Method for managing a sensitive data area in FLASH memory

Abstract

Method for managing a sensitive data area in FLASH memory The present description relates to a method comprising: modifying or deleting one or more data values ​​from a non-volatile memory (104), one or more data values ​​being stored in a first sector (120, 122) of the memory, the first sector being designated as the current sector by one or more selection values ​​(SLT1, SLT2) stored in the non-volatile memory, the modification or deletion comprising: - writing one or more data values ​​into a second sector (122, 120) of the non-volatile memory, the second sector being designated as the alternative sector by one or more selection values. Figure for abstract: Fig. 1

Description

Title of the invention: Method for managing a sensitive data area in FLASH memory Technical field

[0001] The present description relates generally to the field of FLASH type memories. Prior art

[0002] Programmable non-volatile memory, such as electrically erasable programmable memory (EEPROM), allows certain data, such as encryption keys or configuration parameters, to be stored in electronic devices even when the electronic devices are powered off. However, given the technology used to implement an EEPROM, it generally cannot be integrated on-chip. External (off-chip) implementations of EEPROM then result in increased area, power consumption and costs.

[0003] A FLASH type memory can be implemented on chip. However, FLASH memory has certain access constraints. For example, unlike an EEPROM, it is not possible to individually overwrite or modify data values ​​in a FLASH memory. Therefore, there are technical problems associated with using an on-chip FLASH memory to implement memory storage similar to that offered by an EEPROM. Summary of the invention

[0004] There is a need to improve access and manipulation of sensitive data from FLASH memory.

[0005] One embodiment overcomes all or part of the drawbacks of known FLASH memories.

[0006] One embodiment provides a method comprising: modifying or deleting one or more data values ​​from a non-volatile memory, the one or more data values ​​being stored in a first sector of the memory, the first sector being designated as the current sector by one or more selection values ​​stored in the non-volatile memory, the modification or deletion comprising: - writing one or more data values ​​into a second sector of the non-volatile memory, the second sector being designated as an alternate sector by one or more selection values.

[0007] According to one embodiment, the modification or deletion comprises the modi- fixing a first data value stored in a first location, in association with a first address, of the first sector of the memory, and writing the one or more data values ​​to the second sector comprises: - writing a second data value into a first location of the second sector of the non-volatile memory, the first location of the second sector being designated at least in part by the first address.

[0008] According to one embodiment, the one or more selection values ​​comprise a first selection value stored in the first sector.

[0009] According to one embodiment, the one or more selection values ​​further comprises a second selection value stored in the second sector.

[0010] According to one embodiment, the above method comprises, following a power-up of the non-volatile memory: - reading the first and second selection values; - the determination, on the basis of the first and second selection values, of the sector designated as alternative; and - if at least one data value is contained in the sector designated as the alternative sector, the alternative sector is reset.

[0011] According to one embodiment, the modification or deletion comprises a deletion of other first data values, and the first sector comprises a first address range comprising the other first data values ​​associated with a first level value as well as a second address range comprising second data values ​​associated with a second level value, the second level value being strictly greater than the first level value and in which the deletion comprises: - generation of the second level value by a monotonic counter; - writing the second data values ​​in association with the first count value in the second sector; - writing a second selection value (SLT2) into the second sector, making the first sector alternative and the second sector current; and - resetting the first sector.

[0012] According to one embodiment, the above method further comprises: - writing a second selection value into the second sector, making the first sector alternate and the second sector current; and - resetting the first sector.

[0013] According to one embodiment, the above method further comprises, before writing the second selection value in the second sector: - writing one or more other data values, stored in the first sector, into the second sector.

[0014] According to one embodiment, the above method further comprises, following the writing of said one or more other data values ​​in the second sector, the modification or deletion of one or more of the values ​​stored in the second sector and, the writing of a third selection value, different from the first and second selection values, in the first sector, making the first sector current and the second sector alternative.

[0015] According to one embodiment, each of the first, second and third selection values ​​have at least the values ​​of two bits different from the other selection values.

[0016] According to one embodiment, the above method further comprises: - reading the state of a bit stored in a register; and - writing one or more data values ​​in the current sector when the bit is in a first state, or writing one or more data values ​​in the alternate sector when the bit is in a second state.

[0017] According to one embodiment, the non-volatile memory (104) is a FLASH type memory.

[0018] One embodiment provides a device comprising: - a non-volatile memory comprising one or more data values, stored in a first sector of the memory, the memory further comprising a second sector as well as one or more selection values ​​designating the first sector as the current sector and designating the second sector as the alternative sector; and - an access controller configured to modify or delete one or more data values ​​by writing one or more other data values ​​into the second sector of the non-volatile memory.

