard PKCS#15 and ASN1 value PKCS15Certificate ::= wtlsCertificate : { commonObjectAttributes { label "Entrust.net Test WAP CA", flags { } }. classAttributes { iD'D4C6D9234AEF75233FB5B5BF4427FCFBC55C40E3'H, authority TRUE, requestid { idType 5, idValue PKCS15ldentifier: 'D4C6D9234AEF75233FB5B5BF4427FCFBC55C40E3^H } }. typeAttributes { value indirect: path ; { path'610rH. index 0, length 431 } } } After encoding this file, we obtain: Record length (hexa): 67 A365301C 0C17456E 74727573 742E6E65 74205465 73742057 41502043 410301 CO 30340414 D4C6D923 4AEF7523 3FB5B5BF 4427FCFB C55C40E3 0101FF30 19020105 0414D4C6 D9234AEF 75233FB5 B5BF4427 FCFBC55C 40E3A10F 300D300B 04026101 02010080 0201AF EF(CDF) file length: 67 VH) Writing file EF(AQDF) according to standard PKCS#15 and ASN1 value PKCS15Authenticatlon ::= pin : { commonObjectAttributes { label "PIN-G", flags { private, modifiable } }, ciassAttributes { authld'01'H }, typeAttributes { pinFIags { case-sensitive, local, initialized, needs-padding, disabie-allowed }, pinType ascii-numeric, minLength 4, storedLength 8, pinReference 1, padChar 'FF'H, path { path 'OOOO'H } } ; value PKCS15Authentication ::= pin : { commonObjectAttributes { label "PIN-NR", flags { private, modifiable } }. ciassAttributes { authld '02'H }. typeAttributes { pinFIags { case-sensitive, local, initialized, needs-padding }, pinType ascii-numeric, minLength 4, StoredLength 8, pinReference 2, padChar'FF'H, path { path'0100'H } } } After encoding this file, we obtain: Record length (hexa): 32 3030300B 0C055049 4E2D4703 0206C030 03040101 A11C301A 030307CC 800A0101 02010402 01088001 010401FF 30040402 0000 Record length (hexa): 32 3030300C 0C065049 4E2D4E52 03020SC0 30030401 02A11B30 19030202 CC0A01G1 02010402 01088001 020401 FF 30040402 0100 EF(AODF) file length: 64 Claims 1- Data processing device, in particular a smartcard, storing encoded data in memory represented by a tree structure in directories and files according to an object representation, characterised in that it comprises - a specific referencing object abie to reference all or some of the attributes of the encoded data in memory, - and in that the update of the encoded data is managed by a microcontroller programmed to - extract from the referencing object the information required to locate the memory block occupied by this attribute, - and update this block, replacing it by the new data, previously encoded. 2. Device according to claim 1, characterised in that the access to said referencing object is write protected in the data processing device 3. Device according to claim 1 or 2, characterised in that said referencing object comprises permanent data. 4. Device according to claim 1, characterised in that the referencing object comprises attributes identifying - the file (EF(PrKDF)), - the attribute (ClassAttributes.iD) to be updated in this file, - and the location (counter, Length) of this attribute in the file in question, 5- Method to update encoded data stored in a memory of a data processing device such as a smartcard, said data being represented by a tree structure in directories and files according to an object representation, characterised in that it comprises: - a preliminary step to create a specific referencing object able to reference ail or some of the attributes of the encoded data in memory, and in that updating comprises the following steps: - a step to extract from the referencing object the information required to locate the memory block occupied by this attribute, - a step to update this block, replacing it by the new data, previously encoded. 6. Update method according to claim 5, characterised in that, after creating the referencing object and before updating the encoded data, a step consists of write protecting said referencing object in the data processing device. 7. Method according to claim 5, characterised in that the preliminary step to create a specific referencing object is carried out during the personalisation phase of the data processing device. 8. Computer program to update encoded data stored in a memory of a data processing device such as a smartcard, said program comprising program code instructions to execute update steps as defined in claim 5. 9. Computer program according to claim 8, characterised in that the execution of the update steps is carried out on the smartcard. 10. Computer program according to claim 8, characterised in that the execution of the update steps is carried out by an external tool connected to the smartcard. 1 11. A data processing device, substantially as herein described with reference to the accompanying drawings.

Documents:

1673-chenp-2004-abstract.pdf

1673-chenp-2004-claims filed.pdf

1673-chenp-2004-claims granted.pdf

1673-chenp-2004-correspondnece-others.pdf

1673-chenp-2004-correspondnece-po.pdf

1673-chenp-2004-description(complete)filed.pdf

1673-chenp-2004-description(complete)granted.pdf

1673-chenp-2004-drawings.pdf

1673-chenp-2004-form 1.pdf

1673-chenp-2004-form 26.pdf

1673-chenp-2004-form 3.pdf

1673-chenp-2004-form 5.pdf

1673-chenp-2004-other documents.pdf

1673-chenp-2004-pct.pdf

abs-1673-chenp-2004.jpg