Protection of an integrated circuit

Abstract

Integrated circuit, comprising a memory device (DM) comprising a memory plane (SMA) having non-volatile memory cells and being unobservable in reading from outside the memory device, control means (MCM), internal to the memory device, configured to detect the stored content of the memory plane, and when the stored content contains locking content, automatically lock any access to the memory plane from outside the memory device, the integrated circuit then being in a locked status, and authorize delivery outside the memory device of at least one so-called sensitive data item (DTS) stored in the memory plane. Figure for the abstract: Fig 1

Description

Title of the invention: Protection of an integrated circuit

[0001] Implementation and embodiment modes relate to integrated circuits, and more particularly to the protection of integrated circuits containing sensitive data.

[0002] When an integrated circuit leaves manufacturing, and it is intended to store at least one sensitive data item contributing to ensuring the functionality of a functional domain of the integrated circuit, for example an encryption key or a basic data item involved in the generation of an encryption key, there is a need to protect the integrated circuit, in particular before its delivery to a user or after its delivery, against attempts to extract this sensitive data by a malicious third party.

[0003] A solution known from the prior art consists of locking access to the sensitive data stored in the integrated circuit by using fuses intended to be blown to effect this access locking. However, such blown fuses can be reactivated using so-called FIB (Focused Ion Beam) techniques making it possible to modify the state of certain components of the integrated circuit.

[0004] There is therefore a need to protect such an integrated circuit more effectively.

[0005] According to one mode of implementation and embodiment, it is proposed to identify a integrated circuit coming out of manufacturing and, after having stored at least one sensitive data item, to lock it with an irreversible mechanism before introducing this product onto the market, i.e. delivery to an end user.

[0006] According to one embodiment, a locking system is proposed, any attempt to unlock which leads to the destruction of at least part of the sensitive data.

[0007] According to one embodiment, it is provided to equip the integrated circuit with a memory device comprising a memory plane including non-volatile memory cells of the floating gate type. The memory plane is subdivided into several memory zones, including a memory zone intended to store the sensitive data, and one or more other memory zones are intended to define the status of the integrated circuit.

[0008] Thus, if the memory plane includes a first content or reference pattern, the integrated circuit is considered to have a so-called “unlocked” status and it is then possible, for example, upon leaving manufacturing, to carry out a series of tests of the memory plane.

[0009] In particular, it is then possible to store therein a second content or reference pattern corresponding to a so-called “locked” status of the integrated circuit. This second content or reference pattern then forms a locking content or pattern. And, in this case, the sensitive data is stored in the corresponding memory area of ​​the memory plane and Write access to the memory device is locked. It then becomes possible for the memory device to output the sensitive data.

[0010] The memory device is only accessible for writing (programming or erasing), i.e. it is completely unobservable from the outside. In other words, it is not possible for an external user to read the contents of the memory map.

[0011] On the other hand, dedicated logic, internal to the memory device, can scan the memory plane to detect the stored content, and in the case where the second reference content is detected, lock write access to the memory plane and authorize the delivery of the sensitive data outside the memory device.

[0012] Thus according to one aspect, there is provided an integrated circuit, comprising a memory device comprising a memory plane having non-volatile memory cells and being unobservable in reading from outside the memory device, control means, internal to the memory device, configured to detect the stored content of the memory plane, and when the stored content contains locking content, -lock, advantageously automatically and advantageously irreversibly, any access to the memory plane from outside the memory device, the integrated circuit then being in a locked status, and - authorize delivery outside the memory device of at least one so-called sensitive data item stored in the memory plane.

[0013] When the integrated circuit comprises at least one functional domain, for example a domain including encryption / decryption means, said at least one sensitive data item advantageously contributes to ensuring the functionality of the functional domain.

[0014] According to one embodiment, the memory plane is only accessible in writing from outside the memory device and comprises an interface configured to receive data to be written into the memory plane.

[0015] The memory device also comprises processing means, for example programming and / or erasing means, configured to, when the memory plane contains a particular content corresponding to a so-called “unlocked” status of the integrated circuit, store in the memory plane via the interface, the content or locking pattern corresponding to the “locked” status of the integrated circuit and said at least one sensitive data item.

[0016] The control means, internal to the memory device, are configured to, when the stored content contains the locking content, advantageously prohibit irreversibly any access to the memory plane via said interface and authorize delivery of said sensitive data outside the memory device.

[0017] According to one embodiment, the respective mappings of the particular content and the locking content, the location of said at least one sensitive data item in the memory plane as well as the structural characteristics of the memory plane are such that when the integrated circuit is in its locked status, an attempt to modify the content stored in the memory plane, for example an attempt to program certain erased memory cells and / or an attempt to return to the particular content, place the integrated circuit in a so-called "invalid" status prohibiting the delivery of said at least one sensitive data item outside the memory device and / or destroy at least a portion of said at least one stored sensitive data item, i.e. change the logical value of one or more bits of this sensitive data item.

[0018] More particularly, the memory cells being generally mutually attached, the surface size of each memory cell is less than a limit size, for example 0.1 square micron.

[0019] For example, the size of a memory cell may be equal to 0.04 square microns.

[0020] Thus, even if a malicious third party tries to modify the state of a memory cell using ultraviolet radiation while attempting to mask other adjacent memory cells whose state he does not wish to modify, for example by a masking means such as a drop of ink, the size of the memory cells will nevertheless lead to the modification of the state of the masked cells, in particular by diffraction of the ultraviolet radiation.

[0021] Similarly, the size of these memory cells will make it extremely difficult, if not impossible, to modify their state using a FIB technique.

[0022] The control means are advantageously configured to detect the content stored in the memory plane and signal an anomaly if the stored content is different from the particular content or the locking content.

[0023] Reporting this anomaly may, for example, result in the integrated circuit being blocked, since the status of the integrated circuit would then be a so-called “invalid” status.

[0024] The particular content may comprise a first reference content which is for example at least part of the content of the memory plane obtained at the end of the manufacturing of the integrated circuit.

[0025] As will be seen in more detail below, this first reference content can be characterized by a certain number of memory cells of an area of ​​the memory plane in the erased state.

[0026] That being said, if before storing the locking content in the memory plane, it is desired to carry out one or more tests of this memory plane with one or more test patterns, it is then advantageous, according to one embodiment, that the pattern(s) of test patterns are also representative of the unlocked status. Indeed, if this were not the case, writing such a test pattern in the memory plane would lead to an invalid status which could block the integrated circuit.

[0027] In other words, according to a particularly advantageous embodiment, and with a view to carrying out test(s) of the memory plane, the particular content belongs to the group formed by the first reference content and by at least one first test content intended to be used to test the memory plane before storing the locking content.

