Smart card and power-down protection method thereof

Abstract

The application discloses an intelligent card and a power-off protection method thereof, and relates to the technical field of intelligent cards. The intelligent card comprises a processor and a memory. A user data area and a protection area are arranged in the memory. The protection area comprises a protection data area and a protection mark area. The protection data area stores whole-page data of a target area to be updated, and the protection mark area stores n valid marks and one invalid mark corresponding to each protection data area. Since the repetitive backup of data in the same page and the redundant backup of backup stacks are avoided, the performance of the intelligent card is greatly improved, and the balance between performance and space is achieved in the intelligent card. The performance of the intelligent card is accelerated, and the storage space is saved.

Description

Technical Field

[0001] This invention relates to the field of smart card technology, and in particular to a smart card and a power-off protection method thereof. Background Technology

[0002] Smart cards, based on IC card technology and utilizing computer and communication technologies, connect various facilities within intelligent buildings into a cohesive whole. Currently, smart cards are widely used in various sectors of society, including banking, transportation, public safety, and telecommunications. The application of smart cards in the financial industry places particular emphasis on security; these cards are generally referred to as financial IC cards.

[0003] The memory portion of financial IC cards has undergone several stages of development: 1. Initially, it was ROM (Read-Only Memory) products, requiring masks in various applications. 2. With the demand for improved performance and reduced power consumption, memory transitioned from ROM to EEPROM (Electrically Erasable Programmable Read-Only Memory). Due to technical limitations, EEPROM occupies a larger chip area than ROM for the same range. Therefore, products at this stage often used both ROM and EEPROM; large, unchanging data such as programs resided in ROM, while user data was stored in EEPROM. 3. Flash (also called Flash memory) products. Flash combines the advantages of ROM and RAM, possessing not only electronic erasable and programmable capabilities but also fast data retrieval, offering the advantages of non-volatile random access memory. Currently, financial IC cards primarily use Flash memory due to its large capacity, low cost, and high speed.

[0004] Although both EEPROM and Flash memory are characterized by low data loss after power failure, data corruption can still occur if power is lost during programming. Given the high data security requirements of financial IC cards, a reasonable and efficient power-loss protection mechanism must be implemented. Summary of the Invention

[0005] This invention provides a smart card, which includes a processor and a memory; the memory is provided with a user data area and an anti-tampering area; the anti-tampering area includes an anti-tampering data protection area and an anti-tampering flag area, the anti-tampering data protection area stores the entire page of data of the target area to be updated, and the anti-tampering flag area stores n valid flags and one invalid flag corresponding to each anti-tampering data protection area.

[0006] In the smart card described above, the valid identifier includes a valid identifier tag, the address of the data protection zone, the address of the target area to be updated, and a check byte; the invalid identifier includes an invalid identifier tag.

[0007] As described above, in a smart card, the memory includes a user data area and an anti-tamper area.

[0008] As described above, in a smart card, the power-loss protection method for the smart card when processing non-transactions includes:

[0009] Receive a request to write non-transactional data to the target area to be updated in the user data area;

[0010] First, copy the entire page of data containing the target area to be updated to the anti-tampering data protection area, and at the same time write the corresponding valid flag in the flag area;

[0011] Update the target area to be updated;

[0012] If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-pickup flag area, and the data corresponding to the valid flag in the anti-pickup data protection area is restored to the target area to be updated.

[0013] After a non-transactional commit, write an invalidation flag after the last valid flag in the anti-tamper flag area, and then end.

[0014] As described above, in a smart card, the power-loss protection method for the smart card when processing non-transactions includes:

[0015] Receives a request to write transaction data to the target area to be updated in the user data area.

[0016] Check if there is a valid flag in the anti-pickup flag area for the page address where the target area to be updated is located. If it exists, no backup is needed; if it does not exist, copy the entire page of data where the target area to be updated is located to the anti-pickup data protection area, and write the corresponding valid flag in the anti-pickup flag area.

[0017] Update the target area to be updated in the user data area;

[0018] If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-pickup flag area, and all data before the valid flag in the anti-pickup data protection area is restored to the target area to be updated using the valid flags in turn.

[0019] After the transaction is committed, write the invalidation flag after the last valid flag in the anti-tamper flag area, and then end.