[0019] According to one embodiment, the access controller is configured to modify a first data value stored in a first location of the first sector of the memory, in association with a first address, is modified by writing a second data value in a first location of the second sector of the non-volatile memory, the first location of the second sector being designated at least in part by the first address.

[0020] According to one embodiment, the above device further comprises a monotonic counter configured to generate a level value, and wherein the first sector comprises a first address range comprising other first data values ​​associated with a first level value, as well as a second address range comprising second data values ​​associated with a second level value, the second level value being strictly greater than the first level value, the access controller being configured to delete the one or more other first data values, the deletion comprising: - writing the second data values ​​in association with the first count value in the second sector; - writing a second selection value, making the first sector alternative and the second sector current; and - resetting the first sector. Brief description of the drawings

[0021] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0022] [Fig.l] represents, very schematically and in the form of blocks, an electronic device according to an embodiment of the present description;

[0023] [Fig.2] illustrates, schematically and in the form of blocks, the content of a FLASH memory of the electronic device of [Fig.l] according to an embodiment of the present description;

[0024] [Fig.3] is a flowchart representing operations of a method of writing to a FLASH memory according to an exemplary embodiment of the present description;

[0025] [Fig.4] schematically illustrates the content of the sectors of a FLASH memory when carrying out a data modification process;

[0026] [Fig.5] is a flowchart representing operations of a sector exchange method according to an exemplary embodiment of the present description;

[0027] [Fig.6] schematically illustrates the content of the sectors of the FLASH memory when carrying out a method of deleting one or more data;

[0028] [Fig.7] is a flowchart representing operations of a sector exchange method according to an exemplary embodiment of the present description;

[0029] [Fig.8] illustrates, schematically and in block form, an example of embodiment of a FLASH memory according to an embodiment of the present description;

[0030] [Fig.9] schematically illustrates a function for controlling access to a FLASH memory according to an embodiment of the present description; and

[0031] [Fig. 10] is a flowchart representing operations following the powering up of the FLASH memory according to an exemplary embodiment of the present description. Description of the embodiments

[0032] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0033] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed. In particular, the design of processing devices is well known to those skilled in the art and certain elements have not been detailed in the description which follows.

[0034] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0035] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0036] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0037] [Fig.l] represents very schematically and in the form of blocks, an electronic device 100 comprising an integrated circuit 102 according to an embodiment of the present description.

[0038] The electronic device 100 is for example an electronic card such as a microcircuit card, computer hardware, a microprocessor circuit, etc.

[0039] The integrated circuit 102 comprises, for example, a non-volatile memory 104 (NV MEM) of the FLASH type. The memory 104 is connected to an access controller 106 (ACCESS CTRL) implemented, for example, by a hardware circuit, or at least partially by a software implementation. The access controller 106 is, for example, connected to a bus 108, the bus 108 comprising, for example, a data bus.

[0040] The integrated circuit 102 further comprises, for example, a monotonic counter 110 (MONOTONIC COUNTER) configured to generate count values. In addition, in some embodiments, the integrated circuit 102 also comprises a processor 112 (CPU), and / or a volatile memory 114 (RAM). The volatile memory 114 is, for example, a volatile random access memory (Random Access Memory). The monotonic counter 110, the processor 112 and the volatile memory 114 are for example connected to the access controller 106 via the bus 108.

[0041] The access controller 106 comprises for example a volatile register 116 (REGISTER) and a volatile or non-volatile register 118 (ALT_SECT). The access controller 106 is for example configured to receive a generated TIL level value by the monotonic counter 110. In some cases, the access controller 106 is also configured to receive a TZ signal and / or a SEC / NSEC signal. The SEC / NSEC signal is for example a signal indicating an operation of the integrated circuit 102 in a secure (SEC) or non-secure (NSEC) mode. The TZ signal is for example a signal indicating an operation of the integrated circuit 102 in a secure mode with a trust zone (in English "Trust Zone"). The TZ and SEC / NSEC signals are for example transmitted by a circuit for configuring the boot and security of the integrated circuit 102 (in English "System configuration, Boot and Security"), this configuration circuit not being shown in [Fig. 1].

[0042] According to an embodiment of the present description, the non-volatile memory 104 comprises a first sector 120 (SECT1) and a second sector 122 (SECT2). The memory further comprises an area 124 (CODE / DATA) containing for example codes, such as startup codes and / or application codes, and / or data.

[0043] In the applications covered by the present description and in usual operating mode, only one of the two sectors contains data and this sector is designated as being a current sector of the non-volatile memory 104, the other sector being designated as being an alternative sector. The use of the two sectors 120 and 122 makes it possible to modify or delete, individually, a value of a data item stored in the current sector. To do this, data values ​​are written in the alternative sector, then the roles of the sectors are for example reversed, the alternative sector becoming the current sector, and the current sector becoming the alternative sector.

