Emulation of a one-time programmable memory

Abstract

Emulation of a one-time programmable memory The present description relates to a method comprising:- programming a first authorization bit, associated with an area of ​​a non-volatile memory (104) of an electronic device, to a protection value; and- prohibiting erasure of the contents of the first area of ​​the non-volatile memory, on the basis of the state of the first authorization bit. Figure for abstract: Fig. 3

Description

Title of the invention: Emulation of a one-time programmable memory Technical field

[0001] The present description relates generally to one-time programmable (OTP) memories and in particular to the method and circuit enabling the emulation of an OTP memory. Prior art

[0002] Security mechanisms, such as for example mechanisms prohibiting returns to previous versions and / or states of software (in English "Anti RollBack"), are easily implementable on electronic devices when they are provided with a one-time programmable memory.

[0003] However, the size of the one-time programmable memories depends on several parameters, such as, for example, the functionalities embedded in the device, the type of end use of the device, etc. and may not be sufficient for a user of the device.

[0004] It is desirable to ensure a one-time programmable memory size sufficient for the user of the device. In particular, it is desirable to make the one-time programmable memory size of an electronic device configurable. Summary of the invention

[0005] One embodiment provides a method comprising: - programming a first authorization bit, associated with an area of ​​a non-volatile memory of an electronic device, to a protection value; and - the prohibition of erasure of the contents of the first area of ​​non-volatile memory, based on the state of the first authorization bit.

[0006] According to one embodiment, the protection value to which the first authorization bit is programmed is a function of the state of a first configuration bit and / or of at least one value associated with a state in which the device is placed among a plurality of possible states of the device.

[0007] According to one embodiment, the configuration bit is programmable only when the device is placed in a first state among the plurality of states.

[0008] According to one embodiment: - the device is placed in a second state among the plurality of states, from the first state, by programming a first state bit; and - the device is placed in a third state among the plurality of states, from the first or second state, by programming a second state bit included in a one-time programmable memory.

[0009] According to one embodiment, erasure of the non-volatile memory area is authorized when the device is in the first state.

[0010] According to one embodiment, the first status bit is included in the non-volatile memory.

[0011] According to one embodiment, the configuration bit is included in a memory that is programmable only once.

[0012] According to one embodiment, the configuration bit is included in the non-volatile memory.

[0013] According to one embodiment, an additional bit is included in a one-time programmable memory of the device and in which the protection value to which the first authorization bit is programmed is furthermore a function of the additional bit.

[0014] According to one embodiment, the additional bit is programmable only when the device is placed in the second state.

[0015] One embodiment provides a device comprising a non-volatile memory comprising an area associated with a first authorization bit programmed to a protection value, access for erasure of the area being prohibited based on the protection value.

[0016] According to one embodiment, the protection value to which the authorization bit is programmed is a function of the value of a configuration bit, of a first status bit included in the non-volatile memory and of a second status bit included in a one-time programmable memory of the device.

[0017] According to one embodiment, the configuration bit is included in the programmable memory only once.

[0018] According to one embodiment, the configuration bit is included in the non-volatile memory and in which the one-time programmable memory further comprises an additional bit, the protection value to which the authorization bit is programmed being a function, furthermore, of the state of the additional bit.

[0019] According to one embodiment, the state of the first and / or second state bits determines a state of the device among a first, a second and a third state, and wherein the configuration bit is programmable only when the device is in the first state. Brief description of the drawings

[0020] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0021] [Fig.l] is a block diagram illustrating an electronic device;

[0022] [Fig.2] is a flowchart illustrating steps of an embodiment of the present disclosure; and

[0023] [Fig. 3] illustrates an example implementation of a one-time programmable memory emulation method, according to an embodiment of the present description. Description of the embodiments

[0024] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0025] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed.

[0026] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0027] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0028] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0029] [Fig.l] is a block diagram illustrating an electronic device 100 comprising a processing circuit 102 according to an embodiment of the present description.