[0020] As described above, in a smart card, the memory includes a user data area, two anti-tamper areas, and a backup stack;

[0021] The first anti-pickup data protection area of ​​the first anti-pickup zone stores the entire page of data of the target area to be updated. The first anti-pickup flag area stores n valid flags and only one invalid flag corresponding to each anti-pickup data protection area.

[0022] The second anti-pumping data protection area of ​​the second anti-pumping zone stores the entire page of data containing the target area to be updated; the second anti-pumping flag area of ​​the second anti-pumping zone stores m valid flags and m invalid flags corresponding to each anti-pumping data protection area;

[0023] The backup stack stores the data involved in the target area to be updated, and consists of multiple backup records.

[0024] In the smart card described above, the second anti-tamper zone is used in conjunction with the backup stack and can be used cyclically.

[0025] As described above, in a smart card, the power-loss protection method for the smart card when processing non-transactions includes:

[0026] Receive a request to write non-transactional data to the target area to be updated in the user data area;

[0027] Copy the entire page of data containing the target area to be updated to the second anti-plugging data protection area, and write the corresponding valid mark in the second anti-plugging mark area;

[0028] Update the target area to be updated;

[0029] If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the second anti-pickup flag area, and the data corresponding to the valid flag in the second anti-pickup data protection area is restored to the target area to be updated.

[0030] After a non-transactional commit, write an invalidation flag after the last valid flag in the second anti-tamper flag area, and then end.

[0031] As described above, in a smart card, the power-loss protection method for the smart card when processing non-transactions includes:

[0032] A transaction is initiated when a request to write transaction data to the target area to be updated in the user data area is received.

[0033] If the number of target areas to be updated currently being written does not exceed the number of the first anti-tamper zone, then check if there is a valid flag in the first anti-tamper flag zone for the page address where the target area to be updated is located. If it already exists, no backup is needed; if it does not exist, then copy the entire page of data where the target area to be updated is located to the first anti-tamper data protection zone, and write the corresponding valid flag in the first anti-tamper flag zone.

[0034] Update the target area to be updated.

[0035] If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-tamper flag area, and all data before the valid flag in the anti-tamper data protection area is restored to the target area to be updated in turn using the valid flags to ensure transaction integrity.

[0036] After the transaction is committed, a failure flag is written after the last valid flag in the first anti-tamper flag area, the backup stack is invalidated, and the transaction ends.

[0037] As described above, in a smart card, the power-loss protection method for the smart card when processing non-transactions includes:

[0038] A transaction is initiated when a request to write transaction data to the target area to be updated in the user data area is received.

[0039] If the number of currently written target areas to be updated exceeds the number of the first anti-tamper zone, then check if there is a valid flag in the first anti-tamper flag area for the page address where the target area to be updated is located. If it already exists, no backup is needed; if it does not exist, then the data of the target area to be updated is stored in the backup stack as a backup record, and then the entire page of data where the target area to be updated is located is copied to the second anti-tamper data protection area of ​​the second anti-tamper zone. At the same time, the corresponding valid flag is written in the second anti-tamper flag area of ​​the second anti-tamper zone.

[0040] Update the target area to be updated, and write a failure mark in the second anti-pull mark area of ​​the second anti-pull zone;

[0041] If a power outage occurs during the update of the target area to be updated, the data in the second anti-tamper data protection area is restored using the valid flag of the second anti-tamper zone, then the corresponding backup record of the backup stack is restored, and then the data in the first anti-tamper data protection area is restored in sequence according to the first anti-tamper flag area of ​​the first anti-tamper zone.

[0042] After the transaction is committed, a failure flag is written after the last valid flag in the first anti-tamper flag area, the backup stack is invalidated, and the transaction ends.

[0043] The beneficial effects achieved by this invention are as follows:

[0044] (1) By avoiding redundant backups of data on the same page and redundant backups of the backup stack, the performance of smart cards is greatly improved.

