Method for managing the memory of a secure element

Abstract

As data is written to memory pages of non-volatile memory in a secure element, these pages wear down until they reach their endurance capacity. When no more healthy space (data memory page) remains available in memory to move the contents of a worn memory page, the non-volatile memory is no longer reliable and is considered to be at the end of its life. To extend the life of the secure element and thus reduce its environmental impact, it is proposed to use memory pages storing the operating system as replacement pages for worn data memory pages. An overall wear rate can be determined for a block of memory pages that includes the worn page, and when this rate reaches a threshold, the contents of the block can be swapped with the operating system. Alternatively, the move can be performed incrementally, by swapping a sub-section of the operating system with a block of memory pages that is generally worn. [Fig. 4]

Description

Title of the invention: Method for managing the memory of a secure element

[0001] The present invention relates to the field of memory management, in particular the management of non-volatile memory of a secure element.

[0002] The secure elements traditionally used for authentication on mobile telephone networks include UICC (Universal Integrated Circuit Card) universal integrated circuit cards, in particular SIM (Subscriber Identity Module) cards. Each card includes, in addition to an operating system (OS), data, in this case subscription data, for example an IMSI (International Mobile Subscriber Identity) identifier, cryptographic keys, and algorithms (or applications, programs, or software) specific to a subscription provided by a mobile telephone operator.

[0003] The operating system is intended to control the use of the card's hardware resources by the installed applications.

[0004] eUICC cards (for “embedded UICC” - or embedded UICC) have also emerged, as defined by the GSMA group (for “Global System for Mobile Communications Association”), notably in the GSMA standard SGP.02 v3.2 entitled “Remote Provisioning Architecture for Embedded UICC - Technical Specification - Version 4.0” dated February 25, 2019.

[0005] eUICC cards are reprogrammable and allow multiple subscriber profiles (or communication profiles) to be loaded onto the same eUICC card, as well as one or more of these subscriber profiles to be updated and / or deleted. These subscriber profiles may include applications and customized data. They are typically stored in the card's rewritable non-volatile memory. In the following text, the term "stored" is to be understood as "recorded." To add a new subscriber profile, modify an existing subscriber profile, or launch an application from an existing subscriber profile, it is necessary to erase and / or write data to the rewritable non-volatile memory of the secure element (eUICC or other).

[0006] While operating systems have traditionally been stored in read-only memory (ROM) due to the immutable nature of the OS, they are now stored in rewritable non-volatile memory within secure elements. This allows for certain OS updates and also enables the incorporation of a single type of non-volatile memory within these secure elements.

[0007] Also, in general, the rewritable non-volatile memory of a secure element is generally composed of a plurality of memory blocks, each memory block comprising a set of memory pages that can be erased and / or (re)written.

[0008] A rewritable non-volatile memory area, called the OS area, is formed by all the memory pages storing the operating system. The rest of the memory is generally a Data area, formed by all the memory pages for storing data (therefore outside the operating system).

[0009] In what follows, a "memory page" refers to the smallest unit of memory for data erasure (i.e., data erasure can only occur on one or more complete pages, and not on a portion of a page). Writing (or "programming"), on the other hand, can only be performed on a portion of a page. It should be noted that the vocabulary used to designate these elements may vary from one type of memory to another or depending on the memory card manufacturer. For example, the term "sector" is sometimes used to designate the smallest unit of memory for data erasure. A person skilled in the art will, of course, have no difficulty applying the following teachings to secure elements supplied by manufacturers using terminology other than that used here.

[0010] Each page of a rewritable non-volatile memory has a certain endurance capacity (or simply "endurance"), which corresponds to the maximum number of times the memory page can be erased and (re)written. Once this maximum number is reached, the memory page is "worn out" and may no longer be able to retrieve, for reading, the data previously written to it and / or to allow data (re)writing and / or to allow data (re)erasure. The endurance capacity can vary from one page to another. When all the memory pages are worn out, the correct operation of the memory is no longer guaranteed. The "overall" endurance capacity (i.e., taking into account all the memory pages) varies considerably depending on the type of rewritable non-volatile memory (flash, EEPROM - from the English "Electrically Erasable Programmable Read Only Memory", etc.).It can range from a few thousand write and erase cycles for some rewritable non-volatile memories to several hundred thousand cycles for others.

[0011] Some operations require more erases and writes than others, and thus "wear out" more memory. For example, downloading a new subscriber profile generally requires more erases and writes than using or updating an application already installed on an existing subscriber profile. If such operations are performed when the memory has reached an excessively worn state, it It is possible that some or all of the erase / write operations may not be performed on the memory. This can lead to failures in the use of the secure element, or even a complete interruption of its operation.

[0012] French patent FR 2 977 047 B1 proposes a method for efficiently managing the writing and erasure of data in non-volatile memory, depending on its wear state. In particular, it allows a worn working memory sector to be replaced by a replacement memory sector available in a reserve of memory sectors.

[0013] This theoretically allows for maximum utilization of the entire memory area dedicated to data storage. However, these solutions are not optimal when the goal is to maximize the lifespan of the memory in a secure element. The present invention improves this situation. Description of the invention

[0014] The inventor observed that existing techniques disregarded the memory area dedicated to the OS, which, due to the limited or non-upgradable nature of the operating system, was only minimally worn at the end of the secure element's life. Therefore, the invention proposes to exploit this indirect reserve of healthy memory pages as new memory pages for storing data previously stored on a worn memory page, for example, by simply swapping the contents of the memory pages.

[0015] The OS is then transferred, in whole or in part, to worn-out memory pages, which is not detrimental to it, due to the relatively static, or even non-scalable, nature of the operating system (therefore, few new write cycles will occur). On the other hand, the moved data can again be subjected to numerous rewrite cycles.

[0016] To this end, the invention proposes a method for managing rewritable non-volatile memory in a secure element, the memory comprising a first area formed of memory pages, called OS memory pages, storing an operating system, OS, and a second area formed of memory pages, called data memory pages, for storing data, the method comprising the following steps: - determine if at least one first page of data memory is worn, and - if yes, move the contents of the first worn data memory page to an OS memory page while simultaneously moving the contents of that OS memory page to a worn data memory page.

[0017] By "OS memory pages," we mean all the pages or sectors of memory that initially store the compiled OS code. By "memory pages of "Data" refers to all memory pages or sectors intended for storing data other than the compiled OS code, whether or not they contain content (i.e., data). This can include applications or software running within the OS environment (e.g., compiled code for applications or software), but also data (profiles, program data, application data, files, etc.) generated or obtained during the use of the secure element.