[0044] According to one embodiment, sector 120 comprises a location 126 and sector 122 comprises a location 128. The two locations 126 and 128 are reserved for storing one or more selection values ​​SLT1, SLT2. Following a power-up of the non-volatile memory 104, the contents of locations 126 and 128 are read and the selection values ​​SLT1, SLT2 make it possible to identify which of the sectors 120 and 122 is the current sector, and which of the sectors 120 and 122 is the alternative sector. In one example, each selection value SLT1, SLT2 can be either unprogrammed, i.e. the location is blank, or programmed with one of three counting values ​​which will be designated 0, 1 and 2.

[0045] According to one embodiment, a rule is established between the counting values ​​0, 1 and 2 making it possible to decide which is the current sector and which is the alternative sector when the two locations 126 and 128 are not empty. For example, when the programmed selection values ​​are the values ​​0 and 1, the sector containing the selection value 1 is the current sector. When the programmed selection values ​​are the values ​​1 and 2, the sector containing the selection value 2 is the current sector. When the programmed selection values ​​are the values ​​2 and 0, the sector containing the selection value 0 is the current sector.

[0046] According to one embodiment, when the location of one sector is blank and the location of the other sector is non-blank, it is the sector comprising the non-blank location which is designated as being the current sector.

[0047] According to one example, the selection values ​​are values, expressed in hexadecimal digits, 51, 8A and B4. The values ​​51, 8A and B4 are presented solely as examples and other values ​​are of course conceivable. Furthermore, as is the case for the values ​​51, 8A and B4, in certain embodiments, each of the selection values ​​has at least 2-bit values ​​different from the other two selection values.

[0048] When the current sector is identified, an indication of the current sector is then stored in register 116. The indication takes the form, for example, of a bit or an address complement.

[0049] According to one embodiment, locations 126 and 128 are not accessible by software. The contents of locations 126 and 128 cannot therefore be easily falsified.

[0050] According to one embodiment, a bit stored in the register 118 is modifiable by the processor 112, allowing software executed by the processor 112 to indicate in which of the current and alternating sectors a data value will be written. For example, when the bit is in the state 0, this indicates that the current sector is selected for writing, and when the bit is equal to 1, this indicates that the alternating sector is selected for writing.

[0051] [Fig.2] illustrates, schematically and in the form of blocks, the contents of the memory 104 according to an embodiment of the present description.

[0052] By way of example, the memory 104 comprises, in the zone 124, data and codes 200 (DATA / USER CODES) and codes 202 (CODES). The codes among the data and codes 200 are for example codes configurable by a user of the circuit 102 in order to adapt it to his needs for the device 100. The codes 200 are for example non-secure and are for example stored on memory addresses, expressed in hexadecimal values, ranging from 0x081F_FFFF to 0x0800_0000. The codes 202 are for example startup codes stored by the manufacturer of the circuit 102 and are for example stored on memory addresses, expressed in hexadecimal values, ranging from 0x0BF9_FFFF to 0x0BF8_0000.

[0053] By way of example, the FLASH memory 104 also comprises an area 204 configured to store parameters of the FLASH memory, such as security parameters 204 (USER OPTIONS), and / or an area 206 (ENGI OPTION) configured to store configuration parameters, such as configuration parameters of one or more modules, configuration parameters of the integrated circuit 102, parameters for activating or deactivating one or more security applications, parameters indicating the size of one or more areas of the memory 104, such as for example the area 204. The locations of the areas 204 and 206 are for example not part of the address areas mapped in the memory 104, that is to say they are not part of the memory space visible and accessible by the processor 112.

[0054] For example, area 124 further includes other codes or data 208.

[0055] The non-volatile memory 104 further comprises an area 210 comprising sectors 120 and 122. Sectors 120 and 122, and more particularly the current sector, contain data such as OBK (OPTION BYTES KEYS). Area 210 is for example mapped to addresses ranging from 0x0BFD_lFFF to 0x0BFD_0000. Area 210 is implemented by sectors 120 and 122 and the two sectors are then visible from the outside as a single address range.

[0056] The memory addresses are presented for illustrative purposes only and are of course not limiting. Other sizes and locations of the different zones and sectors 120 and 122 are of course conceivable.

[0057] [Fig. 3] is a flowchart representing operations of a method of writing to the memory 104 according to an exemplary embodiment of the present description. This method is for example implemented by the processor 112 and by the access controller 106.

[0058] The device 100, and in particular the memory 104, is then powered up and in a normal operating mode. The register 116 then contains the indication of the sector being current, for example sector 120.

