Introduction to DS1991 and analysis of its reading and writing methods with password-protected memory area

    Dallas' iButton products are a series of new 1-wire bus devices. DS1991 is an encrypted storage information button, encapsulated in a stainless steel shell with a diameter of 16mm. It is small in size, easy to carry and store, dustproof and corrosion-resistant, and can realize password-protected data transmission in harsh application environments. This article introduces the characteristics and working principle of DS1991 and the reading and writing methods of its password-protected storage area.

    abstract:

    DS1991 is a member of Dallas' 1-wire bus information button family, and is an encrypted memory type information button. It integrates 1Kbit non-volatile memory and encryption protection logic, and is packaged in a stainless steel shell with a diameter of 16mm and a thickness of about 6mm. It is compact, easy to operate, moisture-proof, shock-proof, and dust-proof, and can achieve data transmission with password protection in harsh environments.

    1 Features of DS1991

    DS1991 is a unique encrypted memory TM card, which provides a reliable protection measure for users' confidential data. DS1991 has a 1152-bit password-protected memory area and a 512-bit non-password-protected memory scratchpad. The password-protected memory is divided into three independently operable key sub-memories (subkey), each of which is 384 bits. Each password sub-area has its own 64-bit password and 64-bit ID code. The read/write operation of the key sub-area requires password verification. The data in the three areas can be operated separately without interfering with each other. The non-password-protected memory area is mainly used for copying encrypted data to ensure the integrity of the data.

    2 DS1991 and MCU hardware interface and software design

The hardware interface circuit     between DS1991 and MCU is shown in Figure 1.

    The interface between DS1991 and microcontroller is very convenient, using only one data line and one address. The data line is controlled by one I/O line of the microcontroller, and the line is connected to a 5kΩ pull-up resistor . DIOBITP1.0; pin definition RETDJNZR6, WRB1

    The basis of DS1991 operation is the initialization of 1-wire bus and the timing of reading/writing 1 bit, as shown in Figures 2, 3, 4 and 5. VPULLUP is the potential of point D in Figure 1 when the port line is in input state. Initialization is initiated by the host sending a reset pulse. DS1991 responds with a response pulse to let the host know that DS1991 exists on the bus and is ready for operation. Each byte of command and data is transmitted one by one from the least significant bit. Subroutines RESET, RDBYTE and WRBYTE are subroutines for initialization and reading/writing 1 byte respectively.

    RESET:CLR DIO; get the subroutine

    MOV R7,#205

    DELPP1:NOP

    DJNZ R7,DELPP1

    SETB DIO

    MOV R7,#12

    DJNZ R7,$

    MOV R7,#27

    RESETP1:JNB DIO,RESETP2

    DJNZ R7,RESETP1

    RESRET:SETB DIO

    MOV A,#0EH

    RESETP2:MOV R7,#75

    DJNZ R7,$

    MOV R7,#54

    RESETP4:JB DIO,RESETP5

    DJNZ R7,RESETP4

    RESETP5:MOV R7,#180

    DJNZ R7,$

    SETB DIO

    MOV A,#0

    RET

    WRBYTE:MOV R6,#8 ; write 1 byte subroutine

    WRB1:CLR DIO

    MOV R7,#2

    DJNZ R7,$

    RRC A

    MOV DIO,C

    MOV R7,#30H

    DJNZ R7,$

    SETB DIO

    NOP

    NAP

    NOP

    RET

    RDBYTE:MOV R6,#8 ;Read 1 byte subroutine

    RDB1:CLR DUO

    NOP

    NOP

    SETB DIO

    MOV R7,#3

    DJNZ R7,$

    MOV C,DIO

    RRC A

    MOV R7,#32

    DJNZ R7,$

    SETB DIO

    MOV R7,#3

    DJNZ R7,$

    DJNZ R6,RDB1

    RET

    3 DS1991 Laser ROM Code, Memory Structure and Operation

    Like all 1-wire bus devices, the host must first perform initialization and ROM operations before it can read and write DS1991 memory operations.

    DS1991 has a unique 64-bit laser ROM serial code engraved in the factory. This code will not be repeated with any other 1-wire bus device. The first 8 bits of the code are the 1-wire bus family code, the next 48 bits are the device's unique serial code, and the last 8 bits are the CRC checksum of the first 56 bits of data. The ROM operation instructions establish the connection between the accessed 1-wire device and the host. The ROM operation instructions are shown in Table 1. The memory image of DS1991 is shown in Figure 1.