[0018] OS memory pages and data memory pages can initially form two dissociated partitions within physical memory.

[0019] By "worn memory page" is meant a memory page which has already undergone a significant number of erase / write cycles approaching a state of excessive wear where further cycles are likely to be performed incorrectly.

[0020] According to the invention, it is therefore possible to perform write cycles again for the displaced data, now stored in the memory pages initially used for the OS, which statistically have a less worn state. In this way, the lifespan of the secure element is extended, reducing its environmental impact and consequently contributing to sustainable development and resource conservation.

[0021] Optional features of embodiments of the invention are defined in the appended claims. Some of these features are explained below with reference to a method, while they can be transposed into device features.

[0022] In one embodiment, the relocation step involves swapping (i.e., permuting or exchanging) the content stored on the first used data memory page with the content stored on the OS memory page. This swapping simplifies memory page management.

[0023] Alternatively, the content stored on the OS memory page is moved to a different worn data memory page than the first worn memory page. This configuration is possible when there are available worn memory pages that do not store useful data. This is the case, for example, when the invention is implemented after the healthy (i.e., unworn) pages of the second area (storing data) have been exhausted by page replacement mechanisms such as those of the aforementioned French patent FR 2 977 047 B1 (the worn working sectors are then available).

[0024] This configuration of the invention has the advantage of not requiring backup memory to move the contents of the manipulated memory pages. Indeed, the contents (portion of OS) of the OS memory page can be directly moved to the available used memory page, thus freeing up the OS memory page to receive the contents of the first memory page detected as used.

[0025] In one embodiment, the determination step is in response to a data writing step on the first data memory page. The operations according to the invention are thus triggered after the execution of a write instruction. This reduces the risk of write errors.

[0026] In one embodiment, each data memory page determined to be worn is marked as such, and the move includes the following steps: determining an overall wear rate of a block of data memory pages, and if the overall wear rate reaches an overall wear threshold, moving the contents of the data memory pages of the block to the first area, while moving the contents of all the OS memory pages containing the entire operating system to data memory pages.

[0027] In this embodiment, the OS is moved as a single block to free up "healthy" memory space when the data area is too damaged. Thus, risky content relocation operations are limited in time.

[0028] The overall wear rate depends on the marking of the data memory pages in the entire block. Therefore, in a specific embodiment, the overall wear rate represents the number of worn data memory pages or the proportion of worn data memory pages in the block. The overall wear threshold is thus a corresponding value in number of pages or proportion.

[0029] In a specific embodiment, the data memory page block is of equivalent size (e.g. the same) as that of the first area (i.e., the block formed by the OS memory pages storing the operating system).

[0030] As an alternative to the global relocation of the operating system, the stored OS is a compiled OS, composed of a plurality of independently storeable sections, each stored on a respective block of OS memory pages, and the relocation comprises the following steps: select one or more sections of the OS, move the contents of the first worn data memory page to an OS memory page storing the selected section(s), while moving the contents of the OS memory page block(s) storing the selected OS section(s) to a data memory page block.

[0031] A gradual displacement is thus achieved. This advantageously allows for the specific processing of small areas of data that are heavily used and therefore worn out more quickly than the rest of the data memory.

[0032] In a specific embodiment, the movement comprises the following steps: select a block of data memory pages, including the first used data memory page, of a size equivalent to the OS memory page block(s) storing the selected OS section(s), and swapping the contents of the selected data memory page block with those of the OS memory page block(s) storing the selected OS section(s). This prevents the unused portion of certain "healthy" OS memory pages. Preferably, the blocks are constructed of equivalent or equal sizes.

[0033] In a specific embodiment, the selected block of data memory pages is formed from a plurality of contiguous memory pages. This allows for easier content movement.

[0034] In another specific embodiment, selecting the data memory page block comprises the following steps: to obtain a set of contiguous data memory pages, including the first worn data memory page, based on a criterion of overall wear of said memory pages in the set. Such a set will therefore preferentially encompass (in an optimized way) a large number of worn pages. The overall wear rate can be fixed as described above (based, for example, on marking pages successively identified as worn), and Update the entire data memory page set (for example, by extending it to neighboring pages) based on the selected OS section(s) to obtain the desired data memory page block. This ensures that the data memory page set matches the size of the block or blocks storing those sections.

[0035] According to a particular characteristic, selecting one or more of the OS sections includes selecting the smallest set of one or more contiguous OS sections having a size greater than the resulting set of data memory pages.

[0036] These provisions make it possible to optimize the sizing of the blocks to be interchanged, in order to minimize the number of OS memory pages not used after moving the content.

[0037] According to another particular feature, the relocation is triggered by the identification of a set of contiguous data memory pages, including the first worn data memory page, exhibiting an overall wear rate exceeding an overall wear threshold. Alternatively, reaching a specific wear rate of the first worn data memory page beyond a critical threshold (a memory page can be considered worn from a wear threshold lower than the critical threshold) can trigger the relocation procedure (obtaining a block of pages including, in particular, this critically worn memory page).

[0038] This makes moving the contents of memory pages by block more efficient.

[0039] In one embodiment, the process further comprises a step consisting of Determine whether the contents of the first worn data memory page should be moved. Criteria already mentioned above include detecting an overall wear rate (of area 1 or a set of pages). By avoiding systematic relocation, memory management is simplified.

[0040] In a particular embodiment, the determination of whether the contents of the first used data memory page should be moved is based on a data memory page type associated with the first used data memory page. This allows, for example, the definition of a first type of page that cannot be moved, for example due to the nature of the data it contains (cryptographic keys, system area, base memory addresses, etc.), and a second type of page whose contents can be moved.

[0041] In a particular embodiment, if it is determined that the contents of the first spent data memory page must be moved, the first spent data memory page is marked as being to be moved (for example, via a flag), and The process further includes, upon restarting the secure element, a step to check whether a worn data memory page is marked as being moved, and if so, a step to trigger the movement of the contents of said data memory page marked as being moved, to the OS memory page.

[0042] Thus the content movement according to the invention is carried out without use of the secure element, reducing the risks of data corruption (moved or manipulated during an operation of the secure element) or OS malfunction due to the movements carried out.

[0043] This configuration is useful when the OS is not fully loaded into RAM when using the secure element, in order to avoid OS malfunction when moving parts not in RAM if they have to be called at the same time.