[0059] In a step 301 (WRITE REQUEST), a request to write a data value in one of the sectors is initialized by the processor 112, the request being for example accompanied by a memory address. For example, prior to the write request, the processor 112 is configured to further program the state of the bit of the register 118 in order to indicate whether the writing is to be done in the current sector or in the alternative sector.

[0060] In a step 302 (ALT_SEC=1?), the access control circuit 106 is configured to read the contents of the register 118.

[0061] For example, if the bit contained in register 118 is in state 0 (branch N), the method continues in a series of steps 303.

[0062] The sequence of steps 303 includes a step 304 (READ IN CURRENT SECTOR) in which the processor 112 reads the data currently stored in the current sector at the memory address indicated during step 301.

[0063] In a step 305 (DATA=0?), the processor 112 determines whether the data read in step 304 is zero, in other words whether the memory location associated with the address indicated in step 301 is blank or not. In the case where the location is not blank (branch N), and consequently a data value is already stored in the location, the method continues in a step 306 (ERROR SIGNAL) in which the access controller 106 transmits for example an error signal to the processor 112. The method then ends in a step 307 (END).

[0064] If it is determined in step 305 that the memory location is empty (Y branch), the method continues in a step 308 (WRITE IN CURRENT SECTOR) of the sequence of steps 303.

[0065] In step 308, the data value is written into the current sector, and more precisely, into the location of the current sector indicated by the memory address.

[0066] If, in step 302, it is determined that the bit contained in the register 118 has the value 1 (Y branch), the method continues in a series of steps 309 similar to the series of steps 303 with the difference that the operations are carried out in the alternating sector.

[0067] Thus, the sequence of steps 309 comprises a step 310 (READ IN ALTERNATE SECTOR), a step 311 identical to step 305 and a step 312 (WRITE IN ALTERNATE SECTOR)

[0068] Following the completion of step 308 or 312, the method ends at step 307.

[0069] [Fig.4] schematically illustrates the content of sectors 120 and 122 of memory 104 when carrying out a method of modifying data.

[0070] For example, a selection value (SLT1) is stored in location 126, the selection value designating sector 120 as the current sector.

[0071] The current sector 120 comprises, for example, a number N+1, N being an integer, of keys, such as OBK keys, designated by KEY i, i being between 0 and N.

[0072] For example, the key KEY K stored in a location 400 in association with a memory address is obsolete and must be modified or updated. However, since the memory 104 is a FLASH type memory, it is not possible to modify the value of the key KEY K individually. Indeed, it is only possible to write values ​​in empty locations of the sector, or to overwrite the entire contents of the sector 120.

[0073] According to one embodiment, a new key value is then written in a location 402, associated with the same address as location 400, of the alternative sector 122. The writing of the new value in the alternative sector is for example carried out according to the method described in relation to [Fig.3].

[0074] [Fig. 5] is a flowchart representing operations of a sector exchange method. More particularly, the flowchart illustrated in [Fig. 5] represents operations carried out following a modification of data in the current sector, as described in relation to [Fig. 4]. The method of [Fig. 5] is for example implemented by the processor 112 and by the access controller 106.

[0075] As an example, a modification of the key KEY K has been carried out, as described in relation to [Fig. 4]. The current sector 120 then comprises the keys KEY 0 to KEY N, including the key KEY K stored in the location 400. The current sector 120 further comprises the selection value SLT1, stored in the location 126. The alternative sector 122 only comprises the modification of the key KEY K, stored in the location 402, the location 402 being designated by the same address as the location 400.

[0076] Following the storage of the modification of the key KEY K in the location 402, a sector exchange request is initiated in a step 501 (SWAP SECTOR REQUEST).

[0077] In a step 502 (ADDR INDEX=0), an index value, corresponding for example to an address designating a memory location, is initialized. For example, in this step, the index value corresponds to the address designating the memory location of sector 120 containing the key KEY 0.

[0078] In a step 503 (READ DATA @ADDR INDEX), the contents of the memory location of the alternative sector 122 and designated by the index value are, for example, read. The processor 112 then determines, in a step 504 (DATA=0) whether the memory location of the alternative sector associated with the index value is empty. If the location is indeed empty (Y branch) the method continues in a step 505 (COPY DATA) in which, for example, the key KEY 0 is rewritten in the location of the alternative sector 122 associated with the index value.

[0079] If, during step 504, it is determined that the memory location of the alternative sector 122 designated by the index value is not empty (branch N), the method jumps directly to a step 506 (INCREMENT ADDR INDEX).

[0080] In step 506 (INCREMENT ADDR INDEX), after step 505, or step 504 if applicable, the index value is incremented. For example, the index value then corresponds to the memory address designating the location of the key KEY 1 in the current sector 120.

[0081] The succession of steps 503 to 506 will be designated in the remainder of the description as being a sequence of steps 507.