[0045] (2) A balance between performance and space is achieved in smart cards. This speeds up the performance of smart cards while saving storage space. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0047] Figure 1 This is a structural diagram of the existing power failure protection mechanism;

[0048] Figure 2 This is a schematic diagram of a smart card provided in Embodiment 1 of the present invention;

[0049] Figure 3 This is a flowchart of a power-loss protection mechanism for handling non-transactional scenarios provided by the present invention;

[0050] Figure 4 This is a flowchart of a power-loss protection mechanism for processing transactions provided by the present invention;

[0051] Figure 5 This is a schematic diagram of another smart card provided in Embodiment 1 of the present invention;

[0052] Figure 6 This is a flowchart of another power-loss protection mechanism for handling non-transactional scenarios provided by the present invention;

[0053] Figure 7 This is a flowchart of another power-loss protection mechanism for processing transactions provided by the present invention. Detailed Implementation

[0054] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0055] Before introducing the technical solution of this application, let's first give an overview of existing power-down mechanisms:

[0056] Due to the characteristics of Flash programming—erasing is done in pages, while writing is typically done in units of 4 bytes, 8 bytes, or 32 bytes, collectively known as the smallest write unit, which varies between different chip manufacturers—the programming process for Flash chip-based financial IC cards involves an erase-then-write procedure. Therefore, a power outage during programming will not only affect the data within N smallest write units but also the entire page of data.

[0057] (I) Currently, due to limitations in Flash user space, power-loss protection mechanisms are mostly based on backup records plus page protection, requiring two areas: a backup stack and an anti-tamper zone (e.g., ...). Figure 1 (As shown).

[0058] The backup stack stores the data to be updated in the form of backup records. These records primarily contain the address, length, data, and checksum of the target area to be updated. It is mainly used to protect the data in each target area during a transaction and for recovery operations in case of power failure. The anti-tamper zone is divided into a data protection zone and a flag zone. The anti-tamper zone copies the entire page of data containing the data to be updated to the anti-tamper data protection zone and writes a corresponding valid flag in the anti-tamper flag zone. Once the update is complete, a corresponding invalid flag is written in the anti-tamper flag zone. The anti-tamper zone is used cyclically to ensure the integrity of the entire page of data in the current operation.

[0059] Drawback: This power-loss protection mechanism suffers from poor performance due to the dual backup of the backup stack and the anti-tamper zone, and the need for repeated protection of the data area when continuously operating on the same page.

[0060] (ii) Currently, most financial IC cards use Flash memory, and there are two basic power-loss protection mechanisms.

[0061] ① Backup Stack + Anti-Hook Zone: The backup stack organizes the data of the data area to be updated, along with its corresponding address, length, and checksum, and copies it to the backup stack for storage as backup records. It is primarily used to protect the data of each target area to be updated during a transaction, and is used for recovery operations in case of power failure. The anti-hook zone protects the entire page of data containing the target area to be updated. There can be a considerable number of anti-hook zones, which are used cyclically. Only the latest data protection page is ever valid; once the target area data is updated, the data protected by that anti-hook zone becomes invalid.

[0062] In this mechanism, the backup stack and the anti-tamper zone together occupy less storage space, leaving enough room for users. However, the downside is slow performance, as not only do the backup stack and the anti-tamper zone have dual backups, but the data area that is continuously accessed on the same page also needs to be protected repeatedly.

[0063] ② Anti-tamper zone: This power-loss protection mechanism removes the backup stack area and functions, and uses the anti-tamper zone for full-page protection. Furthermore, if the target area to be updated is within the same page, it does not need to be backed up repeatedly, thus avoiding redundant backups in the backup stack.

[0064] This mechanism offers optimal performance. However, in extreme cases (i.e., transactions involving all target pages in the user area), the user area needs to be divided in two, with one half used as a tamper protection zone. This mechanism is unsuitable for financial IC cards with limited space, as it would result in wasted space and insufficient user space.

[0065] Regarding Solution (1), since the unit erased during Flash chip programming is a page, the power-loss protection mechanism must consider protecting the entire page during programming, which already includes the protection of the data in the target area to be updated. Therefore, the power-loss protection mechanism can be implemented by protecting the entire page's data, eliminating the backup stack area and its functions, and only using an anti-tampering area, perfecting its functionality. The data in this area remains valid until committed, avoiding double backups. Simultaneously, when the target area to be updated within the same transaction is on the same page, duplicate backups can also be avoided. Regarding the second drawback, from the perspective of existing technology, the second power-loss protection mechanism meets the high performance requirements of financial IC cards, while the first power-loss protection mechanism occupies less available storage space.