[0044] According to a particular feature, the method further comprises triggering a restart of the secured element in response to marking the first worn data memory page as needing to be moved. This ensures that the move is taken into account as soon as possible, since the move requires a restart.

[0045] Alternatively, the relocation is performed immediately upon determination of the worn state of the memory page. This alternative is similar to an on-the-fly relocation of the contents.

[0046] In one embodiment, the method further comprises updating an indirection register to store information representative of a new Memory address of the moved contents (i.e., the portion of the OS moved and the data moved). This register can be an address translation table, between the initial addresses and the new memory addresses. Depending on the implementation, the information can be a relative value (for example, the memory address displacement or offset) or an absolute memory address value.

[0047] In one embodiment, the relocation is conditional upon the second area no longer containing any free, unused data memory pages. Conventional mechanisms for extending the lifespan of this "data" memory area can thus be implemented prior to the invention. In this sense, data relocations are first performed within the "data" memory area when a page is worn, and only after all "healthy" pages have been exhausted are the OS memory pages used to further extend the memory lifespan.

[0048] In one embodiment, the OS memory page to which the contents of the first used data memory page are moved is distinct from a used memory page into which the contents of an OS memory page have already been moved. This avoids, in particular, moving a portion of OS a second time after it has already been moved (initially to a memory page that is already used). This arrangement contributes to the efficiency of the mechanism according to the invention by avoiding the need to replace data on a data memory page that is already used.

[0049] In one embodiment, the method further comprises, when the OS memory page to which the contents of the first worn data memory page have been moved is determined to be worn, moving said contents of this worn OS memory page to a second OS memory page. This provision makes it possible to extend the lifespan of the memory when certain data is intensively rewritten. It applies, for example, in the case of an OS partitioned into sections, where said moved data is moved from a first block of OS memory pages to a second block of OS memory pages when the first block is found to be worn (for example, according to a criterion mentioned above).

[0050] Another aspect of the invention relates to a secure element comprising a processor and rewritable non-volatile memory, the rewritable non-volatile memory having a first area formed of memory pages, called OS memory pages, storing an operating system, OS, and a second area formed of memory pages, called data memory pages, for storing data, the secure element being configured to: - determine if at least one first page of data memory is worn, and - If so, move the contents of the first worn data memory page to an OS memory page while simultaneously moving the contents of that memory page OS to a worn data memory page.

[0051] For example, the memory can be a non-volatile memory, for example rewritable of the FLASH type.

[0052] Another aspect of the invention relates to a host terminal comprising a secure element as defined above.

[0053] The present invention also relates to a computer program comprising instructions for implementing the above process, when this program is executed by a processor.

[0054] This program may use any programming language (for example, an object-oriented language or other), and may be in the form of interpretable source code, partially compiled code or fully compiled code.

[0055] The invention also relates to a non-transient recording medium readable by a computer on which a program is recorded for the implementation of the above method, when this program is executed by a processor.

[0056] At least part of the methods according to the invention can be implemented by computer. Consequently, the present invention can take the form of a completely hardware embodiment, a completely software embodiment (comprising firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which can be collectively referred to herein as a "circuit," "module," or "system." Furthermore, the present invention can take the form of a computer program product embedded in any tangible medium having computer-usable program code embedded in the medium.

[0057] Since the present invention can be implemented in software, the present invention can be incorporated in the form of computer-readable code for provision to a programmable device on any suitable medium. A tangible or non-transient medium may include a storage medium such as a hard disk drive, a magnetic tape device, or a semiconductor memory device and the like. A transient medium may include a signal such as an electrical signal, an electronic signal, an optical signal, an acoustic signal, a magnetic signal, or an electromagnetic signal, for example, a microwave or RF (radio frequency) signal. Brief description of the drawings

[0058] Other features, details, and advantages of the invention will become apparent upon reading the detailed description below. This description is purely illustrative and should be read in conjunction with the accompanying drawings, in which: Fig. 1

[0059] [Fig. 1] schematically represents a host device comprising an embedded secure element according to an embodiment of the invention; Fig. 2a, 2b, 2c

[0060] [Fig.2a], [2b], [2c] represent, by way of illustration, different organizations of a rewritable non-volatile memory of a secure element to which one or more embodiments of the invention can be applied; Fig. 3

[0061] [Fig.3] illustrates, using a flowchart, the steps of a method for managing a non-volatile rewritable NVM2 memory according to one or more embodiments with global displacement of the operating system; and Fig. 4

[0062] [Fig. 4] illustrates, using a flowchart, the steps of a method for managing rewritable non-volatile memory according to one or more embodiments with progressive (or fragmented or partial) movement of the operating system. Detailed description

[0063] The [Fig.1] schematically represents a host device 100 comprising a secure element 107 according to one or more embodiments of the invention.

[0064] The host device 100 can be, for example, a mobile terminal, a mobile phone, a tablet computer, or any type of electronic equipment. The secure element 107 is incorporated into the host device 100.

[0065] The host device 100 may include a communication bus 106 to which the following may be connected: - a processing unit 101, named in the figure CPU (for "Central Processing Unit") and which may include one or more processors; - one or more non-volatile memories (or "NVM" for Non-Volatile Memory) 102, for example non-rewritable such as a ROM (for "Read Only Memory") and / or rewritable such as an EEPROM (for "Electrically Erasable Read Only Memory") or a Flash memory; - 103 or RAM (for "Random Access Memory"); - an input / output interface 104, labeled I / O (for "Input / Output") in the figure, for example a screen, keyboard, mouse, or other pointing device such as a touchscreen or remote control, allowing a user to interact with the system via a graphical interface; and - a communication interface 105, named COM in the figure, adapted to exchange data for example with an SM-SR server (for "subscription manager-security routing" in English) via a network, or a read / write interface.

[0066] The secure element 107 may be, for example, a universal embedded integrated circuit card (eUICC). It may include a communication bus 112 to which the following may be connected: - a processing unit 110 or microprocessor, named in the figure CPU2; - one or more non-volatile memories 108 denoted NVM2, of the rewritable type, for example an EEPROM or Flash memory. NVM2 typically stores a card operating system, denoted OS, applications or software running in the OS and data used or generated during the use of the secure element. A memory controller provides the classic functions of managing NVM2 memory (write, read, erase, error correction code, etc.); - 111 MB of RAM, labeled RAM2; and - a communication interface 109, named COM2 in the figure, adapted to exchange data with the processor 101 of the host device 100.