[0028] For example, a particularly interesting first test content may include logical “0”s and logical “1”s forming a checkerboard together.

[0029] A second test content, also of particular interest, may comprise a checkerboard that is reversed compared to the checkerboard of the first test content.

[0030] According to one embodiment, each memory cell is configured to have a first state corresponding to a first logic of a bit stored in this memory cell.

[0031] This first state can thus correspond to the erased state of the memory cell, the bit stored in this memory cell in the erased state then having for example the logic value 1.

[0032] Each memory cell is also configured to have a second state corresponding to a second logical value of the bit stored in that memory cell.

[0033] Thus, for example, the second state corresponds to the programmed state of the memory cell, the bit stored in this memory cell in the programmed state then having the logic value 0.

[0034] Said at least one sensitive data item comprises at least one bit, but generally several bits, for example 64 or 128 bits.

[0035] The memory plane comprises for example a first zone containing one or more first memory cells configured to respectively store the bit or bits of said at least one sensitive data item.

[0036] The memory plane also comprises, for example, a second zone and a third zone.

[0037] According to one embodiment, in the locked status, the first zone contains said at least one sensitive data item while the memory cells of the second zone are in their first state, for example the erased state, and the memory cells of the third zone are in their second state, for example the programmed state, the logical values ​​of the bits of the memory cells of the second zone and of the third zone forming the locking content.

[0038] The fact that the memory cells of the second zone are in the erased state, advantageously storing a bit of logic value “1”, is particularly interesting because This helps thwart attacks that attempt to block a bus or sense amplifier with logic values ​​of "0".

[0039] According to one embodiment, in the unlocked status, said at least one sensitive data item is not stored in the first zone and the third zone comprises a number, greater than a threshold, of memory cells in their first state, for example the erased state, the logical values ​​of these memory cells in their first state forming the first reference content.

[0040] This threshold can be equal to 90% of the number of memory cells in the third zone.

[0041] Indeed, at the end of manufacturing, the memory cells of the memory plane are in their virgin state, that is to say that they are generally in an erased state but some of them may nevertheless be in a state corresponding to a programmed state.

[0042] The number of first memory cells (i.e. the memory cells of the first zone intended to contain the bit(s) of the sensitive data) is advantageously less than the number of memory cells of the third zone and these first memory cells are dispersed within the memory plane.

[0043] As an indication, the number of first memory cells may be less than 15%, for example equal to 10%, of the number of memory cells in the memory plane.

[0044] Similarly, the number of second memory cells, i.e. the memory cells of the second zone, is advantageously less than the number of memory cells of the third zone and the second memory cells are also dispersed within the memory plane.

[0045] The number of second memory cells is advantageously also less than 15%, for example equal to 10%, of the number of memory cells of the memory plane.

[0046] Thus, for example, 80% of the memory cells in the memory plane are memory cells of the third zone, 10% of these memory cells are first memory cells and 10% of these memory cells are memory cells of the second zone.

[0047] According to one embodiment, in order to store the locking content and said at least one sensitive data item, the processing means are configured to - place in their first state (for example the erased state) all the memory cells of the memory plane, then - store said at least one sensitive data item in the first memory cell(s), then -place all memory cells in the third zone in their second state (the programmed state).

[0048] The memory cells of the second zone, which were previously erased, remain in their erased state.

[0049] According to one embodiment, the control means comprise - locking means configured to, in the presence of a control signal, lock access to the memory plane in write mode, and - a control block configured to detect the content stored in the memory plane and to, when the locking content is detected, deliver the control signal to the locking means and deliver said at least one sensitive data item outside the memory device.

[0050] The integrated circuit also further advantageously comprises a temporary memory configured to store said at least one sensitive data item when the integrated circuit is in its unlocked status, and the processing means are configured to copy said at least one sensitive data item into the first memory cell(s) and to erase the temporary memory, when switching from the unlocked status to the locked status.

[0051] The control block is also advantageously configured to signal said anomaly if the stored content is different from the particular content or the locking content.

[0052] The memory cells are advantageously memory cells each having a floating gate, a control gate and a selection transistor buried in a substrate.

[0053] The integrated circuit can form a microcontroller.

[0054] According to another aspect, there is provided a method of protecting an integrated circuit, comprising - equipping the integrated circuit with a memory device comprising a memory plane having non-volatile memory cells and not observable in reading from outside the memory device, - have the memory device itself detect the stored contents of the memory map, and -when the stored content contains locking content, having the memory device itself lock, advantageously automatically, any access to the memory plane from outside the memory device, the integrated circuit then being in a locked status, and having the memory device itself authorize delivery outside the memory device of at least one so-called sensitive data item stored in the memory plane.

[0055] This locking is advantageously irreversible and is carried out after the manufacture of the integrated circuit and before delivery of the integrated circuit to a user.

[0056] Said at least one sensitive data item is advantageously stored in the memory plane when the memory plane contains a particular content, corresponding to a so-called “unlocked” status of the integrated circuit, and obtained for example from cells- memory in its pristine state resulting from the manufacture of the integrated circuit. This sensitive data is stored in the memory plane before its locking triggered by the storage of the locking content.

[0057] According to an embodiment in which the memory device comprising an interface, -step b) further comprises, when the memory plane contains a particular content corresponding to a so-called unlocked status of the integrated circuit, a storage in the memory plane via the interface, of the locking content and of said at least one sensitive data item, and -step c) comprises having the memory device prohibit any access to the memory plane via said interface and having the memory device itself authorize the delivery of said at least one sensitive data item outside the memory device.

[0058] According to one embodiment, step a) is carried out during the manufacture of the integrated circuit, and steps b) and c) are carried out after the manufacture of the integrated circuit and before delivery of the integrated circuit to a user.

[0059] According to one embodiment, the method comprises, after delivery of the integrated circuit to the user, during operation of the integrated circuit, before any operation performed by the integrated circuit requiring at least one use of said at least one sensitive data item, a detection by the memory device of the stored content of the memory plane, and if the stored content contains the locking content, a delivery by the memory device of said at least one sensitive data item outside the memory device.

[0060] According to one embodiment, when the integrated circuit is in its locked status, an attempt to modify the content stored in the memory plane places the circuit in a so-called invalid status prohibiting the delivery of said at least one sensitive data item outside the memory device and / or destroys at least a portion of said at least one stored sensitive data item.

[0061] According to one embodiment, the memory device signals an anomaly if the stored content is different from the particular content or the locking content.