[0066] Example 1

[0067] To balance the performance and space requirements of financial cards, the two solutions are combined to achieve the technical solution of this application. In normal use, the second mechanism rarely reaches or approaches its limit, so the performance advantage of the second mechanism can be retained. However, in some special cases involving waste recycling, the space requirement of the first mechanism can be combined to form the new power-off protection mechanism provided by this application.

[0068] In the embodiments of this application, such as Figure 2 As shown, the smart card includes a processor and a memory. The memory contains a user data area and an anti-tamper area. Preferably, if the user space is large enough to ensure the implementation of this scheme, the user space is divided in half, with one half used as the user data area and the other half as the anti-tamper area. If the user space requirement is large or the overall chip space is small, making it impossible to divide the user space in half, the available size of the anti-tamper area can be allocated based on experience.

[0069] The anti-tampering zone specifically includes an anti-tampering data protection zone and an anti-tampering flag zone. The anti-tampering data protection zone stores the entire page of data containing the target area to be updated. The anti-tampering flag zone stores n valid flags and only one invalid flag corresponding to each anti-tampering data protection zone. A valid flag consists of: a valid flag (Tag), the address of the data protection zone, the address of the target area to be updated, and a checksum. An invalid flag consists of: an invalid flag (Tag).

[0070] As an example, the memory of a smart card includes a data area and an anti-tamper zone, which comprises an anti-tamper data protection area and an anti-tamper flag area.

[0071] like Figure 3 As shown, in this example, the power-loss protection mechanism specifically includes the following when processing non-transactional tasks:

[0072] Step 310: Receive a request to write non-transactional data to the target area to be updated in the user data area;

[0073] Step 320: Copy the entire page of data containing the target area to be updated to the anti-tampering data protection area, and write the corresponding valid flag in the anti-tampering flag area;

[0074] Step 330: Update the target area to be updated;

[0075] Step 340: If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-pickup flag area, and the data corresponding to the valid flag in the anti-pickup data protection area is restored to the target area to be updated.

[0076] Step 350: After a non-transactional commit, write an invalidation flag after the last valid flag in the anti-tamper flag area, and then end.

[0077] When a smart card processes non-transactional operations, since there is no correlation between the non-transactional data writes, the original data is backed up to the anti-tamper data protection zone, and an invalidation flag is written to the anti-tamper flag area after the non-transactional data is written, thus ending the non-transactional processing.

[0078] like Figure 4 As shown, in this example, the power-loss protection mechanism specifically includes the following when processing transactions:

[0079] Step 410: Transaction begins. Receive a request to write transaction data to the target area to be updated in the user data area.

[0080] Step 420: Check if there is a valid flag in the anti-pickup flag area for the page address where the target area to be updated is located. If it exists, no backup is needed; if it does not exist, copy the entire page of data where the target area to be updated is located to the anti-pickup data protection area, and write the corresponding valid flag in the anti-pickup flag area.

[0081] Step 430: Update the target area to be updated in the user data area.

[0082] Step 440: If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-tamper flag area, and all data before the valid flag in the anti-tamper data protection area is restored to the target area to be updated in turn using the valid flags to ensure transaction integrity.

[0083] Step 450: After the transaction is committed, write an invalidation flag after the last valid flag in the anti-tamper flag area, and the transaction ends.

[0084] The transaction data written to the user data area updates the target area 1, target area 2, ..., target area n.

[0085] Once the transaction begins, the entire page of data containing the target area 1 to be updated is copied to Page_1 in the data protection zone, and a corresponding valid flag 1 is written to the flag area. Specifically, before updating target area 1, the entire page of data containing target area 1 to be updated is backed up and made effective. If a power failure occurs during the update of target area 1, the valid flag 1 can be used to restore the data in Page_1 of the unplugged data protection zone to the target area 1 to be updated.

[0086] Check the page address of the target area 2 to be updated in the flag area. If it already exists, there is no need to back it up, avoiding duplicate backups and improving performance. If it does not exist, copy the entire page of data of the target area 2 to be updated to Page_2 in the data protection area, and write the corresponding valid flag 2 in the flag area.