[0067] The RAM 111 of the secure element 107 may include registers adapted for storing variables and parameters created and modified during the use of the secure element 107, typically during the execution of the operating system, the applications it hosts, and also a computer program comprising instructions for implementing a method according to the invention. Typically, the instruction codes of the program stored in non-volatile memory 108 are loaded into RAM2 111 for execution by the CPU2 110 processing unit.

[0068] The non-volatile memory 108 of the secure element 107 is typically a rewritable memory of the EEPROM type or a Flash memory that can constitute a medium within the meaning of the invention, i.e., that can include a computer program comprising instructions for the implementation of the methods according to the invention.

[0069] Figures 2a to 2c represent different organizations of a rewritable non-volatile memory of a secure element to which one or more embodiments of the invention can be applied.

[0070] As mentioned above, a memory, for example the NVM2 rewritable non-volatile memory 108 of the secure element 107, comprises a plurality of memory blocks, in which each memory block comprises a set of memory pages on which data can be written and / or erased. It should be noted that, in what follows, the term "memory page" is used to designate the smallest unit for erasing data from memory. Writing (also referred to as "programming") can, however, be performed on only a portion of a page.

[0071] Typically, each memory card manufacturer provides a value called native endurance, which corresponds to the minimum endurance capacity guaranteed for all memory pages on the card. For example, a native endurance of 10,000 cycles indicates that each memory page can withstand at least 10,000 write and erase cycles. Some memory pages can support endurance capacities far exceeding this native endurance (here, 10,000 cycles), and there is significant variability in the individual endurance values ​​of different memory pages.

[0072] According to one or more embodiments of the present invention, the NVM2 rewritable non-volatile memory 108 of the secure element 107 is organized as shown in [Fig. 2a]. In [Fig. 2a], the rewritable non-volatile memory 108 (for example, a Flash memory) comprises two logical partitions defining two distinct memory areas: a first logical partition 201, called the OS memory area, named OS in the figure, dedicated to storing the operating system of the secure element, and a second logical partition 202, called the data memory area, named DATA in the figure, dedicated to storing other data, typically applications, profile and personalization data, application-generated data, etc.

[0073] In an alternative embodiment illustrated in [Fig. 2b], the NVM2 rewritable non-volatile memory 108 of the secure element 107 comprises a single logical partition in which the secure element's operating system and other data (applications, profiles, etc.) are stored. A first area 203, called the OS memory area, labeled OS in the figure, stores the secure element's operating system, while a second area 204, called the data memory area, labeled DATA in the figure, stores the other data and includes sub-areas available for storing additional data. The data memory area can be complementary to the OS memory area in the NVM2 memory.

[0074] Each area comprises a plurality of memory pages (not shown in Figures 2a-2b). For illustrative purposes, a memory page consists of N contiguous bytes (N is typically a power of 2, for example 256, 512, 1024), the memory pages being contiguous within the NVM2 memory.

[0075] By way of further illustration, the NVM2 memory of a secure element 107 can have a capacity of 512 kilobytes (KB) or 1024 KB. The size of the OS, for example, is 200 to 300 KB. In typical operation, the size of other data stored in the secure element is approximately 100 to 200 KB. However, this can vary considerably depending on how the secure element is used.

[0076] In the prior art, there exist methods for managing memory endurance at the level of the data memory area 202 or 204, which make it possible to improve the overall endurance of a memory and to advantageously exploit the variability of the endurance capacities of the different memory pages. For example, in French patent FR 2 977 047 B1, the data memory area 202 or 204 is advantageously The working area is partitioned into two logical sub-areas of memory pages: a working area and a replacement area (also called the "endurance reservoir" or "replacement reservoir," corresponding to memory pages of data not yet in use). The working area comprises a set of memory pages called "working pages" or "main pages." When a working page is identified as "worn out," its contents are redirected to another page, either the main page (if one is available) or the replacement page. For example, when new data needs to be written to a working page but it is worn out, its contents are copied to another page, and the new data is written there. In one or more embodiments, the redirection of the working page's contents to another page is performed using a pointer containing the address of the new page.Furthermore, when such a new page becomes obsolete, its content is redirected to yet another (main or replacement) unused page.

[0077] By "worn-out page" is meant a memory page that has reached its endurance capacity and on which it is no longer possible to correctly erase and / or write data. It should be noted that a memory page is "used" (i.e., the page has already been written to or erased at least once) before it is "worn out" (i.e., the maximum number of write / erase operations has been reached for the page). A method for determining whether a memory page is worn out or not is detailed in French patent FR 2 977 047 B1 and referred to hereafter.

[0078] As data is written to memory pages in data memory area 202 or 204, these pages wear out until they eventually reach their endurance capacity. When a memory page, for example a working page, is newly determined to be worn out, the contents of that page are copied to another available page in data memory area 202 or 204, typically another "blank" page (i.e., one that has never been used, meaning that no data has yet been written / copied to it) available in memory until the data memory pages are exhausted. When no more data memory pages remain available to receive the contents of a memory page determined to be worn out, the non-volatile NVM2 memory is no longer reliable. The secure element 107 is then considered to be at the end of its life.

[0079] In order to extend the life of the secure element 107 and thus reduce its environmental impact, it is proposed to use the OS memory pages of the OS memory area 201, 203 as replacement pages for worn data memory pages.

[0080] Traditionally, the card operating system is not, or only very slightly, scalable over time. It is therefore common practice not to manipulate the OS memory area 201, 203 during the lifetime of the secure element 107, except for reads for Loading the OS into RAM2. Reusing OS memory pages as a stock of "healthy" memory pages to compensate is therefore not intuitive.

[0081] Nevertheless, since these OS memory pages are likely to remain "healthy" given the absence or low number of erase / write cycles compared to a worn memory page, their reuse as replacement pages for worn data memory pages undoubtedly has advantages for extending the life of NVM2 memory.

[0082] Also, the invention provides for determining whether at least one first data memory page is worn out, and if so, for moving the contents of the first worn data memory page to an OS memory page while moving the contents of this OS memory page to a worn data memory page.

[0083] To determine whether a memory page is worn or not, the method described in French patent FR 2 977 047 Bl can be used. This method is based on evaluating the erasure or programming quality of a memory page. This erasure quality is measured by comparing the threshold voltages of the transistors corresponding to the memory cells of a given memory page to one or more predefined thresholds. This determination is known and is therefore not described in further detail.