[0062] According to one embodiment, the particular content comprises a first reference content which is at least part of the content of the memory plane obtained following the manufacture of the integrated circuit.

[0063] The particular content may also belong to the group formed by the first reference content and at least one first test content, and step b) further comprises a memory plane test with said at least one first test content.

[0064] According to one embodiment, in the unlocked status, said at least one sensitive data item is stored in a temporary memory separate from the memory plane, and storing the lock content includes erasing all the memory cells in the memory plane, then storing said at least one sensitive data item in the memory plane and writing the lock content in the memory plane and erasing the temporary memory.

[0065] According to one embodiment, the surface size of each memory cell is less than a limit size.

[0066] According to one embodiment, each memory cell is configured to have a first state corresponding to a first logical value of a bit stored in this memory cell and a second state corresponding to a second logical value of the bit stored in this memory cell.

[0067] Said at least one sensitive data item comprises at least one bit and the memory plane comprises a first zone containing one or more first memory cells configured to store respectively the bit(s) of said at least one sensitive data item, a second zone and a third zone.

[0068] In the locked status, said at least one sensitive data item is stored in the first memory cell(s), the memory cells of the second zone are placed in their first state and the memory cells of the third zone in their second state, the logical values ​​of the bits of the memory cells of the second zone and of the third zone forming the locking content.

[0069] According to one embodiment, the first state corresponds to the erased state of the memory cell, the bit stored in this memory cell in the erased state having the logic value 1, and the second state corresponds to the programmed state of the memory cell, the bit stored in this memory cell in the programmed state having the logic value 0.

[0070] According to one embodiment, in the unlocked status, said at least one sensitive data item is not stored in the first zone and the third zone comprises a number, greater than a threshold, of memory cells of the third zone being in their first state, the logical values ​​of these memory cells in their first state forming the first reference content.

[0071] According to one embodiment, the threshold is equal to 90% of the number of memory cells in the third zone.

[0072] According to one embodiment, the number of first memory cells is less than the number of memory cells in the third zone and the first memory cells are dispersed within the memory plane.

[0073] According to one embodiment, the number of first memory cells is less than 15% of the number of memory cells in the memory plane.

[0074] According to one embodiment, the number of memory cells in the second zone is less than the number of memory cells in the third zone and the memory cells in the second zone are dispersed within the memory plane.

[0075] According to one embodiment, the number of memory cells in the second zone is less than 15% of the number of memory cells in the memory plane.

[0076] According to one embodiment, to store the locking content and said at least one sensitive data item, all the memory cells of the memory plane are placed in their first state, then said at least one sensitive data item is stored in the first memory cell(s), then all the memory cells of the third zone are placed in their second state.

[0077] According to one embodiment, the method further comprises storing said at least one sensitive data item in a temporary memory when the integrated circuit is in its unlocked status, and when switching to the locked status, said at least one sensitive data item is copied into the first memory cell(s) and the temporary memory is erased.

[0078] Other advantages and characteristics of the invention will appear on examining the detailed description of modes of implementation and embodiment, which are in no way limiting, and the appended drawings in which:

[0079] [Fig.l]

[0080] [Fig.2]

[0081] [Fig.3]

[0082] [Fig.4]

[0083] [Fig.5]

[0084] [Fig.6]

[0085] [Fig.7]

[0086] [Fig.7A]

[0087] [Fig. 8]

[0088] [Fig.9]

[0089] [Fig.9A]

[0090] [Fig.9B]

[0091] [Fig. 10]

[0092] [Fig. 11]

[0093] [Fig. 12]

[0094] [Fig. 13], and

[0095] [Fig. 14] schematically illustrate modes of implementation and embodiment of the invention.

[0096] In [Fig.l], the reference IC designates an integrated circuit, for example a microcontroller, comprising in particular a DM memory device having an SMA memory plane forming here a secure memory plane.

[0097] As will be seen in more detail below, the memory device DM is capable of having a so-called unlocked status, for example at the end of manufacturing, in which it is possible to perform tests of the SMA memory plane and in which sensitive data DTS, contributing to ensuring the functionality of a functional domain DMF of the integrated circuit, is stored in a temporary memory MMT.

[0098] The memory device is also intended to have a so-called locked status, in which the sensitive data DTS is this time stored in the memory plane SMA.

[0099] The SMA memory plane is accessible from the outside, i.e. via an IF1 interface, only in writing mode.

[0100] The memory device is thus configured to receive in particular CMD commands, for example write and erase commands, as well as Data data to be written in the SMA memory plane.

[0101] The memory device therefore comprises MT processing means of conventional and known structure, comprising in particular row decoders, column decoders, charge pumps, etc., and configured to carry out programming or erasing of the memory cells of the SMA memory plane, so as to write logic values ​​0 or 1 therein respectively.

[0102] On the other hand, the SMA memory plane is not observable, in reading, from outside the memory device.

[0103] The memory device DM also comprises control means MCM comprising on the one hand a control block BLC, the structure of which will be described in more detail below, and configured to, in response to a scanning command SMA_SCAN received via an additional interface IF2, scan the memory plane SMA to detect its stored content.

[0104] The MCM control means also comprise MVR locking means, configured to, in response to a SCOMV locking signal emitted by the BLC control block, lock write access to the SMA memory plane.

[0105] As a limiting example, these MVR locking means may comprise switches, such as for example MOS transistors, arranged on the data bus and the control bus of the SMA memory plane. When these switches are closed, write access is possible and when they are open, write access is impossible.

[0106] Of course, other structures of locking means are possible.

[0107] Furthermore, even if in [Fig.l], the two interfaces IF1 and IF2 have been represented separately, they can of course be formed by a single interface.

[0108] The BLC control block also transmits status information ST representing in particular the unlocked status or the locked status of the integrated circuit.

[0109] That being said, as will be seen in more detail below, the status information ST can also be representative of a so-called invalid status of the integrated circuit, when the latter is neither in its locked nor in its unlocked status.

[0110] The functional domain DMF of the integrated circuit here may be, as illustrated very schematically in [Fig.2], a domain comprising encryption / decryption means MCR, intended to receive an encryption key HUK resulting for example from a logical operation, for example an exclusive “OR”, between the sensitive data DTS delivered by the memory device, and a data DPUF delivered by a physically non-clonable function device PUF, of conventional structure and known per se.

[0111] And, this DTS data, which is sensitive data, contributes to ensuring the functionality of the DMF functional domain, in particular the encryption / decryption means. Thus, if the sensitive DTS data is corrupted or partially destroyed, the DMF domain is no longer functional.

[0112] As illustrated in [Fig.3], the SMA memory plane here comprises three memory areas ZM1, ZM2 and ZM3.