[0087] Before updating target area 2, back up the entire page of data containing target area 2 and make the backup effective. If a power failure occurs during the update process, the valid flag 2 can be used to restore the Page_2 data in the unblocked data protection zone to target area 2. Then, the valid flag 1 can be used to restore the Page_1 data in the unblocked data protection zone to target area 1. This ensures the integrity of the transaction.

[0088] ...

[0089] Check the page address of the target area n to be updated in the flag area. If it already exists, no backup is needed. If it does not exist, copy the entire page of data containing the target area n to be updated to Page_n in the data protection area, and write the corresponding valid flag in the flag area.

[0090] Before updating target area n, the entire page of data containing target area n is backed up and the backup is made effective. If a power failure occurs during the update process, the valid flag n can be used to restore the Page_n data in the untethered data protection zone to the target area n, and so on. Then, valid flag 2 is used to restore the Page_2 data in the untethered data protection zone to the target area 2, and finally, valid flag 1 is used to restore the Page_1 data in the untethered data protection zone to the target area 1. This ensures the integrity of the transaction.

[0091] As another example, Figure 5 As shown, the smart card's memory includes a data area, two anti-tamper zones (a first anti-tamper zone and a second anti-tamper zone), and a backup stack. Both the first and second anti-tamper zones include an anti-tamper data protection area and an anti-tamper flag area. Preferably, the storage capacity of the first anti-tamper zone is greater than that of the second anti-tamper zone.

[0092] The first anti-pickup data protection zone in the first anti-pickup zone stores the entire page of data containing the target area to be updated. The first anti-pickup flag zone stores n valid flags and only one invalid flag corresponding to each anti-pickup data protection zone. A valid flag consists of: a valid flag (Tag), the address of the data protection zone, the address of the target area to be updated, and a checksum byte. An invalid flag consists of: an invalid flag (Tag).

[0093] The second anti-tamper zone is used in conjunction with the backup stack and can be used cyclically. The second anti-tamper data protection area of ​​the second anti-tamper zone stores the entire page of data containing the target area to be updated. The second anti-tamper flag area of ​​the second anti-tamper zone stores m valid flags and m invalid flags corresponding to each anti-tamper data protection area. A valid flag consists of: a valid flag (Tag), the address of the data protection area, the address of the target area to be updated, and a checksum byte. An invalid flag consists of: an invalid flag (Tag).

[0094] The backup stack mainly stores the data involved in the target area to be updated. It consists of multiple backup records. The backup record contains the address, length, data, and checksum of the target area to be updated.

[0095] like Figure 6 As shown, in this instance, when processing non-transactional data, only the second unplugged zone is used to protect the entire page of data in the target area to be updated (non-transactional processing is equivalent to the instance using only one unplugged zone). The power-loss protection mechanism specifically includes:

[0096] Step 610: Receive a request to write non-transactional data to the target area to be updated in the user data area;

[0097] Step 620: Copy the entire page of data containing the target area to be updated to the second anti-pickup data protection area, and write the corresponding valid mark in the second anti-pickup mark area;

[0098] Step 630: Update the target area to be updated;

[0099] Step 640: If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the second anti-pickup flag area, and the data corresponding to the valid flag in the second anti-pickup data protection area is restored to the target area to be updated.

[0100] Step 650: After a non-transactional commit, write an invalidation flag after the last valid flag in the second anti-tamper flag area, and then end.

[0101] like Figure 7 As shown, in this example, the power-loss protection mechanism specifically includes the following when processing transactions:

[0102] Step 710: Transaction begins. Receive a request to write transaction data to the target area to be updated in the user data area.

[0103] Step 720: Check if the number of currently written target areas to be updated exceeds the number of the first anti-tamper zone. If so, proceed to step 760; otherwise, proceed to step 730.

[0104] Set the first data protection zone of the first anti-tamper zone to n pages (until full), and the second data protection zone of the second anti-tamper zone to m pages (can be used repeatedly). Copy the target areas 1 to n to be updated to the first anti-tamper zone, and copy the target areas n+1 to be updated to the second anti-tamper zone, and enable the backup stack.