[0082] In a step 508 (END?), it is determined, for example by comparing the index value with a limit index value, whether memory locations of the current sector 120 remain to be scanned. For example, the limit index value corresponds to the address designating the memory location of the sector 120 in which the key KEY N is stored. If there are still memory locations to be scanned (branch N), the method resumes at step 503.

[0083] For example, when, following an execution of step 506 in which the index value is incremented towards the index value designating the location memory of sector 122 in which the modification of the key KEY K was previously stored, the location will be seen as not empty when performing step 504.

[0084] In the case where it is determined, during step 508, that there are no more locations to be traversed (branch Y), the method continues in a step 509 (SWAP THEN ERASE).

[0085] For example, at this step of the method, the alternative sector 122 comprises the keys KEY 0 to KEY K-1 in memory locations 404, the modification of the key KEY K in location 402 and the keys KEY K+1 to KEY N in locations 406.

[0086] In step 509, a selection value, different from the selection value stored in location 126 of sector 120, is stored in location 128 of sector 122. For example, when the selection value SLT1 of the current sector 120 is designated by the count value 0, 1 or 2, the selection value stored in the alternative sector 122 will be 1, 2 or 0 respectively.

[0087] Following storage of the new selection value, the alternating sector 122 becomes the current sector, and the current sector 120 becomes the alternating sector. The entire alternating sector 120 is then erased. Consequently, the selection value SLT1, in location 126, is also erased.

[0088] The advantage of deleting the contents of the AC sector 120 only after the selection values ​​have been updated is that the designation of the current and AC sectors is saved. Therefore, if the electronic device 100 is turned off for any reason before or during the deletion of the AC sector 120, upon restart, a reading of the selection values ​​of locations 126 and 128 is performed and makes it possible to identify that sector 122 is the current sector.

[0089] In some cases, after the entire alternate sector has been deleted, the contents of locations 126 and 128 are then read. Because location 126 is blank, only the selection value of sector 122 is detected, meaning that sector 122 is now the current sector of memory 104. The contents of register 116 are then updated to indicate that the current sector is sector 122.

[0090] Although [Fig.5] represents an example in which the data stored in the sectors are keys, the method could be applied to any type of data.

[0091] [Fig.6] schematically illustrates the contents of sectors 120 and 122 of memory 104 when carrying out a method of deleting one or more data.

[0092] As an example and similarly to [Fig.3], the selection value (SLT1) is stored in location 126, the selection value designating sector 120 as the current sector.

[0093] The current sector 120 comprises, for example, the N+1 keys OBK, designated by KEY i, i being between 0 and N, the keys KEY 0 to KEY K being stored in locations 602 and the keys KEY K+1 to KEY N being stored in locations 604.

[0094] By way of example, the deletion of the keys KEY K+1 to KEY N is controlled, for example by the controller 106. However, the memory 104 being a FLASH type memory, it is not possible to delete the keys KEY K+1 to KEY N individually without deleting the entire sector 120 and consequently the keys KEY 0 to KEY K.

[0095] According to one embodiment, the key values ​​KEY 0 to KEY K are then rewritten in locations 606 of the alternative sector 122. The locations 606 are then designated by the same addresses as those designating the locations 602.

[0096] [Fig.7] is a flowchart representing operations of a sup process pressure of one or more data included in the memory 104, and more particularly of data included in the current sector. The method of [Fig.7] is for example implemented by the processor 112 and by the access controller 106.

[0097] By way of example, as described in relation to [Fig.6], the current sector 120 comprises the keys KEY 0 to KEY K, stored in locations 602 of the current sector and the keys KEY K+1 to KEY N stored in locations 604 of the current sector. The current sector 120 further comprises the selection value SLT1, stored in location 126. The alternative sector 122 is then empty, that is to say that all the memory locations composing it are empty.

[0098] A request to delete the keys KEY K+1 to KEY N and to exchange the sector is initiated in a step 701 (SWAP SECTOR REQUEST).

[0099] In a step 702 (K>0?), a number K+1 of data values ​​to be rewritten in the alternative sector 122 is designated. The number K+1 corresponds to a number of data from the current sector to be transferred to the alternative sector before carrying out the exchange between the current sector and the alternative sector. For example, the number of data values ​​to be rewritten corresponds to the number of keys making up the set of keys KEY 0 to KEY K, the keys KEY K+1 to KEY K being intended to be deleted. If at least one data value is to be rewritten (branch Y), the method continues in a step 703 (ADDR INDEX=0).

[0100] In step 703, an index value, corresponding for example to an address designating a memory location, is initialized. For example, in this step, the index value corresponds to the address designating the memory location of sector 120 containing the key KEY 0.