[0030] The processing circuit 102 is, for example, an electronic card such as a microcircuit card, hardware for computer use, a microprocessor circuit, etc. For example, the electronic device 100, comprising the processing circuit 102, is a connected object, such as a smartphone, a connected watch, etc. on which one or more applications are installed.

[0031] According to one embodiment, the circuit 102 comprises a non-volatile memory 104 (NV MEM), for example of the NOR Flash and / or NAND FLASH type. The circuit 102 further comprises, for example, a volatile memory 106 (RAM). By way of example, the volatile memory 106 is a RAM type memory (from the English “Random Access Memory”). Memories 104 and 106 are, for example, connected for example via a bus 108.

[0032] The circuit 102 further comprises, for example, a processor 110 (CPU) connected to the bus 108. By way of example, the processor 110 is configured to execute applications whose application codes are, for example, stored in the non-volatile memory 104.

[0033] According to one embodiment, the circuit 102 further comprises one or more one-time programmable memories 112 (OTP), and for example connected to the bus 108. For example, the memory(s) 112 are fuse-type or anti-fuse-type memories. For example, in their initial state, the bits of the memory(s) 112 have the value 1. A bit of the memory(s) 112 will be said to be burned out when its value changes from 1 to 0.

[0034] By way of example, the memory(s) 112 are configured to, for example, burn one or more bits at each update of a software application, of firmware, for example a firmware of the device. In this way, the memory(s) 112 provide mechanisms preventing returns to previous versions and / or states of software (in English “Anti RollBack”). In another example, the memory(s) 112 are configured to burn one or more bits when the device 100 leaves an initial state, such as for example a state allowing the programming and / or configuration of the device 102, for example to be provided to an intermediary entity between the manufacturer of the circuit 102 and an end user of the device 100 and / or its placing on the market.

[0035] In certain cases, the size of the memories 112 is insufficient for the implementation of the security mechanisms and / or the implementation of other functionalities requiring the use of a memory programmable only once.

[0036] According to one embodiment, the non-volatile memory 104 comprises one or more blocks, or sectors, configurable so as to be protected against erasure of their contents. In other words, one or more blocks of the non-volatile memory 104 are configurable so as to act as a one-time programmable memory.

[0037] For example, each of the one or more blocks of the non-volatile memory 104 is associated with a configuration bit included in the memory 104 and / or in the memories 112. The state of the configuration bit then determines whether the associated block is protected against erasure or not.

[0038] For example, the memory 104 is a NOR Flash type memory and comprises one or more sectors protected against erasure. Each sector comprises, for example, 16 bytes. For example, the bytes of each block initially have the value Oxff. When a request for writing, for example coming from the processor, is required on one of these blocks, the first byte of this block is for example programmed to the value Oxfe or to the value 0x1. For example, when a request to write the first byte to the value Oxff, erasure of the block is then required. Since the block is protected against erasure, the write request is then refused and the first byte of the block remains at the previously programmed value.

[0039] For example, the memory 104 is a NAND Flash type memory and comprises one or more sectors protected against erasure. Each sector comprises, for example, 16 bytes of useful data and 8 bytes of error correction code (ECC), each byte of useful data then being associated with 4 bits of ECC. For example, the bytes of useful data and ECC of each block initially have the value Oxff. When a request for writing, for example coming from the processor, is required on one of these blocks, the first byte of this block is programmed to the value Oxfe and the 4 associated ECC bits are programmed to, for example, the value corresponding to Oxfe. For example, the second byte of this block is programmed to the value 0x1 and the 4 associated ECC bits are programmed to, for example, the value corresponding to 0x1.For example, when a request is made to write the first byte to the value Oxff, erasure of the block is then required. Since the block is protected against erasure, the write request is then refused and the first byte of the block remains at the previously programmed value. Indeed, in a block of a NAND type memory, it is possible to program the bytes of the block in order or in disorder. However, each byte is programmable only once. Indeed, each time a byte is written, ECC bits are programmed and the ECC bits encoding the error code then depend on the data written in the byte. It is then, for example, possible to write the value Oxfe in the first byte. However, if we then want to write a value other than Oxfe in the first byte, the write will fail because a memory controller (not shown in [Fig.l]) of the NAND memory will check, before writing, that the byte is Oxff and that the 4 ECC bits associated with this byte are programmed to the value 1. The behavior is then the same for all the bytes. In other words, the behavior is the same for the 16 bytes.