[0105] Step 730: Check if there is a valid flag in the first anti-pickup flag area for the page address of the target area to be updated. If it exists, no backup is needed; if it does not exist, copy the entire page of data of the target area to be updated to the first anti-pickup data protection area, and write the corresponding valid flag in the first anti-pickup flag area.

[0106] Step 740: Update the target area to be updated.

[0107] Step 750: If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-tamper flag area, and all data before the valid flag in the anti-tamper data protection area is restored to the target area to be updated in turn using the valid flag to ensure transaction integrity. Then, step 790 is executed.

[0108] Step 760: Check if there is a valid flag in the first anti-tamper flag area for the page address of the target area to be updated. If it exists, no backup is required; if it does not exist, save the data of the target area to be updated to the backup stack as a backup record, and then copy the entire page of data of the target area to be updated to the second anti-tamper data protection area of ​​the second anti-tamper area. At the same time, write the corresponding valid flag in the second anti-tamper flag area of ​​the second anti-tamper area.

[0109] The backup record 1 written to the backup stack contains the address, length, data, and checksum of the target area n+1 to be updated. Then, the entire page of data containing the target area n+1 to be updated is copied to the second anti-tamper data protection area of ​​the second anti-tamper zone, and the corresponding valid flag is written to the second anti-tamper flag area of ​​the second anti-tamper zone.

[0110] Since the first anti-tamper zone has been exhausted, the backup stack and the second anti-tamper zone are used to protect the area and the entire page involved in the target area n+1 to be updated, and this protection is enabled.

[0111] Step 770: Update the target area to be updated, and write the failure mark in the second anti-pull mark area of ​​the second anti-pull mark area.

[0112] Step 780: If a power outage occurs during the update of the target area to be updated, the data in the second anti-tamper data protection area is restored using the valid flag of the second anti-tamper zone, then the corresponding backup record of the backup stack is restored, and then the data in the first anti-tamper data protection area is restored sequentially according to the first anti-tamper flag area of ​​the first anti-tamper zone.

[0113] If power fails during the update of target area n+1, the data in the second anti-tamper data protection area is restored using the valid flag of the second anti-tamper zone. Then, backup record 1 of the backup stack is restored, and the data in the first anti-tamper data protection area is restored sequentially from n to 1 according to the first anti-tamper flag area.

[0114] Step 790: After the transaction is committed, write a failure flag after the last valid flag in the first anti-tamper flag area, and fail the backup stack. The transaction ends.

[0115] The transaction data written to the user data area updates the target area 1, target area 2, ..., target area n, target area n+1, target area n+2, and target area n+m.

[0116] Copy the entire page of data containing the first target area to be updated to Page_1 of the data protection zone in the first anti-tamper zone. Simultaneously, write the corresponding valid flag 1 to the first anti-tamper flag area in the first anti-tamper zone. (Before updating the first target area, back up the entire page of data containing the first target area and make the backup effective. If a power failure occurs during the update process, this valid flag 1 can be used to restore the data from Page_1 of the first anti-tamper data protection zone to the first target area.)

[0117] The page address of the second target area to be updated is checked in the first anti-tamper flag area of ​​the first anti-tamper zone. If it already exists, no backup is needed to avoid duplicate backups and improve performance. If it does not exist, the entire page of data of the second target area to be updated is copied to the first anti-tamper data protection area, and the corresponding valid flag 2 is written in the first anti-tamper flag area.

[0118] Before updating the second target area, back up the entire page of data containing the second target area to Page_2 of the first anti-tamper data protection zone and make it effective. If there is a power failure during the update of the second target area, the data of Page_2 in the first anti-tamper data protection zone can be restored to the second target area using the effective flag 2. Then, the data of Page_1 in the first anti-tamper data protection zone can be restored to the first target area 1 using the effective flag 1, thereby ensuring the integrity of the transaction.

[0119] ...

[0120] The page address of the target area n to be updated is checked in the first anti-tamper flag area. If it already exists, no backup is needed; if it does not exist, the entire page of data of the target area n to be updated is copied to the first anti-tamper data protection area, and the corresponding valid flag n is written in the first anti-tamper flag area.

