The invention also concerns a module capable of being connected to such an apparatus, and a code circuit as well as a storage medium for storage of data and for use in such a system.

Many technical systems comprise an apparatus to which a plurality of modules may be connected. Typically, it may e.g. be an electronic device comprising a central control unit to which a plurality of external printed circuit cards may be connected depending on the use. The elec- tronic device may e.g. be a network element in a telecom- munications network or a control system for a manufactur- ing process.

Other examples of such modules may be battery packet for a mobile telephone, a component or a spare part which may be connected to the electrical system in a car or to the car in general, or a probe for a measuring instrument.

Such systems have the advantage that the technical solu- tion may be composed of individually selected modules.

For several reasons, when a module is connected to the system, it may be expedient to be able to detect whether the other module is of a specific type. It may e.g. be a matter of checking that the connected module is supplied by the supplier who has also supplied the main system, since this is the only way to ensure that the system op- erates as specified by the supplier. This may e.g. be the case where probes for measuring instruments are cali- brated for each individual measuring instrument, and where it may thus be essential to ensure that the correct probe is connected.

In respect of high-technology products, extension modules and spare parts for the products are produced in large numbers. However, it happens frequently that other sup- pliers make copies having the same function as the origi- nal products, but at a lower price. It may be expedient for a manufacturer of the original products to protect himself against copy products, partly because reliability and quality might be impaired when the original modules are replaced by copy modules, and partly because of the loss of earnings from the sale of the original products.

It is known to prevent interconnection of such elements by various physical obstacles, which, however, are gener- ally easy to imitate by a copy manufacturer.

Further, the art in the software field includes a large number of methods for access control and limitation of copying of e.g. discs or CD-ROM with programs such as e.g. games. These methods, however, are not suitable for preventing connection of hardware modules to e.g. an electronic apparatus.

Known are also electronic systems in which a code circuit on a module must apply a code word before the module will be accepted by the main system, as is known also from e.g. payment cards in financial systems.

When mechanical and electronic systems can be physically accessed, however, it will frequently be possible to ex- pose details of the structure and thereby evade the methods which just permit combination with certain mod- ules. In the case of the code word which has to be ap- plied by the module, it will e.g. be possible to find the code word by outputting it in the same manner as is done in the original system. Thus, all that needs to be done is to obtain a sample of the original module, and then the code word of this module may be read and copy modules may be manufactured with the same code word.

From US 4 851 653 a system in which a confidential code is introduced to a memory card to get access to the memory of the card is known. On the card the introduced code is compared to a reference code and only in case of a match between the introduced code and the reference code access is provided to the memory. A built-in time delay ensures that a certain time must pass between each attempt at introducing a code. In this manner it is ensured that an unauthorized user cannot just try with a high number of different codes in a short time. By systems of the above described type, in which modules are connected to an apparatus, this system does not, however, provide any security, because an unauthorized card can just read the code word used by an authorized card and subsequently use the same code word, since only one reference code is used. Therefore, the system can be cracked by a simple interception.

A similar system is used according to EP 379 333 in which a finger print of a person is compared with a reference finger print stored in digital form on a credit card.

Also here, a single reference code that can be uncovered by interception is used, and therefore also this system does not provide sufficient security in the systems mentioned above.

WO 86/03864 discloses a system for establishing connection between a computer terminal and a main computer. In stead of a usual code word or pass word this system uses a new random code word each time a connection between a given terminal and the main computer is to be established. Before termination of a connection the terminal generates a new code word, which is sent to the main computer in which it is stored. It is also stored in the terminal itself. Next time this terminal wishes a connection to the main computer it must be able to provide exactly this code word to the main computer. In this way it is ensured that an unauthorized terminal cannot just intercept the code word from an authorized terminal and subsequently use the same code word itself.

However, this system only ensures that the main computer - when the system has been initialized and is in normal use - only accepts communication with a terminal to which it has communicated before. When a terminal is connected to the computer for the the first time the security procedure must be by-passed and, therefore, the security is totally dependent of the person taking care of the connection of new terminals to the system. Therefore, this principle cannot be used in the situations mentioned above and with which the present invention is concerned.

Another principle that attempts to overcome the risk of interception of a code word is known from DE 44 11 780.