[0113] As will be seen below, the memory zone ZM1 is intended to store in its memory cells, the bits of the sensitive data DTS while, in this example, the memory cells of the zones ZM2 and ZM3 are intended to store a particular content (for example a first reference content which is a part of the content of the memory plane obtained at the end of the manufacturing of the integrated circuit) or a second reference content (also called locking content) respectively representative of the unlocked status and the locked status of the integrated circuit IC.

[0114] It is also possible, as will be seen below, that the entire memory plane stores, as particular content representative of the unlocked status, one or more test contents, for example a “checkerboard” or an “inverted checkerboard”.

[0115] As illustrated very schematically in [Fig.4], the matrix of memory cells, arranged in rows and columns, of the SMA memory plane mainly comprises memory cells M3i,j from the third memory zone ZM3 and a few cells M2i,j from the second memory zone ZM2.

[0116] The first memory zone ZM1 comprises as many memory cells Mli,j, called first memory cells, as there are bits in the sensitive data DTS.

[0117] As a non-limiting example, the memory cell matrix comprises 80% of memory cells M3i,j, 10% of memory cells M2i,j, and 10% of first memory cells Mli,j.

[0118] Furthermore, as illustrated in [Fig.4], the memory cells Mli,j, and the memory cells M2i,j, are dispersed within the memory cell matrix of the SMA memory plane.

[0119] Furthermore, each memory cell occupies substantially a square location on the silicon, the side d of the square being for example here of the order of 0.2 microns leading at a surface size of the order of 0.04 square microns.

[0120] And, two adjacent memory cells are joined together, even if in [Fig.4], they are shown spaced apart for the purpose of greater clarity of the figure.

[0121] The size of these memory cells, as well as the dispersion of the memory cells M2i,j within the memory plane in particular, make it extremely difficult, if not impossible, for a malicious third party to attack the SMA memory plane using ultraviolet radiation, for example, with a view to selectively erasing certain memory cells without erasing the others.

[0122] Thus, if an attacker wants to erase a cell M3i,j located next to a cell Mli,j containing a bit of sensitive data, without wanting to erase the bit of this sensitive data, he could be tempted to mask this cell Mli,j with a masking means, such as a drop of ink, so that the ultraviolet radiation does not impact this cell.

[0123] However, given the small size of the cells, ultraviolet radiation impacting the cell M3i,j adjacent to this cell Mli,j masked by the drop of ink, will nevertheless erase the contents of this cell Mli,j by diffraction.

[0124] Similarly, it will be extremely difficult, if not impossible, for an attacker to carry out an attack using a FIB technique in order to selectively program certain memory cells without programming adjacent memory cells.

[0125] The memory cells Mli,j M2i,j and M3i,j are all here non-volatile cells of the split-gate type.

[0126] In [Fig.5], the reference M designates such a non-volatile memory cell of the type split gate, for example of the select transistor type having a vertical gate buried in the substrate of an integrated circuit.

[0127] More precisely, the memory cell M comprises a state transistor T comprising a floating gate FG surmounted by a control gate CG connected to a gate control line CGL.

[0128] The drain (D) of the state transistor T is connected to a bit line BL while the source (S) of the state transistor T is connected to the drain of a selection transistor ST.

[0129] The selection transistor ST comprises a gate CSG connected to a word line WL.

[0130] The source (S) of the selection transistor ST is connected to a source line SL.

[0131] With such memory cells, different memory plane structures are possible, namely a structure with a single bit line per column or a structure with two (or double) bit lines per column.

[0132] That being said, a structure with two bit lines per column, as for example described in the French patent application published under No. 3049380 or in the French patent application published under No. 3036221, is particularly advantageous because it simplifies in particular the reading of the memory cells in the sense that it is not necessary to provide for the application of an inhibition voltage on a twin memory cell of the memory cell to be read.

[0133] As an example, [Fig.6] represents an SMA memory plane structure with two bit lines per column and comprising memory cells Mi,j; Mi,j+1; Mi-l,j; Mi-l,j+l of the type described in patent application US 2013 / 0228846.

[0134] For the purposes of simplification and clarity, the memory cells referenced in Figures 6 and 7 indistinctly designate the memory cells Mli,j or M2i,j or M3i,j located in the memory areas ZM1, ZM2 and ZM3 of the SMA memory plane illustrated in Figures 3 and 4.

[0135] [Fig.6] is the electrical diagram of an embodiment of such an SMA memory plane, made in a semiconductor substrate. The memory plane comprises rows and columns of memory cells.

[0136] For the purpose of simplification and clarity, only eight memory cells Ml,j, M2,j, M3,j, M4,j, Ml,j+1, M2,j+1, M3,j+1, M4,j+1 belonging to rows 1, 2, 3 and 4 and to columns j and j+1 are shown here. Each memory cell comprises a floating gate (FG) state transistor, respectively Tl,j, T2,j, T3,j, T4,j, Tl,j+1, T2,j+1, T3,j+1, T4,j+1, and a selection transistor ST whose drain terminal (D) is connected to the source terminal (S) of the floating gate transistor.

[0137] The memory cells Ml,j, M2,j, M3,j, M4,j belong to a column of rank j and the memory cells Ml,j+1, M2,j+1, M3,j+1, M4,j+1 belong to an adjacent column of rank j+1. The memory cells Ml,j, Ml,j+1 belong to a first row of memory cells and their floating gate transistors Tl,j, Tl,j+1 have control gates CGI connected to a common gate control line CGL1. The memory cells M2,j, M2,j+1 belong to a second row of memory cells and their floating gate transistors T2,j, T2,j+1 have control gates CG2 connected to a common gate control line CGL2. Memory cells M3,j, M3,j+1 belong to a third row of memory cells and their floating gate transistors T3,j, T3,j+1 have control gates CG3 connected to a common gate control line CGL3.Memory cells M4,j, M4,j+1 belong to a fourth row of memory cells and their floating gate transistors T4,j, T4,j+1 have control gates CG4 connected to a common gate control line CGL4.

[0138] In the column of rank j, the memory cells Ml,j, M2,j are twin memory cells and their selection transistors ST comprise a common selection gate CSG 1,2 connected to a common word line WL1,2.

[0139] Similarly, the memory cells M3,j, M4,j are twin memory cells and their selection transistors ST comprise a common selection gate CSG3,4 connected to a common word line WL3,4.

[0140] In the column of rank j+1, the memory cells Ml,j+1, M2,j+1 are twin memory cells and their selection transistors ST comprise a common selection gate CSG1,2 connected to the word line WL1,2.