    Table 1 ROM operation instructions

MOV A,#0

RET

WRBYTE:MOV R6,#8; write 1 byte subroutine

WRB1: CLR DIO

MOV R7, #2

DJNZ R7, $

RRC A

MOV DIO,C

MOV R7,#30H

DJNZ R7,$

SETB DIO

NOP

NAP

NOP

 

RET

RDBYTE:MOV R6,#8 ; read 1 byte subroutine

RDB1:CLR DUO

NOP

NOP

SETB DIO

MOV R7,#3

DJNZ R7,$

MOV C,DIO

RRC A

MOV R7,#32

DJNZ R7,$

SETB DIO

MOV R7,#3

DJNZ R7,$

DJNZ R6,RDB1

RET

3 DS1991 Laser ROM Code, Memory Structure and Operation

Like all 1-wire bus devices, the host must first perform initialization and ROM operations before it can read and write DS1991 memory.

DS1991 has a unique 64-bit laser ROM serial code engraved in the factory. This code will not be repeated with any other 1-wire bus device. The first 8 bits of the code are the 1-wire bus family code, the next 48 bits are the device's unique serial code, and the last 8 bits are the CRC check code for the first 56 bits of data. ROM operation instructions establish the connection between the accessed 1-wire device and the host. ROM operation instructions are shown in Table 1. The memory image of DS1991 is shown in Figure 1.

Table 1 ROM operation instructions

The scratchpad and each subkey area of ​​DS1991 have their own addresses. The scratchpad is 64 bytes in total and is not password protected. It is mainly used to copy data to the key sub-area. 00H to 07H in the key sub-area is the 8-byte ID code of the area, 08H to 0FH is the 8-byte password of the area, and 10H to 3FH is the password-protected data storage area.

The / write operation of the Scratchpad does not require a password, but the correct password must be provided for the copy operation. The password sub-area is protected by a 64-bit password, which greatly improves confidentiality. The operation instructions for the memory are shown in Table 2. The flow of the memory operation instructions is shown in Figure 2.

Table 2 DS1991 memory operation command format

4 DS1991 memory read and write procedures

The host reads and writes the memory of DS1991, which consists of three steps: initialization, ROM operation and memory reading and writing.

The following program uses the write SUBBYKEY command to write the data of RAM 40H~47H unit into the subkey 0 area 10H~17H, and uses the read SUBBYKEY command to read the content back and store it in RAM 50H~57H. The password and ID code of this area are stored in the table of the program.

; Write the contents of RAM40H~47H units into

;subkey

WRSUBKEY:LCALL RETSET

MOV R2,#99H

MOV R0,#10H

LCALL WRCOM

LCALL IDPASS

MOV R1,#40H

MOV R4,#8

REWRSUB:MOV A,@R1

LCALL WRBYTE

INC R1

DJNZ R4,REWRSUB

LCALL RESET

RET

; Read subkey and store it in RAM 40H~47H

RDSUBKEY：ＬＣＡＬＬＲＥＳＥＴ

MOV R2，#66H

ＭＯＶＲ0，#10Ｈ

LCAL WRCOM

LCALL ＩＤＰＡＳＳ

ＭＯＶＲ1，#40Ｈ

MOV R4, #8

ＲＥＲＤＳＵＢ：ＬＣＡＬＬＲＤＹＢＴＥ

ＭＯＶ @R1,A

INC R1

DJNZ R4,RERDSUB

LCALL RESET

RET

IDPASS:MOV R4,#8

MOV R1,#50H

RERD1:LCALL RDBYTE

MOV @R1,A

INC R1

DJNZ R4,RERD1

MOV R4,#8

CLR A

MOV DPTR,#PSTAB

REWR1:MOVC A,@A+DPTR

LCALL WRBYTE

INC A

DJNZ R4,REWR1

RET

IDTAB:DB10H,00H,00H,00H,

DB 00H,00H,00H,00H

PSTAB:DB12H,34H,56H,78H,DB12H,34H,56H,78H

WRCOM:MOV A,#33H

LCALL WRBYTE

MOV R4,#8

RDROM1:LCALL RDBYTE

DJNZ R4,RDROM1

MOV A,R2

LCALL WRBYTE

MOV A,R0

LCALL WRBYTE

MOV A,R0

CPL A

LCALL WRBYTE

RET



Conclusion

The password protected memory area of ​​DS1991 provides users with highly reliable data protection measures. The software and hardware design of the interface between DS1991 and single chip microcomputer provided in this paper has been applied in the information button card type public electric meter system.