[0040] In the case of a NOR type memory, it is not possible to first write the value Oxfe and then the value 0x1 in the same byte. Indeed, the least significant bit of this byte would be programmed to the value 0 during the first writing of Oxfe and then be programmed to the value 1 during the second writing of this bit. However, NOR type memory technology involves erasing a block to reprogram a bit having the value 0 to the value 1.

[0041] According to one embodiment, the choice of the blocks of the memory 104 for which the erasure protection is activated is configurable only when the circuit 102 is in a programming and / or configuration state. For example, this state is an initial state in which the circuit 102 is when it is between the hands of its manufacturer and before being handed over to, for example, an intermediary entity between the manufacturer and an end user and / or before it is placed on the market.

[0042] [Fig.2] is a flowchart illustrating steps of an embodiment of the present description.

[0043] [Fig. 3] illustrates an example of implementation of the one-time programmable memory emulation method, according to an embodiment of the present description.

[0044] In a step 200 (LEVEL0), the circuit 102 is in its initial state. For example, the circuit 102 is in the hands of its manufacturer and has not yet been delivered to an intermediate entity and / or to its end user.

[0045] For example, the initial state of the circuit is defined by the state of two status bits. For example, when these two status bits are programmed to the value 0, the circuit 102 is in the initial state. For example, the two status bits comprise a first status bit A71 included in the memory 104 and a second status bit Zv / 2 included in one of the memories 112.

[0046] According to one embodiment, when the circuit 102 is in its initial state, blocks 300 (SECTORS) of the memory 104 are configurable so as to be, in the remainder of the life of the device 100, protected against erasure. For example, the blocks of the memory 104 are further configurable so as to be, in the remainder of the life of the device 100, protected against writing. In other words, in the initial state of the circuit 102, it is possible to configure the blocks 300 of the memory 104 so as to prohibit their erasure and / or their writing.

[0047] For example, the blocks 300 comprise 8 blocks of 16 bytes each. In the example where the memory 104 is of the NAND type, each of the blocks 300 comprises, in addition to the 16 bytes of useful data, 8 bytes of error code.

[0048] In one example, a TestConf ig byte for configuring blocks 300 is, for example, included in one of the memories 112. Each bit of the configuration byte is then associated with one of the blocks 300. The bits of the configuration byte are then programmed in step 200. For example, when a bit of the configuration byte is toasted, taking for example the value 0, this indicates that the associated block in the memory 104 is protected against erasure. Thus, once a bit of the configuration byte is toasted, this action is irreversible.

[0049] In another example, the configuration byte TestConj ig is included in the memory 104. Thus, it is possible to change the configuration of the blocks 300 when write access to the byte TestConf ig is authorized. In this example, an additional byte ProdConfig is included in the memories 112.

[0050] For example, the protection against erasure of a block of memory 104 is not effective when circuit 102 is in its initial state. In other words, during step 200, it is possible to modify and / or erase the content of a block of memory. 104 protected against erasure. This allows you to test the contents of the protected block and modify it if necessary.

[0051] In a step 201 (LEVEL1), the circuit 102 is placed in an intermediate state. For example, the transition of the circuit from the initial state to the intermediate state is carried out by programming the first state bit / vZl, for example, included in the memory 104. For example, when the first state bit IvlA is programmed to the value 0, the circuit 102 is in the intermediate state. It is then possible to return to the initial state by reprogramming the first state bit Zv / 1, for example to the value 1.