[0141] The memory cells M3,j+1, M4,j+1 are twin memory cells and their selection transistors ST comprise a common selection gate CSG3,4 connected to the common word line WL3,4.

[0142] The common selection gates CSG1,2 or CSG3,4 of the pairs of twin memory cells are buried vertical gates made in the form of conductive trenches made in the substrate, and the source terminals (S) of the selection transistors ST are connected to a buried source plane SL, extending under the region of the substrate where the memory cells are implanted.

[0143] The SMA memory plane comprises two bit lines per column of memory cells. Thus, two bit lines BL1,j, BL2,j are allocated to the memory cells of the column of rank j, and two bit lines BL1,j+1, BL2,j+1 are allocated to the memory cells of the column of rank j+1.

[0144] Two twin memory cells are connected to different bit lines among the two bit lines assigned to the column in which they are located, while two adjacent but non-twin memory cells are connected to the same bit line.

[0145] Thus, in the column of rank j:

[0146] - the drain terminal (D) of the floating gate transistor T1,j is connected to the bit line BLl,j via a conductive path IA,

[0147] - the drain terminal of the floating gate transistor T2,j is connected to the bit line B2,j via a conductive path 23B,

[0148] - the drain terminal of the floating gate transistor T3,j is connected to the bit line BL2,j via the conductive path 23B (the memory cell M2,j being adjacent but not twinned with the memory cell M3,j), and

[0149] - the drain terminal of the floating gate transistor T4,j is connected to the bit line BL1,j via a 4A conductive path.

[0150] In the column of rank j+1:

[0151] - the drain terminal of the floating gate transistor Tl,j+1 is connected to the bit line BLl,j+l via a conductive path IC,

[0152] - the drain terminal of the floating gate transistor T2,j+1 is connected to the bit line BL2,j+l via a 23D conductive path,

[0153] - the drain terminal of the floating gate transistor T3,j+1 is connected to the bit line BL2,j+l via the conductive path 23D (memory cell M2,j+1 being adjacent but not twin to memory cell M3,j+1), and

[0154] - the drain terminal of the floating gate transistor T4,j+1 is connected to the bit line BL1,j+1 via a 4C conductive path.

[0155] As illustrated in [Fig.7], and as indicated above, each state transistor cooperates with a vertical selection transistor buried in the substrate SB.

[0156] The ZCH channel of the state transistor is referenced ZCH.

[0157] The selection transistors ST connected to the two state transistors T3,j and T4,j each have a vertical channel ZCV and a buried vertical common selection gate CSG3,4. It should be noted that for the purpose of simplifying the figure, the contact for connecting the buried common gate CSG3,4 to the corresponding word line WL3,4 is not shown.

[0158] [Fig.7] illustrates more precisely the four cells M2,j, M3,j, M4,j, M5,j belonging to the same column j and to the 4 rows 2 to 5.

[0159] The drain of transistors T2,j and T3,j is connected to bit line BL2j and the drain of transistors T4,j and T5,j is connected to bit line BL1j which are the two bit lines for column j.

[0160] Each memory cell has a first state, for example an erased state, in which it stores a bit having a first logical value, for example the logical value 1, and a second state, for example a programmed state, in which it stores a bit having a second logical value, for example the logical value 0.

[0161] The state transistor of a memory cell is advantageously configured to be on when the memory cell is in its first state and to be off when the memory cell is in its second state.

[0162] A simple way to obtain such a state transistor is to provide, for example, a state transistor of the depletion type as described in the aforementioned French patent application published under No. 3049380.

[0163] As is well known to those skilled in the art, the depletion MOS transistor is conductive without a control voltage applied to the control gate of the state transistor (control gate connected to ground), and consequently to the floating gate by capacitive coupling. The state transistor is therefore said to be "normally on". On the other hand, the transistor becomes less and less conductive as the control voltage present on the control gate increases in absolute value (becomes more and more negative) to finally turn off beyond a blocking voltage.

[0164] The ZCH channel of the state transistor is advantageously a surface channel so that it may be possible to block the conduction of the channel by applying an acceptable control voltage to the control gate of the state transistor.

[0165] The implantation energy of the dopants defines the depth of the ZCH channel. As an indication, this energy can be between 5keV and 100keV, leading to a channel depth of the order of 100 nm.

[0166] In the case of a channel of conductivity type N, the implanted dopants may be, for example, arsenic As, and the concentration of dopants determines the threshold voltage VthO of the state transistor of a memory cell in the virgin state. The state transistor is here configured to have such a negative threshold voltage VthO. In this respect, a dose of implanted dopants of between 1012 atoms / cm2 and 1014 atoms / cm3 may be used.

[0167] With such a dose of dopants, it is possible to obtain a negative voltage VthO of, for example, between -1 volt and -0.5 volt.

[0168] In [Fig.7A], the different threshold voltages Vthe, VthO and Vthp corresponding respectively for example to erased, blank and programmed memory cells are shown schematically.

[0169] In read mode, a zero read voltage can be applied to the control gate CG of the state transistor and a positive voltage can be applied to the bit line BL.

[0170] The state transistor being depletion with a negative voltage VthO, it is normally on for a blank memory cell, i.e. when no charge is present in the floating gate.

[0171] It then emerges from [Fig.7A] that a state transistor of an erased memory cell will be on while the state transistor of a programmed memory cell will be off. And, the fact of applying a zero voltage to the control gate and consequently to the floating gate FG of the state transistor, does not induce read stress.

[0172] Furthermore, the programming or erasure of a floating gate transistor is carried out here by injecting or extracting electrical charges into the gate of the transistor by injecting hot electrons by means of high voltage(s).

[0173] More particularly, the erasure of a memory cell is ensured by combining a positive voltage applied to the substrate with a negative voltage applied to the control gate of its floating gate state transistor.

[0174] That being said, the SMA memory plane is advantageously erasable by block of memory cells.

[0175] The programming of a memory cell can be ensured for example by applying a positive voltage to the bit line concerned, by applying a zero voltage to the substrate, and a positive voltage on the control gate of its floating gate state transistor.

[0176] The selection of such a memory cell to be programmed is carried out by applying a positive voltage greater than the threshold voltage of the state transistor, on the word line concerned.

[0177] Finally, as indicated above, the reading of a memory cell is ensured in ap applying a zero voltage to the control gate CG of its state transistor, as well as a positive voltage to the corresponding bit line.

[0178] The selection of such a memory cell to be read is carried out by applying a positive voltage greater than the threshold voltage of the state transistor, on the word line concerned.

[0179] In practice, in read mode, a zero voltage will be applied to the control gates of all the cells in the memory plane.