Here, the code word is changed dependent on the actual

time. A user introduces on a terminal or a module a primary code word which is then converted into a corresponding secondary code word. This code word is combined with a time signal representing the actual time, which is received from a radio transmitter, and the result is used as address to a ROM device of e.g. 32 kbytes. The content of the selected address is transmitted to the receiver unit which has a similar ROM device and knows the correct secondary code word. Also here the known secondary code word is combined with the actual time signal to form an address to the ROM device and the resulting content must correspond to that received from the terminal. As the actual time signal is changed all the time a code word that is intercepted can only be used for a very short time, i.e. until the time signal is changed. This could e.g. happen every 6 minutes. However, this principle has the drawback that if an unauthorized user once knows the principle he only has to get access to an authorized unit and then copy the ROM device, which can be done in a very short time. With a copy of the original ROM device the unauthorized module can without any difficulty generate correct code words.

It is also a drawback with this principle that the central apparatus as well as each unit or module must be provided with a radio receiver for the time signals and also must be placed in a location where these signals can be received.

Accordingly, the object of the invention is to provide a method and a system which ensure that only modules of the specific type can be connected to the system, and in which the incorporated code circuits are impossible to copy with a reasonable period of time.

This is achieved according to the invention by a method wherein a large number of different code words is stored

in the code circuit on modules of the specific type, and wherein the code circuit is moreover so adapted that a code word can be output correctly only after the lapse of a prefixed period of time, which is considerably longer than the normal output time determined by the implementa- tion of the code circuit, after a previous output of a code word.

When ensuring on one hand that a large number of code words is present and on other hand that a considerable period of time has to elapse between each time a code word can be output, then it will take an extremely long time to output and thus copy the contents of the code circuit. Thus copying of the code circuit has been made impossible in practice.

The same is achieved by the system of claim 2.

In an expedient embodiment which is defined in claim 3, the code circuit on each module comprises an addressable storage in which one of said code words is stored on each storage address.

When, as stated in claim 4, the code word of a given storage address in said storage is allowed to be the same for all the modules, it is ensured that the same code circuit may be used on all the modules, and that it therefore suffices to store one set of reference code words in the apparatus. A particularly expedient embodi- ment is obtained when the reference code words of the ap- paratus, as stated in claim 5, are formed by a code cir- cuit like the code circuits arranged on the modules. It is hereby ensured in a simple manner that it will be just as difficult to copy the code words from the apparatus as from the individual modules.

When moreover, as stated in claim 6, the apparatus is adapted to read code words from the same storage address or addresses on each module at start, it is ensured that the apparatus need only read code words from its own code circuit or its own reference table once, since the same answer is to come from all the modules. This will save some time particularly in the situation where the appara- tus contains a code circuit like that of the modules, since, otherwise, the apparatus would have to wait said period of time between each output from its own code cir- cuit.

As mentioned, the invention moreover concerns a module which may be used in a system and a method as described above. Such a module is defined in claim 7.

Either, as stated in claim 8, the code circuit of the module may comprise means for calculating code words from a bit pattern consisting of a plurality of digital input signals, or, as stated in claim 9, it may comprise an ad- dressable storage in which one of said code words is stored on each storage address. In the latter case, the addressable storage may expediently be of ROM type, as stated in claim 10.

When, as stated in claim 11, the code circuit is adapted to receive an address consisting of a large number of bits and to calculate, from this, a modified address con- sisting of a smaller number of bits, and the number of storage addresses is adapted such that the smaller number of bits is just sufficient to address all the storage ad- dresses, it is ensured that the copying time will be ex- tremely great even with a storage of a limited size, since, seen from the outside, the storage appears to have a number of bit positions which corresponds to the large number of bits. Thus, if e.g. a 32-bit address is used, which is modified to a 16-bit address in the code cir-

cuit, a storage circuit of 64 kbytes will look like a storage circuit of 232 bytes, and, if the preselected pe- riod of time is e.g. one second, it will take 232 sec- onds, which correspond to more than 136 years, to output and thereby to copy the contents of the code circuit.

In particular when the code circuit is adapted to receive an address consisting of a large number of bits, it may be advantageous, as stated in claim 12, to adapt the code circuit to receive said address in serial form.

The means necessary for determining the prefixed period of time may be positioned internally in the code circuit, as stated in claim 13. This ensures that there is no pos- sibility of affecting this period of time from the out- side, nor is it thus possible to increase the output rate. On the other hand, the components required for this will take up space on the code circuit itself. Alterna- tively, as stated in claim 14, the code circuit may com- prise means for determining the prefixed period of time by counting a plurality of clock periods for a clock sig- nal which is supplied to the code circuit. Component space may hereby be saved in the code circuit; but it will be possible to increase the output rate by increas- ing the frequency of the external clock signal. However, this may be counteracted in a simple manner by selecting a clock frequency which is close to the maximum clock frequency at which the circuit can operate. If it is at- tempted to output the code words with an even higher fre- quency, the circuit will merely stop operating. A lower frequency will correspondingly mean a lower output rate.