[0101] Following step 703, the method continues in the sequence of steps 507 in which the contents of the memory location of sector 120 and designated by the index value are rewritten to the memory location in sector 122 and designated by the same index value, provided that the latter is empty. For example, the value of the key KEY 0 is written to sector 122 during these steps. The index value is then incremented.

[0102] Following the steps of sequence 507, the method continues in a step 704 (ADDR INDEX=K+1) in which it is determined whether all the values ​​to be rewritten in sector 122 have been rewritten, which is for example the case if the index value is equal to K+1. If not, the method resumes at steps 507, in which, for example, the value of the key KEY 1 is written in sector 122.

[0103] If, following step 704, it is determined that all the values ​​to be rewritten have been rewritten (Y branch), the method continues in a step 705 (SWAP AND ERASE) identical to step 509 described in relation to [Fig. 5]. Step 705 also follows step 702 when it is determined that no data values ​​are to be rewritten in sector 122 (N branch).

[0104] For example, the values ​​of each of the keys KEY 0 to KEY K have been rewritten in sector 122. A selection value, different from the value SLT1, is then stored in location 128 of sector 122 and the entire sector 120 is erased. Thus, the keys KEY K+1 to KEY N are no longer stored in sectors 120 and 122, they are thus deleted from the memory 104.

[0105] The method then ends in a step 706 (END).

[0106] As in the method described in relation to [Fig.5], the advantage of deleting, in step 705, the AC sector 120 only once the selection values ​​have been updated is that the designation of the current and AC sectors is saved. Consequently, if the electronic device 100 is switched off for any reason before or during the deletion of the AC sector 120, upon restart, a reading of the selection values ​​of the locations 126 and 128 is carried out and makes it possible to identify that the sector 122 is the current sector.

[0107] Although [Fig.7] represents an example in which the data stored in the sector locations are keys, the method could be applied to any type of data.

[0108] [Fig.8] illustrates, schematically and in block form, an exemplary embodiment of the memory 104 according to an embodiment of the present description.

[0109] [Fig.8] illustrates different storage areas in sectors 120 and 122. In addition to locations 126 and 128 reserved for storing selection values, each sector 120 and 122 comprises, for example, 5 areas.

[0110] For example, sector 120 comprises zones 800 to 804 and sector 122 comprises zones 800' to 804'. Each of the zones is associated with a TIL (Temporal Isolation Level) value. For example, at each When the device 100 is started, a level value is generated by the monotonic counter 110. The level value is, for example, transmitted to the controller 106. Thus, access to a zone associated, for example, with a TIL level value lower than the level value generated by the counter 110 is prohibited by the controller 106.

[0111] For example, zones 800 and 800' (TIL 0) are associated with the level value of TIL 0 and their access is authorized only when the level value generated by the monotonic counter 110 is equal to 0. Similarly, zones 801 and 801' (TIL 1) are associated with the value of TIL 1 and are accessible for example only when the level value is equal to 1. In another example, zones 801 and 801' are accessible when the generated level value is less than or equal to 1. Similarly, zones 802 and 802' (TIL2) are associated with the value of TIL 2 and zones 803, 803' (TIL3SEC) and 804, 804' (TIL3NSEC) are associated with the value of TIL 3.

[0112] By way of example, the controller 106 is further configured to command the deletion of the content of one or more zones when the monotonic counter 110 increments the level value. By way of example, the level value is incremented from 0 to the value 1, and the content of the zone 800 or 800' associated with the TIL value 0 of the current sector is deleted according to the embodiment described in relation to FIGS. 6 and 7. Similarly, the content of the zones associated with the other TIL values ​​is for example deleted when the level value is incremented to a value being greater than the TIL value associated with said zones.

[0113] [Fig.9] schematically illustrates a function for controlling access to the memory 104, and in particular to the current sector of the memory 104.

[0114] For example, the access control function is implemented by the access controller 106.

[0115] As an example, we consider the case where the current sector is sector 120. Sector 120 comprises for example the 5 zones 800 to 804 described in relation to [Fig.8].

[0116] The access controller 106 is then configured to receive the level value (TIL) generated by the monotonic counter 110. As an example, the access controller 106 is further configured to prohibit access to one or more zones among the zones 800 to 804 on the basis of the received TIL level value. As an example, the access controller 106 is configured to prohibit any access to zones being associated with a TIL value strictly lower than the received level value. In another example, the access controller 106 is configured to prohibit any access to zones being associated with a TIL level value different from the received TIL level value.

[0117] As an example, the access controller 106 is further configured to receive the SEC / NSEC signal, indicating operation of the integrated circuit 102 in a secure (SEC) or non-secure (NSEC) mode. As an example, the access controller 106 is configured to allow access to zone 804 and deny access to zone 803 when circuit 102 is in unsecured mode.