[0084] As detailed with reference to [Fig.3], the invention proposes, in one or more embodiments, to move, in one go, the contents of the data memory pages of a block to the first OS memory area 201, 203, while moving the contents of all the OS memory pages containing the entire operating system to data memory pages of the data memory area 202 or 204.

[0085] These embodiments therefore refer to a global movement of the operating system to recover, at once, all the OS memory pages forming the OS memory area 201, 203. These embodiments are opposed to those relating to a partial or piecemeal movement of the operating system, as described below with reference to [Fig.4].

[0086] The operating system may have been compiled into code "Relocatable" or "relocatable" code is used to facilitate its movement within the non-volatile, rewritable NVM2 memory. Code is considered "relocatable" or "relocatable" when it can be loaded anywhere in memory due to its independence from its position within that memory. This is particularly true when using relative addresses.

[0087] "Relocatable" or "relocatable" code allows, in particular, the code to be decomposed into "independent" sections that can be loaded anywhere in memory, and therefore moved, independently of each other. However, any code referencing another section can be corrected using a table of relocation (memorizing the offset); thus the sections can be linked together.

[0088] Fig. 3 illustrates, using a flowchart, steps of a process for managing a non-volatile rewritable NVM2 memory according to one or more embodiments with global displacement of the operating system.

[0089] Such memory management can be implemented after the data memory pages have been exhausted, as mentioned for example above. In this case, the transfer of the contents of a used data memory page to the OS memory area 201, 203 is conditional upon the data memory area 202, 204 no longer containing any unused or "healthy" data memory pages that are free.

[0090] At step 300, the secure element is waiting for a write instruction in data memory area 202, 204. A "write instruction" is defined as any instruction intended to modify data stored in a data memory page, and therefore also includes an erase instruction. Thus, when such an instruction is received (the "yes" branch of step 300), it is executed at step 305, resulting in writing to one or more data memory pages, depending on the size of the data to be written or erased. If the received instruction is not a write instruction (the "no" branch of step 300), then the process loops back to step 300, waiting for a new write instruction.

[0091] With these steps 300 and 305, the continuation of the process leading to the relocation of contents from worn memory pages is conditioned on, or "in response to", a step of writing data to a data memory page. Other conditions could nevertheless be used.

[0092] In step 310, a wear level of each of the "written" pages is determined. The process described in patent FR 2 977 047 B1 can be used for this purpose.

[0093] A "written" memory page may turn out to be worn out (the "yes" branch of step 310), in which case it is marked as such in step 315. Also, as the various write operations to NVM2 memory occur, each "written" data memory page that is determined to be worn out is marked as such.

[0094] The determined wear level is, for example, considered "worn out" if it exceeds a prefixed wear threshold value THR1. In the example of the mechanisms of patent FR 2 977 047 Bl, if the erasure quality measured by comparing the threshold voltages is less than a wear threshold, then the memory page is considered worn out.

[0095] The marking may consist of activating a "worn-out" flag associated with the memory page in question. For example, a table of "worn-out" flags for all data memory pages may be stored in a register 205 (illustrated in Figures 2a, 2b, and 2c), which may optionally be part of the NVM2 memory. As an alternative to using one flag per memory page, a memory page identifier (by (For example, its address) can be stored in the register. Preferably, as contiguous ranges of used memory pages form, ranges of identifiers (storing the start page identifier and the end page identifier) ​​can be stored to reduce the number of registers used.

[0096] If no memory page is identified as newly worn (branch "not" of step 310), then the process starts again at step 300 waiting for a new write instruction.

[0097] Once all the "written" memory pages have been processed (those of step 305) and when at least one new page is marked as worn (i.e. following step 315), the secure element determines in step 320 an overall wear rate of a block of data memory pages from the data memory area 202, 204, which includes the page or pages newly marked as worn.

[0098] The issue here is to determine whether a block in the data memory area 202, 204 is too degraded, justifying a move of its contents to the OS memory area 201, 203.

[0099] Preferably, the data memory page block considered here is of equivalent size (e.g. the same size) to that of the OS memory area 201, 203. This aims to perform, where appropriate, a substitution of contents without leaving unused memory pages.

[0100] In one embodiment, the data memory area 202, 204 can be divided into N disjoint blocks of contiguous memory pages, each block being the size of the OS memory area 201, 203, with the possible exception of the last block. In this case, step 320 focuses on the block including the newly marked "written" memory page(s) that have been worn out.

[0101] In another embodiment, the data memory area 202, 204 can be divided into M disjoint subblocks of one or more contiguous memory pages of the same size (with the possible exception of the last block), this size being, for example, a submultiple of that of the OS memory area 201, 203. A subblock therefore comprises a set of one or more contiguous memory pages. In this case, the block to be considered is formed of several consecutive disjoint subblocks. The block is therefore formed of several memory pages. Step 320 can then focus on all the blocks, each formed of several consecutive disjoint subblocks, which include the newly marked "written" memory page(s) as worn out.

[0102] Disjoint subblocks can be formed so as not to cut data stored on several consecutive memory pages.

[0103] The overall wear rate can be representative of a number of worn data memory pages or a proportion of worn data memory pages in the block. For example, if the block consists of X data memory pages of which Y pages memory are marked as worn, so the overall wear rate of the sector is Y / X.

[0104] If several blocks are evaluated in step 320, only the one with the highest overall wear rate is considered.

[0105] Still at step 320, the overall wear rate of the block in question is compared to a threshold value, called the overall wear threshold, for example 90%.

[0106] If the overall wear rate reaches the overall wear threshold, then the process proceeds to step 325 (the "yes" branch of step 320) aimed at moving the contents of the data pages of this block to the OS memory area 201, 203; otherwise (the "no" branch of step 320), the process returns to step 300 awaiting a new NVM2 memory write instruction.

[0107] Step 325 therefore consists of moving the contents of the data memory pages of the block to the OS memory area 201, 203, while moving the contents of all the OS memory pages containing the entire operating system to data memory pages.

[0108] Preferably but not necessarily, this movement consists of the interchange (i.e. the permutation or the exchange) of the contents stored in the data memory page block with the contents stored in the OS memory area 201, 203.

[0109] The permutation of contents can be on the fly, therefore immediately after step 320. Such a permutation, while the secure element 107 is in use, is possible because generally the running operating system has been loaded into RAM2 111. Also, it is possible to move the static compiled code of the operating system.