[0052] In the example where the configuration byte is included in the memory 104 and the memories 112 include the additional byte ProdConfig, the intermediate entity has the possibility of burning bits of the additional byte, thus indicating whether it wishes one or more blocks of the blocks 300 to be protected against erasure. For example, access for writing the byte ProdConfig is authorized only when performing step 201. The programming of the byte ProdConfig is then definitive. In addition, the byte ProdConfig is programmed from the value of the byte TestConfig.

[0053] In a step 202 (LEVEL2), the circuit 102 is for example placed in a final state. For example, step 202 is carried out before the device 100 is delivered to its end user. For example, the transition of the circuit 102 to the final state is carried out by programming the second status bit ZvZ2, for example stored in the memories 112. For example, when the second status bit is programmed to the value 0, the circuit 102 is in the final state. Thus, the second status bit being included in the memories 112, once the circuit 102 has passed into the final state, it is not possible to return to step 200 and / or to step 201.

[0054] For example, write access to the TestConfig byte is authorized when the first status bit and the second status bit ZvZ2 both have the value 1, in other words when the circuit 102 is in the initial state. Similarly, in the case where the memories 112 include the ProdConf ig byte, write access to the ProdConfig byte is authorized when the first status bit ZvZ1 has the value 0 and the second status bit Zv / 2 has the value 1. In this example, writing the status bit ZvZ2 to the value 0 is possible when the ProdConfig byte is programmed, based on the values ​​of the TestConfig byte.

[0055] As an example, an EraseAllow authorization byte is for example included in the memory 104. The value of the EraseAllow byte is, for example, calculated from different elements stored in the memory 104, such as for example the status bit ZvZl, the value of the TestConfig byte, and / or from values ​​stored in the memory 112, such as, for example, the status bit lvl2 and the value of the ProdConf ig byte. The EraseAllow byte is then, for example, stored in a register. The value of this byte is, for example, calculated via logic hardware, such as, for example, logic gates, and from the contents of the memories 104 and 112. The register storing the EraseAllow byte is then, for example, coupled to the memory controller. The memory controller is then configured to authorize, or not, the erasure of a block on the basis of the value of the EraseAllow byte. For example, when performing steps 200, 201 and 202, upon receipt of a request to erase one of the blocks of the memory 104, the value of a bit, associated with the block whose erasure is requested, of the authorization byte is calculated.

[0056] In the example where the configuration byte is included in the memories 112, for each block of the memory 104 identified, for example by an integer x between 0 and 7, an authorization bit EraseAllov^x\, for example, the x-th bit of the authorization byte is then such that EraseAllow[x] = (LVL1 AND LVL2) OR TestConfig[x], where LVL1 is the state of the first status bit 071, LVL2 is the state of the second status bit 072, and TestConf i^x\ is the state of the bit associated with block x in the TestConfig byte. For example, when the EraseAllow{x\ bit is equal to 0, any request to erase the associated block is refused. Thus, it is possible to erase any block during step 200. During steps 201 and / or 202, erasure of the block identified by the integer x is authorized only if the associated TestConf i$x\ bit was programmed, during step 200, to authorize erasure of the block.

[0057] In the case where the configuration byte is included in the memory 104, the additional byte ProdCon / ig included in the memory 112 is accessible for writing only during step 201, in other words when the circuit 102 is in the intermediate state. It is then not possible to modify the value of the byte ProdConfig during the performance of step 202, in other words when the circuit 102 is in its final state.

[0058] In this example, the x-th bit of the authorization byte is then calculated such that EraseAllow[x] = ( LVL1 AND LVL2) OR (TeslConfig[x] ANDLVL2) OR (Not(LVL2) AND PmdC <mfig[x] ) . Ainsi, il est possible pour l’entité intermédiaire, durant l’étape 201, de modifier et configurer les blocs 300 protégés, ou non, contre l’effacement.