[0121] Before updating the target area n, back up the entire page of data containing the target area n to Page_n in the first anti-tamper data protection zone and make it effective. If power fails during the update of the target area n, the effective flag n can be used to restore the Page_n data in the first anti-tamper data protection zone to the target area n, the effective flag n-1 can be used to restore the Page_n-1 data in the first anti-tamper data protection zone to the target area n-1, ..., the effective flag 2 can be used to restore the Page_2 data in the first anti-tamper data protection zone to the target area 2, and then the effective flag 1 can be used to restore the Page_1 data in the first anti-tamper data protection zone to the target area 1.

[0122] Since the first anti-tamper data protection zone is set to only n, when the valid flag is written to the nth one, it means that the first anti-tamper zone is full. At this time, the first anti-tamper zone needs to be checked again to prevent backups from being made in the first anti-tamper zone. If there is a page address to be updated in the target area, there is no need to back up the record and add page protection again, saving time.

[0123] The page address of the target area n+1 to be updated is checked in the first anti-tamper flag area. If it already exists, no backup is needed. If it does not exist, the data of the target area n+1 to be updated is stored in the backup stack as a backup record, i.e., backup record 1. The backup record contains the address, length, data, and checksum of the target area n+1 to be updated. Then, the entire page of data containing the target area n+1 to be updated is copied to the second anti-tamper data protection area, and a corresponding valid flag is written in the second anti-tamper flag area.

[0124] Since the first anti-scraping zone is exhausted, the backup stack and the second anti-scraping zone are used to protect the area and the entire page involved in the target area n+1 to be updated, and this protection is activated. If a power failure occurs during the update of target n+1, the data in the second anti-scraping data protection zone is restored using the valid flag of the second anti-scraping zone. Then, backup record 1 of the backup stack is restored, and the data in the first anti-scraping data protection zone is restored sequentially from n to 1 according to the first anti-scraping flag area.

[0125] Update target area n+1 and write a failure flag in the second tamper protection flag area. The purpose is to disable the second tamper protection data page so that it can be reused.

[0126] The page address of the target area n+2 to be updated is checked in the first anti-tamper flag area. If it already exists, no backup is needed; otherwise, the data of the target area n+2 to be updated is stored in the backup stack as a backup record, i.e., backup record 2. The backup record contains the address, length, data, and checksum of the target area n+2 to be updated. Then, the entire page of data containing the target area n+2 to be updated is copied to the second anti-tamper data protection area, and a corresponding valid flag is written in the second anti-tamper flag area.

[0127] Since the first anti-scratching zone is exhausted, the backup stack and the second anti-scratching zone are used to protect the area and the entire page involved in the target area n+2 to be updated, and this protection is activated. If a power failure occurs during the update of target n+2, the data in the second anti-scratching data protection zone is restored using the valid flag of the second anti-scratching zone. Then, backup record 2 and backup record 1 of the backup stack are restored, and the data in the first anti-scratching data protection zone is restored sequentially from n to 1 according to the first anti-scratching flag area.

[0128] Update target area n+2 and write a failure flag in the second tamper protection flag area. The purpose is to disable the second tamper protection data protection page so that it can be reused.

[0129] ...

[0130] Transaction Commit: After the last valid flag in the first tamper-proof flag area, write the end flag. Simultaneously, invalidate the contents of the backup stack. The purpose is to invalidate all data in the first tamper-proof area and the backup stack, indicating that the transaction has completed normally and is now complete.

[0131] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A smart card, characterized in that, The smart card includes a processor and a memory; the memory includes a user data area and an anti-tampering area; the anti-tampering area includes an anti-tampering data protection area and an anti-tampering flag area. The anti-tampering data protection area stores the entire page of data where the target area to be updated is located, and the anti-tampering flag area stores n valid flags and one invalid flag corresponding to each anti-tampering data protection area; the valid flag includes a valid flag label, the address of the anti-tampering data protection area, the address of the target area to be updated, and a check byte; the invalid flag consists of an invalid flag label. The smart card is configured to, before copying the entire page of data containing the target area to be updated to the anti-tamper data protection area, further include: Check if the address of the target area to be updated has a valid flag in the anti-tamper flag area. If it already exists, no backup is needed; if it does not exist, copy the entire page of data containing the target area to be updated to the anti-tamper data protection area, and write the corresponding valid flag in the anti-tamper flag area.