[0110] Alternatively, particularly if part of the operating system is not loaded into RAM2 111 (and is therefore likely to be called at any time), it may be preferable to postpone the actual movement of the contents to a later time, typically the next reboot of the secure element. This avoids moving the contents while the secure element is in use, and thus avoids the potential risk of write errors.

[0111] In this embodiment, it may be provided for in step 320, when it is determined that the content of the block must be moved (because it is too worn overall), that this block is marked as being to be moved. Again, a flag associated with the block may be set in register 205, or alternatively, a block identifier may be stored.

[0112] Then, the move step 325 is performed when the secure element 107 is restarted. In other words, when the secure element is restarted, a check is performed to see if a block of data memory pages is marked as being moved. If so, the secure element triggers the move of the contents of the data memory page block marked as being moved to the OS memory area 201, 203.

[0113] The restart can be left to the user's initiative, for example when he turns off the host device 100.

[0114] Alternatively, the method according to the invention can trigger such a restart to force the relocation of the contents. The restart instruction can be provided at the end of step 320. Also, the triggering of the restart of the secured element is in response to marking the data memory page block as being to be moved.

[0115] As illustrated in Figures 2a and 2b, a backup memory 206 is available to allow for movement. This memory may or may not be part of the NVM2 memory. Within the NVM2 memory, it may consist of a reserved area, and therefore not used for data storage, or alternatively, it may consist of unused and free memory pages from the data memory area 202, 204. Furthermore, the backup memory 206 may vary in size depending on the number of free memory pages available when step 325 is engaged.

[0116] The contents can be moved in a single block, meaning that the backup memory 206 is the same size as the block to be moved. For example, the contents of the data page block to be moved are copied to backup memory 206. Then, the contents of the OS memory area 201, 203, which is the same size as the data page block to be moved, are copied into the memory pages forming the block whose contents have already been moved (thus, this OS content overwrites the old data content copied to backup memory 206). Finally, the contents of backup memory 206 are copied back into the memory pages of the OS memory area 201, 203. Alternatively, the contents of all the OS memory pages storing the operating system could be copied to backup memory 206 first. In another variation, the entire first area, consisting of the OS memory pages, could be copied to backup memory 206.In another variant, the backup memory 206 can be duplicated and receive a copy of the two contents to be swapped, before the swapped copies are made onto the initial memory pages.

[0117] Alternatively, the move can be performed in sub-blocks. This allows the use of a reduced backup memory size. A sub-block can, in particular, contain only a single memory page (the minimum unit). In this case, the move is progressive: the first sub-block of the block to be moved and the first sub-block of the OS memory area 201, 203 are swapped using the backup memory, then the second sub-block of the block to be moved and the second sub-block of the OS memory area 201, 203 are swapped, and so on. As in the variant above, the backup memory can be doubled to receive a copy of the two sub-blocks to be swapped.

[0118] The movement of the contents of memory pages (whether memory pages of data or OS memory pages) requires an update of the memory addresses corresponding to the various stored data.

[0119] By way of illustration, a Memory Management Unit (MMU) in a memory controller, not shown in [Fig. 1], maintains a lookup table or "address translation table" that translates the memory addresses sent by the CPU2 110 processor into physical addresses in memory. Moving the contents of memory pages changes the physical address where the contents are stored. Therefore, when the contents of data memory pages are moved, the physical address in the address translation table is updated to point to the new address, corresponding to the destination OS memory pages in the OS memory area 201, 203.

[0120] The operating system of a secure element generally includes, hardcoded at the beginning of the compiled code, an absolute memory address where this operating system is initially stored. In other words, this is the memory address starting in the OS memory area 201, 203. The other addresses specified in the compiled code of the operating system are generally expressed as relative addresses with respect to this absolute address.

[0121] Since the operating system is not recompiled during the move according to the invention, one or more embodiments provide for updating an indirection register to store information representing a new memory address of the moved contents, here of the moved OS. This indirection register, initially set to 0 during the installation of the operating system, can include the memory offset between the initial address and the destination address of the move. The stored offset can simply be added to the load addresses. Thus, the addresses for calling operating system functions are evaluated as the sum of the initial absolute address of the OS, the relative address of the called function, and the indirection value contained in the register, and therefore allow, both before and after the move, for calls to operating system functions to be made without risk.

[0122] Once the content has been moved (step 325), the process ends. The operating system is now stored on a block of memory pages that is generally used up. These pages no longer constitute a reserve of "healthy" memory pages for a new implementation of the invention.

[0123] Figure 4 illustrates, using a flowchart, the steps of a management process of a non-volatile rewritable NVM2 memory according to one or more embodiments with progressive (or piecemeal or partial) movement of the operating system.

[0124] Indeed, only a part of the operating system may be displaced. This is particularly advantageous for secure devices where the operating system occupies a significant portion of the NVM2 memory space. For example, it is not uncommon to use secure devices with 512 KB of NVM2 memory hosting a 300 KB operating system.

[0125] The operating system can be "relocatable" or "relocatable" and thus structured into sections that can be moved independently of each other, provided that the associated relocation table is updated, as explained above. [Fig. 2c] illustrates an operating system 207, named OS in the figure, structured into sections 208, in the memory configuration of [Fig. 2b]. It is also possible to use an operating system structured into sections 208, in the partitioned memory configuration of [Fig. 2a].

[0126] In these examples, the stored operating system is therefore a compiled OS, composed of a plurality of independently storeable sections, each stored on a respective block of OS memory pages. In the Figure, the first OS section is stored on four memory pages (each horizontal strip schematically representing one memory page), the second section on two memory pages, and so on.

[0127] Again, memory management according to [Fig. 4] can be implemented after the data memory pages have been exhausted as mentioned above. In this case, the transfer of the contents of a used data memory page to an OS memory page (in area 201, 203) is conditional upon the data memory area 202, 204 no longer containing any unused or "healthy" data memory pages that are free.

[0128] In step 400, the secured element awaits a write instruction in data memory area 202, 204, similarly to step 300 above. When such an instruction is received (the "yes" branch of step 400), it is executed in step 405 (similar to step 305), leading to writing to one or more data memory pages, depending on the size of the data to be written or erased. If the received instruction is not a write instruction (the "no" branch of step 400), then the process loops back to step 400, awaiting a new write instruction. With these steps 400 and 405, the subsequent process leading to the relocation of contents from worn memory pages is conditioned on, or "in response to," a step of writing data to a data memory page. However, other conditions could be used.

[0129] In step 410, similar to step 310 above, a wear level of each of the "written" pages is determined. Again, the process described in patent FR 2 977 047 B1 can be used for this purpose.