[0059] Various embodiments and variants have been described. Those skilled in the art will understand that certain features of these various embodiments and variants could be combined, and other variants will occur to those skilled in the art. In particular, with regard to the memory 112, although in the embodiments described, a bit of the memory 112 is burned when its value is equal to 0, it is entirely possible for a burned bit to have the value 1. Those skilled in the art will know how to adapt the calculation of the bits of the EraseAllow byte accordingly. In addition, although the examples described illustrate 8 blocks, each of 16 bytes, configurable, it is envi It is possible to configure a higher or lower number of blocks. The blocks can also be of a size other than 16 bytes. The person skilled in the art will be able to adapt the size of the configuration and authorization bytes accordingly.

[0060] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

Claims

1. A method comprising: - programming a first authorization bit (EraseAlloM[x]), associated with an area of ​​a non-volatile memory (104) of an electronic device (100), to a protection value; and - prohibiting erasure of the contents of the first area of ​​the non-volatile memory, based on the state of the first authorization bit.

2. Method according to claim 1, in which the protection value to which the first authorization bit (EraseAllow[x]) is programmed is a function of the state of a first configuration bit (TestConfig[x]) and / or of at least one value (LVL1, LVL2) associated with a state in which the device is placed among a plurality of possible states of the device.

3. The method of claim 2, wherein the configuration bit (TestConfig^x]) is programmable only when the device is placed in a first state among the plurality of states.

4. The method of claim 3, wherein: - the device (100) is placed in a second state among the plurality of states, from the first state, by programming a first state bit (Ivll); and - the device is placed in a third state among the plurality of states, from the first or second state, by programming a second state bit (lvl2) included in a one-time programmable memory (112).

5. The method of claim 4, wherein erasure of the area of ​​the non-volatile memory (104) is enabled when the device (100) is in the first state.

6. The method of claim 4 or 5, wherein the first status bit (Ivll) is included in the non-volatile memory (104).

7. A method according to any one of claims 2 to 6, wherein the configuration bit (TestConfiglx]) is included in a programmable memory (112) only once.

8. A method according to any one of claims 2 to 6, wherein the configuration bit (TestConfig[xJ) is included in the non-volatile memory (104).

9. The method of claim 8, wherein an additional bit (ProdConfig[x}) is included in a programmable memory only once (112) of the device and in which the protection value to which the first authorization bit (EraseAlloM^x^) is programmed is furthermore a function of the additional bit.

10. A method according to claim 8 or 9 in their dependence on claim 4, wherein the additional bit (ProdConfig\x\) is programmable only when the device (100) is placed in the second state (ZvZl).

11. A device comprising a non-volatile memory (104) comprising an area associated with a first authorization bit (EraseAlloM\x\) programmed to a protection value, access for erasing the area being prohibited based on the protection value.

12. Device according to claim 11, in which the protection value to which the authorization bit (EraseAlloM{x\) is programmed is a function of the value of a configuration bit (TestConfi$x\), of a first status bit (ZvZl) included in the non-volatile memory (104) and of a second status bit (ZvZ2) included in a one-time programmable memory (112) of the device.

13. The device of claim 12, wherein the configuration bit (TestConfi$x\) is included in the one-time programmable memory (112).

14. The device of claim 12, wherein the configuration bit (TestConfi^x\) is included in the non-volatile memory (104) and wherein the one-time programmable memory (112) further comprises an additional bit (ProdConfi^x]), the protection value to which the authorization bit is programmed being a function, furthermore, of the state of the additional bit.

15. Device according to any one of claims 12 to 14, wherein the state of the first and / or second status bits (Zv / l, lvl2) determines a state of the device among a first, a second and a third state, and wherein the configuration bit (TestCon fig[x]) is programmable only when the device is in the first state.

Images