[0118] By way of example, the access controller 106 is further configured to receive the signal TZ, being for example a signal indicating an operation of the integrated circuit 102 in a secure mode with a trusted domain. By way of example, the access controller 106 is configured to authorize access to all the zones 800 to 804 when the signal TZ is received, even when the level value generated by the monotonic counter 110 does not allow it.

[0119] [Fig. 10] is a flowchart showing operations following the energization of circuit 102.

[0120] The device is powered up in a step 1001 (BOOTING). Following step 1001, the contents of locations 126 and 128 are read, for example by the processor 112, in a step 1002 (LECTURE OF SELECTORS).

[0121] Following step 1002, the method continues in a step 1003 (VALUES IN BOTH SELECTORS?), in which it is determined whether the two locations 126 and 128 comprise a selection value, i.e., whether one or the other of the two locations 126 and 128 is not blank. In the case where only one of the two locations comprises a selection value (branch N), (for example, the value SLT2 in location 128, location 126 being blank), the method continues in a step 1004 (DETERMINATION OF CURRENT SECTOR AND UPDATE REGISTER). In step 1004, the sector whose location contains a selection value, for example, sector 122, is determined to be the current sector. In addition, the indication contained in register 116 is updated in step 1004.

[0122] The method then ends in a step 1005 (END).

[0123] If, during step 1003, a selection value is read in each of the em locations 126 and 128 (Y branch), i.e. neither location 126 nor location 128 are empty, the method continues in a step 1006 (DETERMINATION OF CURRENT SECTOR AND UPDATE REGISTER).

[0124] When the two locations 126 and 128 each contain a selection value following a power-up of the memory 104, this means that the memory 104 has been switched off during a performance of step 509, or during a performance of step 705. Indeed, in this case, following the modification or deletion of one or more data of the current sector, a new selection value is stored in the location of the alternating sector before the complete erasure of the alternating sector. If, for any reason, the memory 104 is no longer powered after the storage of the new selection value but before the erasure of the current sector, the two values ​​SLT1 and SLT2 are stored in the locations 126 and 128.

[0125] In step 1006, a rule is applied to determine which sector is the current sector. As an example, the rule applied is that described in relation to [Fig.l].

[0126] By way of example, during an implementation of step 509 of the method of [Fig.5] or during an implementation of step 705 of the method of [Fig.7], the selection value of the alternating sector 122 is programmed with the counting value, corresponding to the counting value programming the selection value of the current sector. For example, if the count value programming the selection value of current sector 120 is the value 0, the new value, stored in location 128 of alternative sector 122, will be programmed with the value 1. Similarly, the new selection value will be programmed with the value 2 if the value of current sector 120 is programmed with the value 1. The new selection value will be programmed with the value 0 if the selection value of current sector 120 is programmed with the value 2. When reading the selection values, sector 122 will then be designated as the current sector.

[0127] Once the current sector is determined, the indication of the current sector contained in register 116 is updated.

[0128] The old data values, for example the keys KEY 0 to KEY N, being still stored in the sector then designated as alternative, this sector is reinitialized in a step 1007 (REINITIALIZATION OF ALTERNATE SECTOR). The contents of the alternative sector, for example sector 120, are for example completely erased. Consequently, the alternative sector no longer contains a selection value.

[0129] The method then ends in step 1005.

[0130] An advantage of the described embodiments is that they allow the contents of a FLASH type memory to be modified or partially deleted.

[0131] Another advantage of the described embodiments is that it is possible, via software, to choose in which sector, current or alternating, to write one or more data values.

[0132] Another advantage of the described embodiments is that access to the memory 104, and in particular to different areas included in the sectors 120 and 122, is controlled by the incrementation of the monotonic counter 110, which improves data security.

[0133] Another advantage of the described embodiments is that the contents of locations 126 and 128 for determining which sector is the current sector are only accessible by hardware circuitry.

[0134] Another advantage of the described embodiments is that an indication of which sector is the current sector is loaded into a register 116 of the circuit each time the memory 104 is powered up and following a reading of the contents of the locations 126 and 128.

[0135] Various embodiments and variants have been described. The person skilled in the art will understand that certain features of these various embodiments and variants could be combined, and other variants will occur to the person skilled in the art. In particular, the choice of the values ​​that the selection values ​​can take is within the ability of the person skilled in the art. Similarly, the choice of the rule for determining, from the selection values, which is the current sector and which is the alternative sector is within the ability of the person skilled in the art.

[0136] Finally, the practical implementation of the embodiments and variants described is within the reach of the person skilled in the art from the functional indications given above. In particular, with regard to the implementation of the access controller.