[0180] [Fig.8] very schematically illustrates a first reference content MREF1 capable of being stored in the SMA memory plane.

[0181] In this example, the first reference content MREF1 is characterized by at least 90% of the memory cells M3i,j of the third memory zone ZM3 in the erased state, i.e. storing a logical “1”, regardless of the content of the remaining 10% of cells M3i,j and regardless of the content or state of the cells Mli,j and M2i,j.

[0182] This first reference content MREF1 is representative of the unlocked status of the integrated circuit IC.

[0183] It should also be noted that in the unlocked status, the first memory cells Mli,j do not contain the bits of the sensitive data DTS.

[0184] [Fig.9] illustrates, still very schematically, a second reference content MREF2 intended to be stored in the SMA memory plane.

[0185] This second reference content is this time representative of the locked status of the integrated circuit.

[0186] Here, the second reference content comprises all the memory cells M3i,j of the third memory area in the programmed state, i.e. containing a logical “0”, and all the memory cells M2i,j in the erased state, i.e. containing a logical “1”.

[0187] In the locked status of the integrated circuit IC, the first memory cells Mli,j store the bits k of the sensitive data DTS.

[0188] Even if all the bits of the DTS data are designated here by the arbitrary value k, they are of course not all equal to the same logical value.

[0189] As will be seen below, the control block is advantageously configured to emit an anomaly signal, leading for example to the blocking of the integrated circuit, if the detected content of the memory plane is different from the first reference content MREF1 or the second reference content.

[0190] However, it is only when the integrated circuit is in its unlocked status that one can write to the SMA memory plane.

[0191] As will be seen below, the first reference content MREF1 is particularly advantageous because it is formed by part of the content of the SMA memory plane after manufacturing the integrated circuit.

[0192] We can therefore already write to the memory plane without performing any particular operations.

[0193] So if at this stage we do not wish to carry out a test of the memory plane, we can directly write the MREF2 locking content into the memory plane as well as the sensitive data DTS, so as to lock it and authorize the delivery of the sensitive data outside the memory device DM.

[0194] If, on the other hand, it is desired, prior to placing the integrated circuit in its locked status, to carry out tests of the SMA memory plane with test contents, these test contents must also be representative of the unlocked status of the integrated circuit.

[0195] In other words, in this perspective, each of the first reference pattern and the test content(s) will be considered as being a so-called particular content corresponding to the unlocked status of the integrated circuit.

[0196] As an example, a first MTST1 test content of interest is illustrated in [Fig.9A]. In this first MTST1 test content, all memory cells in the SMA memory plane have either a logical “0” or a logical “1” so as to form a checkerboard.

[0197] A second possible test content is the MTST2 content illustrated in [Fig.9B], which is a reverse checkerboard compared to the checkerboard in [Fig.9A].

[0198] Reference is now made more particularly to [Fig. 10] to describe an embodiment of the BLC control block.

[0199] This comprises an MMR memory, for example a ROM type memory, containing the first reference content MREF1 and the second reference content MREF2.

[0200] This memory can also contain one or more test contents, here the two test contents MTST1 and MTST2 because, as indicated above, when the integrated circuit IC is in an unlocked status, it is entirely possible to carry out tests of the memory plane.

[0201] The BLC control block also comprises an LGC control logic comprising, for example, a state machine associated with means for reading the SMA memory plane, including in particular reading amplifiers.

[0202] When the LGC control logic receives the SMA_SCAN scan control signal, it scans all the column addresses of the memory plane to successively read the bits of the different lines stored in the SMA memory plane.

[0203] Then, the LGC control logic can compare the stored content thus read with the contents stored in the MMR memory, here the first reference content MREF1, the second reference content MREF2 and the two test contents MTST1 and MTST2.

[0204] If the first reference content MREF1 is detected, then the status signal ST takes a logic value representative of the unlocked status and the SMA memory plane can be tested with the test patterns MTST1 and MTST2 for example.

[0205] In this regard, the control logic may incorporate a structure known to those skilled in the art as “Built-In Self-Test” (BIST) which allows the memory device to diagnose itself. More specifically, for example the test content MTST1 is delivered as an input to the memory device via the interface IF1. And, if the content stored in the memory plane following this write command actually corresponds to the test content MTST1, the control logic may deliver a logic signal indicating that the test result is positive (OK).

[0206] As indicated above, when the second reference content MREF2 is detected, the status signal takes a logic value corresponding to the locked status of the integrated status, the locking control signal SCOMV is delivered to the locking means locking the write access of the memory plane and the bits of the data DTS are delivered at the output of the memory device by the control block BLC.

[0207] We now refer more particularly to figures 11 and following to describe an embodiment of the method according to the invention.

[0208] In step SI 10, the memory device and the integrated circuit are manufactured in a conventional manner known per se.

[0209] At the end of this manufacturing, all the memory cells Mi,j, whether they are cells M1, M2 or M3, are in a blank state, that is to say they have never been erased or programmed.

[0210] Also, in general, the majority of memory cells in the blank state have an erased state, but some of them may nevertheless have a programmed state.

[0211] This is the reason why when detecting the contents of the memory plane SMA in step SI 11, it is sought to detect whether at least 90% of the memory cells M3i,j of the third memory zone are in the erased state (step SI 12).

[0212] If this is not the case, then there is an anomaly (step SI 13A) and the process stops.

[0213] If, on the other hand, in step SI 12, at least 90% of memory cells M3i,j have been detected in the erased state, then the control logic LGC considers that the particular content, in this case the first reference content MREF1, has indeed been detected, which places the integrated circuit IC in its unlocked status (step SI 13B).

[0214] It is then possible to write data into the memory plane to carry out in particular a test of the SMA memory plane (step SI 14) using one or more test contents, for example the MTST1 and MTST2 contents.

[0215] If the checkerboard of the first test content MTST1 is first used, and then another test is to be performed with the inverted checkerboard of the second test content MTST2, it is possible to write the second test content into the memory plane, since it is still in its unlocked status (the first test content is in fact a particular content representative of the unlocked status). For this purpose, the programmed cells can be erased and the erased cells of the first test content MTST1 can be programmed.

[0216] Another possibility consists, since it is only possible to write in the memory plane when the unlocked status is detected, after each test, of erasing at least 90% of the memory cells M3i,j and in practice all of the memory cells of the memory plane SMA, to find the first reference content MREF1 and to find oneself there again in the unlocked status before carrying out a new test with a new test content, for example by writing the second test content MTST2.