In an expedient embodiment, which is defined in claim 15, the code circuit is implemented as a customer-specified integrated circuit (ASIC) , which comprises the address- able storage as well as the means for determining the

prefixed period of time. This improves the possibility of preventing others from outputting and thereby copying the contents of the code circuit within a reasonable period of time.

Either, as stated in claim 16, the means ensuring that a code word can be output correctly only if a prefixed pe- riod of time after a previous output has elapsed, may be adapted simply not to apply a code word if output is re- quested before the lapse of said period of time, or, as stated in claim 17, where such output is requested, they may be adapted to output one or more wrong code words.

The latter possibility makes it even more difficult to perform unauthorized output of the contents of the code circuit.

Further, as stated in claim 18, the code circuit may be adapted such that a code word can be output correctly also only if said period of time has elapsed from the start of the module concerned. This ensures that also the first output can only take place after said time delay.

Finally, as mentioned, the invention also concerns a code circuit for the storage of a plurality of code words, as described above and defined in claim 19, and a storage medium for the storage of data and for use in a system as well as a method as described above. Such a storage me- dium is defined in claim 20, and it is adapted such that data can be output correctly from the storage medium only after the lapse of a prefixed period of time, which is considerably longer than a normal output time determined by the implementation of the storage medium, after a pre- vious output of data.

The invention will now be described more fully below with reference to the drawing, in which

fig. 1 shows a system in which the invention may be ap- plied, fig. 2 shows a block diagram of a code circuit according to the invention, fig. 3 shows an embodiment of the code circuit in which an external clock signal is used, fig. 4 shows an embodiment of the code circuit in which an internal clock generator is used, and fig. 5 shows an embodiment of the code circuit in which a modified address is calculated.

Fig. 1 shows an example of how the invention may be ap- plied to ensure that modules to be connected to an appa- ratus or a system are of a specific type. The figure schematically shows a system 1 which consists of an appa- ratus 2 and a plurality of modules, of which the modules 3 and 4 are shown here. The system 1 may e.g. be an elec- tronic control system for a manufacturing process or a network element in a telecommunications system, and in that case the apparatus 2 may contain a central control unit 5 and other common components for the system, while the modules 3 and 4 may be printed circuit cards includ- ing the system input and output circuits, which may be provided in arbitrary numbers, and the system may typi- cally be extended later by the addition of further printed circuit cards. Since these printed circuit cards will frequently be added to the system after its ini- tialization, it may be of great importance to be able to ensure that only printed circuit cards of a specific and approved type can be connected. This is done partly to be certain that the system, also after the addition, will be

able to comply with the specifications originally given, and partly to ensure for commercial reasons that no so- called pirate copies of the printed circuit cards are used.

Such a security may be established e.g. by providing each of the printed circuit cards 3, 4 with a code circuit 6, 7, which is capable, on request, of giving a predeter- mined code word. When e.g. the printed circuit card 3 has been connected to the system, the central control unit 5 may request the printed circuit card 3 via the connection 8 to identify itself by means of the code circuit 6 by giving the correct code word via the connection 9. As mentioned before, this system, however, has the drawback that it will be relatively simple for a copy supplier to copy the code circuit 6 so that also the copy printed circuit cards will be capable of giving the correct code word.

This is remedied by the invention in that, for one thing, the code circuit 6 contains a large number of code words, and the control unit 5 can then request the code circuit to give an arbitrary one of the many code words via the connection 9. This may be done e.g. in that the code cir- cuit 6, as shown in fig. 2, contains a ROM 10 having a plurality of addresses, which each contain a code word.

The control unit 5 then transmits a request for a code word and the address of the desired code word on the con- nection 8. The addresses and the code words may be transmitted via the connections 8, 9 as serial or paral- lel data depending on the structure of the system in gen- eral. In addition to the connections 8, 9, a plurality of connections will usually be provided between the appara- tus 2 and the printed circuit cards 3, 4 owing to the proper function of the system. These connections do not

concern the invention and are therefore not shown in the figure.