Claims

Claims

1. A method comprising: modifying or deleting one or more data values ​​of a non-volatile memory (104), the one or more data values ​​being stored in a first sector (120, 122) of the memory, the first sector being designated as the current sector by one or more selection values ​​(SLT1, SLT2) stored in the non-volatile memory, the modification or deletion comprising: - writing one or more data values ​​(KEY 0, KEY Kl, KEY K, KEY K+l, KEY N), stored in the first sector (120), into a second sector (122, 120) of the non-volatile memory, the second sector being designated as the alternative sector by the one or more selection values.

2. A method according to any one of claims 1, wherein the modification or deletion comprises modifying a first data value (KEY K) stored in a first location (400), in association with a first address, of the first sector (120) of the memory, and writing the one or more data values ​​in the second sector (122) comprises: - writing a second data value in a first location (402) of the second sector of the non-volatile memory, the first location of the second sector being designated at least in part by the first address.

3. The method of claim 1 or 2, wherein the one or more selection values ​​(SLT1, SLT2) comprises a first selection value (SLT1) stored in the first sector (120).

4. The method of claim 3 wherein the one or more selection values ​​(SLT1, SLT2) further comprises a second selection value (SLT2) stored in the second sector (122).

5. A method according to claim 4, comprising, following a power-up of the non-volatile memory (104): - reading the first and second selection values ​​(SLT1, SLT2); - determining, on the basis of the first and second selection values, the sector (120, 122) designated as alternative; and - if at least one data value is contained in the sector designated as alternative sector, resetting the alternative sector.

6. A method according to any one of claims 1 to 5, wherein the modification or deletion comprises a deletion of other first data values ​​(KEY K+1, KEY N), and the first sector (120) comprises a first address range (604, 800, 801, 802) comprising the other first data values ​​associated with a first level value (TIL) as well as a second address range (602, 801, 802, 803, 804) comprising second data values ​​(KEY 0, KEY K) associated with a second level value, the second level value being strictly greater than the first level value and wherein the deletion comprises: - generating the second level value by a monotonic counter (110); - writing the second data values ​​in association with the first counting value in the second sector (122);- writing a second selection value (SLT2) to the second sector, making the first sector alternate and the second sector current; and - resetting the first sector.;

7. The method of claim 1 or 2, further comprising: - writing a second selection value (SLT2) into the second sector (122), making the first sector (120) alternative and the second sector current; and - resetting the first sector.

8. A method according to any one of claims 1 to 7, further comprising, following the writing of said one or more other data values ​​(KEY 0, KEY Kl, KEY K, KEY K+l, KEY N) in the second sector (122), modifying or deleting one or more of the values ​​stored in the second sector and, writing a third selection value, different from the first and second selection values ​​(SLT1, SLT2), in the first sector (120), making the first sector current and the second sector alternative.

9. The method of claim 8, wherein each of the first, second, and third selection values ​​has at least two bit values ​​different from the other selection values.

10. A method according to any one of claims 1 to 9, further comprising: - reading the state of a bit stored in a register (116); and - writing one or more data values ​​into the current sector (120, 122) when the bit is in a first state, or writing one or more data values ​​to the alternating sector (122, 120) when the bit is in a second state.

11. A method according to any one of claims 1 to 10, wherein the non-volatile memory (104) is a FLASH type memory.

12. Device comprising: - a non-volatile memory (100) comprising one or more data values, stored in a first sector (120, 122) of the memory, the memory further comprising a second sector (122, 120) as well as one or more selection values ​​(SLT1, SLT2) designating the first sector as the current sector and designating the second sector as the alternative sector; and - an access controller (106) configured to modify or delete the one or more data values ​​by writing one or more other data values ​​(KEY 0, KEY Kl, KEY K, KEY K+l, KEY N), stored in the first sector (120), into the second sector of the non-volatile memory.

13. The device of claim 12 wherein the access controller (106) is configured to modify a first data value (KEY K) stored in a first location (400) of the first sector of the memory, in association with a first address, is modified by writing a second data value in a first location (402) of the second sector of the non-volatile memory, the first location of the second sector being designated at least in part by the first address.

14. The device of claim 12 or 13, further comprising a monotonic counter (110) configured to generate a level value (TIL), and wherein the first sector (120, 122) comprises a first address range (604, 800, 801, 802) comprising other first data values ​​associated with a first level value, and a second address range comprising second data values ​​(602, 801, 802, 803, 804) associated with a second level value, the second level value being strictly greater than the first level value, the access controller (106) being configured to delete the one or more other first data values, the deletion comprising: - writing the second data values ​​in association with the first count value in the second sector (122, 120); - writing a second selection value (SLT2, SLT1), making the first sector alternative and the second sector current; and - resetting the first sector.

Images