[0217] Furthermore, when the integrated circuit is in its unlocked status, the sensitive data DTS is not stored in the memory plane SMA but in the temporary memory MMT (step SI 15).

[0218] If in step SI 16, the test of the SMA memory plane has proven to be incorrect, then there is again an anomaly detected (step SI 17) and there again the method stops.

[0219] If, on the other hand, the test proves positive (OK), then, to write the second reference content MREF2 into the memory plane SMI, a mass erasure of the memory plane SMA is first carried out in step SI 18, which therefore places all the memory cells of this memory plane in the erased state (stored logic value “1”).

[0220] Then, the sensitive data DTS is copied into the first memory zone ZM1 (step 119).

[0221] Then, in step S120, all the cells M3i,j of the third memory zone are programmed, that is to say a 0 is written in these cells.

[0222] Since the memory cells M2i,j which were previously erased during the mass erase have not been programmed, they retain their logic value 1.

[0223] We therefore find ourselves in step S121, with a memory plane whose memory cells M2i,j are in the erased state (they store bits of logic value 1), and whose memory cells M3i,j are in the programmed state (they store bits of logic value 0).

[0224] The control logic LGC then detects in step S122 the content of the memory plane SMA and consequently, in step S123, the second reference content MREF2 is detected.

[0225] This has the consequence, as indicated above, of locking the memory device at input.

[0226] This operation is irreversible, and no further writing can take place in the memory plane of the memory device (step 124).

[0227] The integrated circuit then exhibits its locked status (step S125).

[0228] The delivery of the sensitive data DTS is then possible and it is carried out by the control logic which extracts the bits of this sensitive data and delivers them outside the memory device (step S126).

[0229] The integrated circuit can at this stage be delivered to the end user for use.

[0230] Reference is now made more particularly to [Fig. 13] to describe consequences on sensitive DTS data, resulting from fraudulent behavior.

[0231] More precisely, when the integrated circuit is in its locked status (step 130), any attempt to modify the content of the SMA memory plane or any attempt to return to the unlocked status (step S131) ​​leads to the delivery of an invalid status and / or to the at least partial destruction of the sensitive data DTS (step 132).

[0232] More precisely, if a malicious third party performs a mass erase of the SMA memory plane, in an attempt to regain the unlocked status, it de facto changes the bits of the sensitive data which had the value 0 to the value 1.

[0233] The DTS data is therefore corrupted (at least partially destroyed) which makes the DMF functional domain of the integrated circuit non-operational (non-functional).

[0234] If the malicious third party wishes to carry out, as indicated above, selective erasures of memory cells by attempting to mask other adjacent memory cells that he does not want to erase, these masked adjacent memory cells have every chance of being erased all the same by diffraction of the ultraviolet radiation used for selective erasure. Thus, for example, this will corrupt the memory cells containing the bits of the sensitive data, which are located immediately in the vicinity of the cells M3i,j that the malicious third party wishes to erase in order to reprogram.

[0235] Similarly, it will be extremely difficult, if not impossible, for a malicious third party to carry out a FIB-type attack to try to selectively program certain erased memory cells while not programming adjacent memory cells.

[0236] And, if the control logic detects a stored content of the SMA memory plane which is different from the first reference content or the second reference content, the status is then declared invalid and an anomaly is reported (step S133).

[0237] In response to this anomaly signal, no data is output from the memory device and the integrated circuit may also perform other protective actions, such as completely blocking the microcontroller.

[0238] [Fig. 14] schematically illustrates a use of the memory device at the end user when the integrated circuit IC is in operation (step S140).

[0239] Before any operation intended to use the sensitive data DTS, by the appropriate means of the integrated circuit, for example the encryption / decryption means MCR, the control logic LGC carries out a detection S141 of the content of the memory plane SMA.

[0240] If the second reference content MREF2 is detected in step S142, then the locked status is confirmed and the delivery of the DTS output in step S145 by the control logic LGC is possible and the encryption / decryption key HUK can be generated in step S146.

[0241] If, on the other hand, in step S142, the second reference content MREF is not detected, then an anomaly is detected and the memory device is again blocked and the sensitive data DTS is not delivered (step 144).

Claims

Claims

1. Integrated circuit, comprising a memory device (DM) comprising a memory plane (SMA) having non-volatile memory cells and being unobservable in reading from outside the memory device, control means (MCM), internal to the memory device, configured to detect the stored content of the memory plane, and when the stored content contains a so-called locking content (MREF2), lock any access to the memory plane from outside the memory device, the integrated circuit then being in a so-called locked status, and authorize delivery outside the memory device of at least one so-called sensitive data item (DTS) stored in the memory plane.

2. Integrated circuit according to claim 1, in which the memory device (DM) comprises an interface (IF1) configured to receive data to be written in the memory plane, and processing means (MT) configured to, when the memory plane contains a particular content (MREF1) corresponding to a so-called unlocked status of the integrated circuit, store in the memory plane via the interface, said locking content (MREF2) corresponding to the locked status of the integrated circuit and said at least one so-called sensitive data item, the control means (MCM) being configured to, when the stored content contains the locking content, prohibit any access to the memory plane via said interface and authorize delivery of said at least one sensitive data item (DTS) outside the memory device.

3. Integrated circuit according to claim 1 or 2, comprising at least one functional domain (DMF), said at least one so-called sensitive data contributing to ensuring the functionality of the functional domain.

4. Integrated circuit according to claim 2 or 3, in which the respective mappings of the particular content (MREF1) and the locking content (MREF2), the location of said at least one sensitive data item in the memory plane as well as the structural characteristics of the memory plane are such that when the integrated circuit is in its locked status, an attempt to modify the content stored in the memory plane places the circuit in a so-called invalid status prohibiting the delivery of said at least one sensitive data item outside the memory device and / or destroys at least a part of said at least one stored sensitive data item.

5. Integrated circuit according to one of the preceding claims taken in combination with claim 2, in which the control means (MCM) are configured to detect the content stored in the memory plane and signal an anomaly if the stored content is different from the particular content or the locking content.

6. Integrated circuit according to one of the preceding claims taken in combination with claim 2, in which the particular content comprises a first reference content (MREF1) being at least part of the content of the memory plane obtained at the end of the manufacture of the integrated circuit.

7. Integrated circuit according to claim 6, in which the particular content belongs to the group formed by the first reference content (MREF1) and by at least one first test content intended to be used to test the memory plane before the storage of the locking content.

8. Circuit according to one of the preceding claims, in which the control means comprise locking means (MVR) configured to, in the presence of a control signal, lock access to the memory in writing, and a control block configured to detect the content stored in the memory plane, and to when the locking content is detected, deliver the control signal to the locking means and authorize the delivery of said at least one sensitive data item outside the memory device.