Although the many code words per se make it more diffi- cult to copy the code circuit 6 or its ROM 10, it is how- ever, still not impossible to do so, as it usually just takes a little longer to read one storage address at a time and then to copy it. Therefore, the circuit is de- signed such that it is not possible to read the contents of the individual storage cells quickly in succession, since, as shown in fig. 2, it moreover contains a time delay circuit 11, which ensures that a certain time has to elapse between each output of the contents of a stor- age cell. This period of time may e.g. be of the order of one second. If e.g. a ROM of 64 kbytes is used, it will thus take 65 536 seconds, corresponding to a little more than 18 hours, to output all the code words. As will ap- pear in more detail from the following, this time may be increased considerably by simple means. The circuit 11 may either just delay each output by said time, or it may release the contents of the storage cell right away and then prevent new output requests until said period of time has elapsed. In the former case, this means that there will also be a delay at the first output after the start of the system or the connection of the printed cir- cuit card. This means in both cases that correct code words can be output only when the individual storage cells are output at a suitably low rate such that it will be an impossible task to read the contents of the entire storage medium, thereby making it an impossible task to copy the code circuit 6. In the periods where a correct code word cannot be given owing to the time delay, the code circuit may be designed not to give a code word at all. This may e.g. be done in that the code word output or outputs are in a tristate mode or simply emit a byte exclusively containing ls or Os. Alternatively, the cir-

cuit may be designed to give an arbitrary, but wrong code word during this period, thereby making it even more dif- ficult to copy the contents, as it will not be known whether the code words output are actually correct.

Examples of embodiments of the time delay circuit 11 will be described more fully below.

When a new module or printed circuit card, e.g. the printed circuit card 3, is to be connected to the system, the first step is to place the printed circuit card in e.g. a connector, thereby connecting it to the power sup- ply of the system, and the control unit 5 will detect that a new printed circuit card has been connected to the system. The time delay circuit 11 on the printed circuit card 3 ensures that no correct code words can be output the first second after the connection of the printed cir- cuit card. The control unit 5 will therefore wait one second and then generate a random address and request, via the connection 8, the code circuit 6 to give the as- sociated code word. The circuit 6 finds the correct code word and returns it via the connection 9 to the control unit 5. The control unit 5 compares the received code word with a list of reference code words, and if the code word received is correct, the printed circuit card 3 will be accepted and added to the system. If, on the other hand, the code word received is wrong, the printed cir- cuit card will be rejected.

It is important of course that the list of reference codes words is concealed well, since, otherwise, it will be possible to copy the correct code words from it. Op- tionally, the list may be encrypted. If identical code circuits are used on all the modules, i.e. all of them contain the same code words on the same addresses, it will be an expedient solution simply to provide the con- trol unit 5 with a code circuit 12 like the one used on

the modules, since, then, the control unit is merely to address the same (random) address in its own code circuit 12 and in the code circuit 6 on the module just connected and then compare the two code words. This also means that, at the start of the entire system, the control unit 5 is just to address the same (random) address in its own code circuit and in the code circuits on each of the con- nected modules, since the control unit is to expect the same answer from each module. As a result, the control unit does not have wait one second between each inquiry to a module, which would delay the start of the system by a second per module. This would have been necessary if different code words were requested from each module, since, then, the control unit would have to address a new address in its own code circuit each time. To make it im- possible that a copy module in this situation just reads on the data bus which code word is given from another module and then merely gives the same word itself, the control unit may be caused to inquire for a new and ran- dom code word from all the modules at regular intervals in operation. A copy module, which has managed to get through the start phase merely by giving the same answer as the other modules, will then be revealed by the next random inquiry.

It is important that the storage 10 of the code circuit and the time delay circuit 11 are so arranged with re- spect to each other as to make it impossible to get ac- cess to the connections between the two circuits, since, otherwise, it would be possible to evade the time delay merely by bypassing the time delay circuit 11 when out- putting and copying the contents of the storage 10.

Therefore, the code circuit 6 may advantageously be de- signed as a user-specified integrated circuit, also called ASIC. An example of an ASIC circuit 13 is shown in fig. 3.

The circuit is composed of the two previously mentioned elements, the ROM 10 and the time delay circuit 11. The ROM 10 is implemented such that the connections related to control reading from the ROM are present only inter- nally in the ASIC. This prevents unauthorized reading of the storage contents. The read input 16 of the ROM is connected directly to the timer circuit 11. The address bus 14 and the code word bus 15 are external connections.