[0130] A "written" memory page may turn out to be worn (the "yes" branch of step 410), in which case it is marked as such in step 415. Also, as the different writes to NVM2 memory, each "written" data memory page that is determined to be worn out is marked as such.

[0131] The determined wear level is, for example, considered "worn out" if it exceeds a prefixed wear threshold value THR1. In the example of the mechanisms of patent FR 2 977 047 Bl, if the erasure quality measured by comparing the threshold voltages is less than a wear threshold, then the memory page is considered worn out ("worn out state").

[0132] In one or more embodiments, at least two different wear states can be evaluated for the memory page under examination, based on two respective threshold values. A first threshold value, here the wear threshold value THR1 mentioned previously, allows the "worn" state to be assigned to the memory page under examination; a second threshold value THR2, called the critical wear threshold value, allows the "critical" state to be assigned to the memory page under examination. Since the "critical" state is more restrictive than the "worn" state, the threshold value THR2 is higher than the threshold value THR1 ("higher" in the sense of representing a greater level of wear, THR2 being mathematically smaller than THR1). In this case, the aforementioned marking can indicate "unworn," "worn," or "critical." Of course, a greater number of wear states can be used within the scope of the invention.

[0133] The marking can then consist of activating a "worn" flag or indicating the state ("worn" or "critical") in a field associated with the memory page in question. This information can be stored in register 205 for each of the data memory pages, as explained above in step 315. As an alternative to using one flag / field per memory page, a memory page identifier (for example, its address) can be stored in the register as explained above in step 315. Optionally, two registers, one associated with the "worn" state and the other with the "critical" state, can be used.

[0134] If no memory page is identified as newly worn (branch "not" of step 410), then the process starts again at step 400 waiting for a new write instruction.

[0135] Once all the "written" memory pages have been processed (those of step 405) and when at least one new page is marked as worn or critical (i.e. following step 415), the secure element determines in step 420 whether the content of this worn memory page should be moved.

[0136] Several criteria can be used as described below, which can be combined except in cases of obvious incompatibility. For example, if one or more memory pages are marked as critical, it is possible to determine the set of contiguous memory pages (as explained below) including this or these "critical" memory page(s), which exhibits the highest overall wear rate, and proceed to the de placement is independent of the value of this rate (the triggering criterion being the simple presence of a "critical" page). It may also be necessary to ensure that all memory pages in an analyzed set are of type 2 (see below).

[0137] In one or more embodiments relating to these criteria, the move is systematic as soon as the memory page is marked as worn.

[0138] In one or more embodiments relating to these criteria, the relocation is triggered if the memory page is marked as "critical". Also, in these embodiments, reaching a specific wear rate of a worn data memory page beyond a critical threshold triggers the relocation procedure.

[0139] In one or more embodiments relating to these criteria, the relocation is based on a type of data memory page associated with the worn memory page. For example, certain pages may be declared unmovable (type 1 pages) because their content is sensitive (cryptographic keys, system area, base memory addresses, etc.). These pages may constitute a protected area of ​​NVM2 or be mixed with other data memory pages (in which case a marking allows them to be identified). Other data memory pages are subject to less protection and their content can therefore be moved (type 2 pages).

[0140] In one or more embodiments relating to these criteria, the displacement is based on an overall wear rate of a set of data memory pages including the newly marked memory page(s) as worn.

[0141] The secure element 107 can, for example, analyze one or more sets of contiguous data memory pages, each including the newly marked memory page(s) as worn, and then evaluate an overall wear rate for each of these sets. This can, for example, trigger the relocation of the contents of a set of contiguous data memory pages including the first worn memory page, if it is identified that this set of contiguous data memory pages has an overall wear rate exceeding an overall wear threshold.

[0142] Similar considerations to those mentioned in connection with step 320 above are applicable.

[0143] Note that sets of varying sizes can be analyzed. Typically, secure element 107 can analyze all sets composed of A to B contiguous data memory pages (A, B are prefixed integers, for example A = 2 and B = one-tenth of the size of the OS memory area 201, 203) and search for the one with the highest overall wear rate.

[0144] In one or more embodiments, since it may be preferable to move the contents of a substantial set of memory pages all at once, the wear rate The overall wear rate may include a weighting of the Y / X ratio (described earlier in step 320, scaled to the set considered here) by the number of memory pages forming the analyzed set. For example, the overall wear rate may be equal to Y / X².

[0145] The issue here is to determine whether a sub-part of the data memory area 202, 204 is too degraded, justifying a move of its contents to the OS memory area 201, 203.

[0146] If the overall wear rate of the assembly under consideration reaches the overall wear threshold (the "yes" branch of step 420), then the process continues to step 425, which aims to select one or more of the sections 208 of OS 207. If the overall wear rate of the assembly under consideration does not reach the overall wear threshold (the "no" branch of step 420), then the process returns to step 400, waiting for a new write instruction.

[0147] In one or more embodiments, the selection process in step 425 consists of selecting the smallest set (in terms of the number of associated OS memory pages) of one or more contiguous sections of the OS that are larger than the set of data memory pages obtained (in step 420). The aim is thus to identify the portion of OS memory area that best matches (in terms of size) the overall worn memory pages to be moved.

[0148] In this text, moving a memory page, moving a block, moving a section are to be understood in the sense of "moving the content" which is stored in the memory page(s) considered, in the block(s) considered or the section(s) considered.

[0149] Of course, only sections of the OS that have not yet been moved, that is, those still in the initial OS memory area 201, 203, are taken into account. This ensures that an OS memory page to which the contents of the first used data memory page are moved (i.e., the destination of a content move) is distinct from a used memory page into which the contents of an OS memory page have already been moved.

[0150] Once this section or these sections have been identified, the optional step 430 consists of the secured element determining a final block of data memory page to be moved. This step is optional, as it may be decided to move only the set obtained in step 420 (possibly a single data memory page).

[0151] The final block to be moved can, for example, be obtained by updating the data memory page set obtained in step 420, for example by adding adjacent data memory pages preceding and / or following said set, depending on the OS section(s) selected. Ideally, the data memory page set is increased until it reaches the size of the OS section(s) selected in step 425. The data stored in this is, of course, taken into account. The entire set is augmented so as not to truncate them. Also, the augmented set forming the final block has a size equivalent to, or possibly equal to, that of the selected OS section(s).