9. Circuit according to claims 5 and 8, wherein the control block (BLC) is configured to signal said anomaly if the stored content is different from the particular content or the locking content.

10. Circuit according to one of the preceding claims, in which the memory plane (SMA) is erasable by block of memory cells.

11. Integrated circuit according to one of the preceding claims, in which the surface size of each memory cell (Mi,j) is less than a limit size.

12. Integrated circuit according to one of the preceding claims, in which each memory cell (Mi,j) is configured to have a first state corresponding to a first logical value of a bit stored in this memory cell and a second state corresponding to a second logical value of the bit stored in this memory cell, in which said at least one sensitive data item comprises at least one bit and the memory plane comprises a first zone (ZM1) containing one or more first memory cells configured to store respectively the bit(s) of said at least one sensitive data item, a second zone (ZM2) and a third zone (ZM3), and in which in the locked status, the first zone contains said at least one sensitive data item, the memory cells of the second zone are in their first state and the memory cells of the third zone are in their second state, the logical values ​​of the bits of the memory cells of the second zone and of the third zone forming the locking content.

13. Integrated circuit according to claim 12, in which the first state corresponds to the erased state of the memory cell (Mi,j), the bit stored in this memory cell in the erased state having the logic value 1, and the second state corresponds to the programmed state of the memory cell (Mi,j), the bit stored in this memory cell in the programmed state having the logic value 0.

14. Integrated circuit according to claim 12 or 13 taken in combination with claim 6 or 7, wherein in the unlocked status, said at least one sensitive data item (DTS) is not stored in the first zone (ZM1) and the third zone comprises a number, greater than a threshold, of memory cells of the third zone being in their first state, the logic values ​​of these memory cells in their first state forming the first reference content.

15. Integrated circuit according to claim 14, in which the threshold is equal to 90% of the number of memory cells (M3i,j) of the third zone.

16. Integrated circuit according to one of claims 12 to 15, in which the number of first memory cells (Mli,j) is less than the number of memory cells of the third zone and the first memory cells are dispersed within the memory plane.

17. Integrated circuit according to claim 16, in which the number of first memory cells (Mli,j) is less than 15% of the number of memory cells of the memory plane.

18. Integrated circuit according to one of claims 12 to 17, in which the number of memory cells (M2i,j) of the second zone is less than the number of memory cells of the third zone and the memory cells of the second zone are dispersed within the memory plane.

19. Integrated circuit according to claim 18, in which the number of memory cells (M2i,j) of the second zone is less than 15% of the number of memory cells in the memory plane.

20. An integrated circuit according to one of the preceding claims taken in combination with claim 7, wherein said at least one test content comprises logical "0"s and logical "1"s together forming a checkerboard.

21. Integrated circuit according to one of the preceding claims taken in combination with claims 2 and 12, in which, to store the locking content and said at least one sensitive data item in the memory plane, the processing means (MT) are configured to place all the memory cells of the memory plane in their first state, then to store said at least one sensitive data item in the first memory cell(s), then place all the memory cells of the third zone in their second state.

22. Integrated circuit according to claim 21, further comprising a temporary memory (MMT) configured to store said at least one sensitive data item when the integrated circuit is in its unlocked status, and the processing means are configured to copy said at least one sensitive data item into the first memory cell(s) and to erase the temporary memory.

23. Integrated circuit according to one of the preceding claims, in which the memory cells (Mi,j) are memory cells each having a floating gate, a control gate and a selection transistor buried in a substrate.

24. Integrated circuit according to one of the preceding claims, forming a microcontroller.

25. Method for protecting an integrated circuit, comprising -a) equipping the integrated circuit (IC) with a memory device (DM) comprising a memory plane (SMA) having non-volatile memory cells and not observable in reading from outside the memory device, -b) having the memory device itself detect the stored content of the memory plane, and when the stored content contains locking content, -c) having the memory device itself lock any access to the memory plane from outside the memory device, the integrated circuit then being in a locked status, and having the memory device itself authorize delivery outside the memory device of at least one so-called sensitive data item (DTS) stored in the memory plane.

26. Method according to claim 25, in which the memory device comprises an interface, step b) further comprises: when the memory plane contains a particular content (MREF1) corresponding to a so-called unlocked status of the integrated circuit, storing in the memory plane via the interface, the locking content (MREF2) and said at least one sensitive data item, and step c) comprises having the memory device prohibit any access to the memory plane via said interface and having the memory device itself authorize the delivery of said at least one sensitive data item (DTS) outside the memory device.

27. ​​A method according to claim 25 or 26, wherein step a) is performed during the manufacture of the integrated circuit, and steps b) and c) are performed after the manufacture of the integrated circuit (IC) and before delivery of the integrated circuit to a user.

28. Method according to one of claims 25 to 27, comprising after delivery of the integrated circuit to the user, during operation of the integrated circuit, before any operation carried out by the integrated circuit requiring at least one use of said at least one sensitive data item (DTS), a detection by the memory device of the stored content of the memory plane, and if the stored content contains the locking content (MREF2), a delivery by the memory device of said at least one sensitive data item outside the memory device.

29. Method according to one of claims 25 to 28, wherein when the integrated circuit is in its locked status, an attempt to modify the content stored in the memory plane places the circuit in a so-called invalid status prohibiting the delivery of said at least one sensitive data item (DTS) outside the memory device and / or destroys at least part of said at least one stored sensitive data item (DTS).

30. Method according to one of claims 25 to 29, in which the integrated circuit comprises at least one functional domain (DMF), said at least one so-called sensitive data contributing to ensuring the functionality of the functional domain.

31. A method according to one of claims 25 to 30 taken in combination with claim 26, wherein the memory device signals an anomaly if the stored content is different from the particular content (MREF1) or lock content (MREF2).

32. Method according to one of claims 25 to 31 taken in combination with claim 26, in which the particular content comprises a first reference content (MREF1) being at least part of the content of the memory plane obtained following the manufacture of the integrated circuit.

33. Method according to claim 32, wherein the particular content belongs to the group formed by the first reference content (MREF1) and at least one first test content, and step b) further comprises a memory plane test with said at least one first test content.

34. Method according to one of claims 25 to 33 taken in combination with claim 26, wherein in the unlocked status, said at least one sensitive data item is stored in a temporary memory separate from the memory plane, and the storage of the locking content comprises an erasure of all the memory cells (Mi,j) of the memory plane, then a storage of said at least one sensitive data item in the memory plane and a writing of the locking content in the memory plane and an erasure of the temporary memory.

Images