2. A method for power-off protection of a smart card, wherein the method is applied to the smart card as described in claim 1, characterized in that, The method includes: Receive a request to write data to the target area to be updated in the user data area; First, copy the entire page of data containing the target area to be updated to the anti-tampering data protection area, and at the same time write the corresponding valid mark in the anti-tampering mark area; Update the target area to be updated; If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the anti-pickup flag area, and the data corresponding to the valid flag in the anti-pickup data protection area is restored to the target area to be updated. After the data request is completed, write the failure flag after the last valid flag in the anti-tamper flag area, and then end.

3. A smart card, characterized in that, The smart card includes a processor and a memory; the memory contains a user data area, two anti-tampering areas, and a backup stack. The first anti-pickup data protection area of ​​the first anti-pickup zone stores the entire page of data of the target area to be updated, and the first anti-pickup flag area stores n valid flags and only one invalid flag corresponding to each anti-pickup data protection area. The second anti-pumping data protection area of ​​the second anti-pumping zone stores the entire page of data containing the target area to be updated; the second anti-pumping flag area of ​​the second anti-pumping zone stores m valid flags and m invalid flags corresponding to each anti-pumping data protection area. The backup stack stores the data involved in the target area to be updated, and consists of multiple backup records; Both the first and second anti-pickup zones include an anti-pickup data protection zone and an anti-pickup flag zone. The anti-pickup data protection zone stores the entire page of data containing the target area to be updated. The valid flag includes a valid flag label, the address of the anti-tamper data protection zone, the address of the target area to be updated, and a check byte. The invalid flag consists of an invalid flag label. The smart card is configured to, before copying the entire page of data containing the target area to be updated to the anti-tamper data protection area, further include: Check if the address of the target area to be updated has a valid flag in the anti-tamper flag area. If it already exists, no backup is needed; if it does not exist, copy the entire page of data containing the target area to be updated to the anti-tamper data protection area, and write the corresponding valid flag in the anti-tamper flag area.

4. A smart card as described in claim 3, characterized in that, The second anti-tamper zone is used in conjunction with the backup stack and can be reused repeatedly.

5. A method for power-off protection of a smart card, wherein the method is applied to the smart card as described in any one of claims 3-4, characterized in that, include: Receive a request to write data to the target area to be updated in the user data area; Copy the entire page of data containing the target area to be updated to the second anti-plugging data protection area, and write the corresponding valid mark in the second anti-plugging mark area; Update the target area to be updated; If a power outage occurs during the update of the target area to be updated, the corresponding valid flag is searched in the second anti-pickup flag area, and the data corresponding to the valid flag in the second anti-pickup data protection area is restored to the target area to be updated. After the data request is completed, write the failure flag after the last valid flag in the second anti-tamper flag area, and then end.

6. The smart card power-off protection method as described in claim 5, characterized in that, Before copying the entire page of data containing the target area to be updated to the second anti-tamper data protection zone, the process also includes: checking if the number of target areas to be updated currently being written does not exceed the number of the first anti-tamper zone; if so, checking if the page address containing the target area to be updated has a valid flag in the first anti-tamper flag zone; if it already exists, no backup is needed; if it does not exist, copying the entire page of data containing the target area to be updated to the first anti-tamper data protection zone, and writing the corresponding valid flag in the first anti-tamper flag zone.

7. A smart card power-off protection method as described in claim 5, characterized in that, Before copying the entire page of data containing the target area to be updated to the second anti-tamper data protection area, the process also includes: checking if the number of target areas to be updated currently being written exceeds the number of the first anti-tamper data protection area; if so, checking if the page address containing the target area to be updated has a valid flag in the first anti-tamper flag area; if it already exists, no backup is needed; if it does not exist, the data of the target area to be updated is stored in the backup stack as a backup record, and then the entire page of data containing the target area to be updated is copied to the second anti-tamper data protection area of ​​the second anti-tamper zone, while writing the corresponding valid flag in the second anti-tamper flag area of ​​the second anti-tamper zone.

Images