The connections 14 and 15 may be parallel as well as se- rial, the serial embodiment being most frequently used in a practical design to occupy the fewest possible branch connections on the ASIC. The address 14 is used for ad- dressing the ROM 10, in which the previously mentioned code words are already stored. When a code delay time de- termined by the timer has elapsed, the addressed code word is output on the code word bus 14 by activating the read input of the ROM.

The time delay circuit 11 is here shown implemented by means of a counter circuit 17, which divides a clock sig- nal on the line 18. If a clock signal of e.g. 8 MHz is used, a count pulse per second may be obtained by divid- ing by 8 * 106. The signal of 8 MHz may be a signal which is already used in the system and is therefore available on the printed circuit card concerned. The frequency may advantageously be selected close to the maximum operating frequency of ASIC, since it will then be impossible to reduce the output time considerably merely by increasing the frequency of the clock signal 18.

The delay time begins to elapse when an address is ap- plied to the address bus 14, or when the time delay cir- cuit 11 is activated by a separate control signal 19.

When the code delay time has elapsed, the read signal 16 of the ROM is activated, and the desired code word may be

output on the code word bus 15. The ROM on the integrated ASIC can thus just be read at the intervals predetermined by the time delay circuit, which, as mentioned, are se- lected to have a duration of one second in the present example.

The field 20 on the ASIC just indicates that space for other components may be provided on the circuit.

Fig. 4 shows an ASIC circuit 21 having a somewhat differ- ently designed time delay circuit 22. Instead of dividing an external clock signal 18, the circuit 22 here incorpo- rates an internal clock generator 23 which can generate a corresponding clock signal itself, so that the time delay is completely independent of external signals. Such an internal clock generator may be implemented in a known manner e.g. by interconnecting two gates in a feedback loop. The rest of the circuit is unchanged with respect to fig. 3.

It should be noted that, instead of the ROM 10, it is possible to use other corresponding types of circuits, such as e.g. a storage of EEPROM type or a RAM. In the latter case, measures must be taken to avoid uninten- tional erasure of the stored code words. The use of these storage types ensures that the code words need not be de- termined when the ASIC is designed, but may be input at a later time, e.g. in the manufacture of the module or printed circuit card concerned. Alternatively, instead of a storage, it is possible to use a combinatorial circuit which is capable of calculating an associated code word on the basis of a bit pattern (i.e. the address) on the input. Such a circuit may be implemented in a known man- ner, provided that an algorithm to calculate the code words has been determined beforehand.

No matter whether a storage or a combinatorial circuit is used, the time it takes to output and copy the code cir- cuit contents may be increased considerably by using an address having a larger number of bits than the one cor- responding to the number of code words, and then modify- ing this address. This may be done e.g. as shown on the ASIC in fig. 5, in which the ROM 10 may be of 64 kbytes here too, which means that it may be addressed by an ad- dress of 16 bits. An address modification circuit 25 re- ceives an address of 32 bits via the address bus 23 and converts it into two addresses of 16 bits each. Each of these two addresses is used for addressing the associated code words in the storage 10 via the bus 24, and these are output via the bus 26 to a calculation circuit 28 calculating, from the two code words, a new code word which is returned to the control unit via the code word bus 27.

Alternatively, the address modification circuit 25 may be adapted to convert the address of 32 bits into a single new address of 16 bits, which then designates a code word in the ROM 10, as described earlier. In that case, the calculation circuit 28 may be omitted, since just a single code word is given from the ROM.

When an address of 32 bits is modified in this manner to one or more addresses of 16 bits, the time it takes to output the entire storage contents may be increased very considerably. Still assuming a time delay of 1 second be- tween each output, it will take 232 seconds to output all combinations, even though the storage is just 64 kbytes in reality. The 232 seconds correspond to more than 136 years, which is more than sufficient in practice to pre- vent copying of the code circuit.

Finally, it should be mentioned that the connections 8, 9 between the apparatus 2 and the individual modules 3, 4 may be replaced by a wireless connection, as the appara- tus and the modules may e.g. be provided with radio transmitters/receivers or infrared transmit- ters/receivers. This ensures that the principle may also be applied in systems in which the individual subcompo- nents are not already electrically interconnected. This may be the case e.g. with spare parts for cars or access cards to access control systems.

Although a preferred embodiment of the present invention has been described and illustrated, the invention is not restricted to it, but may also be embodied in many other ways within the scope of the subject-matter defined in the following claims.