[0152] Once the memory page block to be moved has been obtained in step 430, its contents are moved, in step 435, to the OS memory area 201, 203, typically by swapping these contents with those of the OS memory page block corresponding to the selected section(s).

[0153] This ensures that the content of the newly marked data memory page (or pages) as worn in step 415 is moved to an OS memory page storing the selected section(s), and that conversely the selected section(s) are moved to a data memory page block.

[0154] Nevertheless, it may be provided that the content stored on the selected section(s) (possibly a single OS memory page) is moved to one or more available data memory pages, preferably globally worn (according to an overall wear rate) different from the block of data memory pages (possibly the single memory page newly marked as worn) whose content is moved in parallel.

[0155] Similar considerations to those set out above in connection with step 325 are applicable.

[0156] In particular, the swapping of contents can be done on the fly, or at the next restart of the secure element (in which case a marking is put in place indicating when the memory page block obtained in step 430 is to be moved).

[0157] Also, the movement of contents can be done in a single block or in sub-blocks, depending on the size of the available backup memory 206.

[0158] Finally, memory addresses are updated, typically in the address translation table for data, and via the indirection register and / or the relocation table for the moved OS section(s)

[0159] Once the contents have been moved (step 435), step 440 can consist of checking whether at least one OS section remains unmoved. Indeed, in this condition, there remains a reserve of "healthy" memory pages that the invention could use to extend the lifespan of the NVM2 memory.

[0160] Also, if step 440 is successful, the process returns to step 400 to await a new write instruction. Otherwise, the process terminates because there are no more "healthy" memory pages available for a new implementation of the invention.

[0161] The above description primarily considers the transfer of the contents of a data memory page to an OS memory page in order to take advantage of the low wear and tear on the latter. As long as there are OS memory pages (or OS sections) that have not yet been moved, it is also possible to move data content that has already been moved to an OS memory page again, to a new OS memory page if the first OS memory page turns out to be worn (for example, by multiple rewrites of the data it contains).

[0162] Also, some embodiments may envisage that the secure element: determines that a first OS memory page to which the contents of a worn data memory page have already been moved, is worn, and in response to this determination, moves said contents of this first now worn OS memory page to a second OS memory page (whose contents have not yet been moved).

[0163] The principles of content displacement, of determination of a worn (or even critical) state as defined above also apply here.

[0164] As can be seen from the above, the invention therefore makes it possible to extend, in a significant way, the life of a secure element.

[0165] Of course, the present invention is not limited to the embodiments described above by way of example; it extends to other variants. Other embodiments are possible.

[0166] Depending on the embodiment chosen, certain acts, actions, events, or functions of each of the methods described in this document may be performed or occur in a different order than described, or may be added, merged, or not performed or occur, as the case may be. Furthermore, in some embodiments, certain acts, actions, or events are performed or occur concurrently rather than sequentially.

[0167] Although described through a number of detailed embodiments, the proposed method and the equipment for implementing the method include various variants, modifications, and improvements that will be obvious to those skilled in the art, it being understood that these various variants, modifications, and improvements form part of the scope of the invention, as defined by the following claims. Furthermore, different aspects and features described above may be implemented together, separately, or substituted for one another, and all the different combinations and subcombinations of aspects and features form part of the scope of the invention. In addition, some of the systems and equipment described above may not incorporate all of the modules and functions described for the preferred embodiments.

Claims

Claims

1. Method for managing a rewritable non-volatile memory (108) in a secure element (107), the memory comprising a first area (201, 203, 207) formed of memory pages, called OS memory pages, storing an operating system, OS, and a second area (202, 204) formed of memory pages, called data memory pages, for storing data, the method comprising the following steps: - determining (310, 410) whether at least one first data memory page is worn, and - if so, moving (325, 435) the content of the first worn data memory page to an OS memory page while moving the content of this OS memory page to a worn data memory page.

2. The method of claim 1, wherein each data memory page determined to be worn is marked (315) as such, and the moving comprises the steps of: determining (320) an overall wear rate of a block of data memory pages, and if the overall wear rate reaches an overall wear threshold, moving (325) the contents of the data memory pages of the block to the first area, while moving the contents of all OS memory pages containing the entire operating system to data memory pages.

3. The method of claim 1, wherein the stored OS is a compiled OS (207), composed of a plurality of independently storable sections (208), each stored on a respective block of OS memory pages, and the moving comprises the steps of: selecting (425) one or more of the sections (208) of the OS, moving (435) the contents of the first used data memory page to an OS memory page storing the selected section(s), while moving the contents of the block(s) of OS memory pages storing the selected OS section(s) to a data memory page block.

4. The method of claim 3, wherein selecting (425) one or more of the sections (208) of the OS comprises selecting the smallest set of one or more contiguous sections of the OS having a size greater than the resulting set of data memory pages.

5. The method of claim 3 or 4, wherein the moving (435) is triggered by identifying (420) a set of contiguous data memory pages, including the first worn data memory page, having an overall wear rate greater than an overall wear threshold.

6. The method of any one of claims 1 to 5, further comprising a step of determining (320, 420) whether the contents of the first used data memory page should be moved.

7. The method of claim 6, wherein determining whether the contents of the first used data memory page should be moved is based on a data memory page type associated with the first used data memory page.

8. The method of claim 6, wherein in the affirmative of a determination that the contents of the first worn data memory page must be moved, the first worn data memory page is marked as being to be moved, and the method further comprises, upon a restart of the secure element, a step of verifying whether a worn data memory page is marked as being to be moved, and if so a step of triggering the movement of the contents of said data memory page marked as being to be moved, to the OS memory page.

9. A method according to any one of claims 1 to 8, further comprising updating an indirection register to store information representative of a new memory address of the moved contents.

10. The method of any one of claims 1 to 9, further comprising, when the OS memory page to which the contents of the first worn data memory page have been moved is determined to be worn, moving said contents of that worn OS memory page to a second OS memory page.

11. Secure element (107) comprising a processor (110) and a rewritable non-volatile memory (108), the rewritable non-volatile memory comprising a first zone (201, 203, 207) formed of memory pages, called OS memory pages, storing an operating system, OS, and a second zone (202, 204) formed of memory pages, called data memory pages, for storing data, the element secure being configured to: - determine whether at least one first data memory page is worn, and - if so, move the contents of the first worn data memory page to an OS memory page while moving the contents of this OS memory page to a worn data memory page.

12. Non-transitory recording medium readable by a computer on which is recorded a program for implementing the method according to one of claims 1 to 10 when this program is executed by a processor.

Images